nymaim | 23941746340e89fb699e4ecec106fbfd40186fc5b483bf72d82d5d5a2706863f

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ZSJWjNw1edEt9wRVo4oqoF9b.exe

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
2308	HZuhItls9SqPLo6sEtCqnsyA.exe
1272	pREoY0OVPs02owNSI7mWh8Js.exe
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe
1928	r13hjE8Crkq7EU3AfdoQ2QGo.exe
2272	0oEWhwEmQ7_W0mjmQh3V9fnn.exe
3208	is-BIONS.tmp
5096	P4H8kl9RvTiQ9aY1fyJ5me_1.exe
1300	fhsearcher65.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000e000000022fa0-149.dat	vmprotect
behavioral2/files/0x000e000000022fa0-152.dat	vmprotect
behavioral2/memory/1928-158-0x0000000140000000-0x0000000140616000-memory.dmp	vmprotect
behavioral2/files/0x000200000001e58a-280.dat	vmprotect
behavioral2/files/0x000200000001e58a-279.dat	vmprotect
behavioral2/memory/3232-295-0x0000000140000000-0x0000000140616000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ZSJWjNw1edEt9wRVo4oqoF9b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ZSJWjNw1edEt9wRVo4oqoF9b.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	6069a4aea1cda39a5473e5f4d5345208.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	P4H8kl9RvTiQ9aY1fyJ5me_1.exe

Loads dropped DLL 1 IoCs

pid	Process
3208	is-BIONS.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ZSJWjNw1edEt9wRVo4oqoF9b.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ipinfo.io
18	ipinfo.io
144	ipinfo.io
145	ipinfo.io
153	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	6069a4aea1cda39a5473e5f4d5345208.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	6069a4aea1cda39a5473e5f4d5345208.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	6069a4aea1cda39a5473e5f4d5345208.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	6069a4aea1cda39a5473e5f4d5345208.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\unins000.dat	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-9ADJN.tmp	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-S781V.tmp	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-05B37.tmp	is-BIONS.tmp
File opened for modification	C:\Program Files (x86)\fhSearcher\unins000.dat	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-HSNPG.tmp	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-IGTAG.tmp	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-T8N72.tmp	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-U58BN.tmp	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-F1ECO.tmp	is-BIONS.tmp
File created	C:\Program Files (x86)\fhSearcher\is-94R9N.tmp	is-BIONS.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
5024	4772	WerFault.exe	77
2080	4772	WerFault.exe	77
2220	4772	WerFault.exe	77
3620	4772	WerFault.exe	77
1648	4772	WerFault.exe	77
1148	4772	WerFault.exe	77
2772	4772	WerFault.exe	77
1664	4772	WerFault.exe	77
2688	4772	WerFault.exe	77
3396	4772	WerFault.exe	77
2024	4772	WerFault.exe	77
3820	4772	WerFault.exe	77
4064	4772	WerFault.exe	77
860	4772	WerFault.exe	77
2432	4772	WerFault.exe	77
2604	4772	WerFault.exe	77
2908	4772	WerFault.exe	77
3680	4772	WerFault.exe	77
1888	4772	WerFault.exe	77
3720	4772	WerFault.exe	77
1052	4772	WerFault.exe	77
532	4772	WerFault.exe	77
4028	4772	WerFault.exe	77
3744	4772	WerFault.exe	77
4576	4772	WerFault.exe	77
1728	4772	WerFault.exe	77
4200	4772	WerFault.exe	77
1688	4772	WerFault.exe	77
3900	4772	WerFault.exe	77
1968	4772	WerFault.exe	77
2772	4772	WerFault.exe	77
1672	4772	WerFault.exe	77
2428	4772	WerFault.exe	77
5108	4772	WerFault.exe	77
4972	4772	WerFault.exe	77
2552	4772	WerFault.exe	77
2272	4772	WerFault.exe	77
4252	4772	WerFault.exe	77
4840	4772	WerFault.exe	77
860	4772	WerFault.exe	77
3380	4772	WerFault.exe	77
1848	4772	WerFault.exe	77
2712	4772	WerFault.exe	77
1712	4772	WerFault.exe	77
4400	4772	WerFault.exe	77
2108	4772	WerFault.exe	77
748	4772	WerFault.exe	77
532	4772	WerFault.exe	77
3560	4772	WerFault.exe	77
3744	4772	WerFault.exe	77
4576	4772	WerFault.exe	77
1728	4772	WerFault.exe	77
316	4772	WerFault.exe	77
1140	4772	WerFault.exe	77
932	4772	WerFault.exe	77
1648	4772	WerFault.exe	77
3148	4772	WerFault.exe	77
3308	4772	WerFault.exe	77
5100	4772	WerFault.exe	77
3444	4772	WerFault.exe	77
2356	4772	WerFault.exe	77
3116	4772	WerFault.exe	77
1964	4772	WerFault.exe	77
4860	4772	WerFault.exe	77

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pREoY0OVPs02owNSI7mWh8Js.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pREoY0OVPs02owNSI7mWh8Js.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pREoY0OVPs02owNSI7mWh8Js.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3924	schtasks.exe
216	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	P4H8kl9RvTiQ9aY1fyJ5me_1.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4772	6069a4aea1cda39a5473e5f4d5345208.exe
4772	6069a4aea1cda39a5473e5f4d5345208.exe
1272	pREoY0OVPs02owNSI7mWh8Js.exe
1272	pREoY0OVPs02owNSI7mWh8Js.exe
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe
3564	ZSJWjNw1edEt9wRVo4oqoF9b.exe
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1272	pREoY0OVPs02owNSI7mWh8Js.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3564	4772	6069a4aea1cda39a5473e5f4d5345208.exe	218
PID 4772 wrote to memory of 3564	4772	6069a4aea1cda39a5473e5f4d5345208.exe	218
PID 4772 wrote to memory of 3564	4772	6069a4aea1cda39a5473e5f4d5345208.exe	218
PID 4772 wrote to memory of 2308	4772	6069a4aea1cda39a5473e5f4d5345208.exe	216
PID 4772 wrote to memory of 2308	4772	6069a4aea1cda39a5473e5f4d5345208.exe	216
PID 4772 wrote to memory of 2308	4772	6069a4aea1cda39a5473e5f4d5345208.exe	216
PID 4772 wrote to memory of 1272	4772	6069a4aea1cda39a5473e5f4d5345208.exe	215
PID 4772 wrote to memory of 1272	4772	6069a4aea1cda39a5473e5f4d5345208.exe	215
PID 4772 wrote to memory of 1272	4772	6069a4aea1cda39a5473e5f4d5345208.exe	215
PID 4772 wrote to memory of 2272	4772	6069a4aea1cda39a5473e5f4d5345208.exe	217
PID 4772 wrote to memory of 2272	4772	6069a4aea1cda39a5473e5f4d5345208.exe	217
PID 4772 wrote to memory of 2272	4772	6069a4aea1cda39a5473e5f4d5345208.exe	217
PID 4772 wrote to memory of 1928	4772	6069a4aea1cda39a5473e5f4d5345208.exe	214
PID 4772 wrote to memory of 1928	4772	6069a4aea1cda39a5473e5f4d5345208.exe	214
PID 2308 wrote to memory of 3208	2308	HZuhItls9SqPLo6sEtCqnsyA.exe	220
PID 2308 wrote to memory of 3208	2308	HZuhItls9SqPLo6sEtCqnsyA.exe	220
PID 2308 wrote to memory of 3208	2308	HZuhItls9SqPLo6sEtCqnsyA.exe	220
PID 4772 wrote to memory of 5096	4772	6069a4aea1cda39a5473e5f4d5345208.exe	221
PID 4772 wrote to memory of 5096	4772	6069a4aea1cda39a5473e5f4d5345208.exe	221
PID 4772 wrote to memory of 5096	4772	6069a4aea1cda39a5473e5f4d5345208.exe	221
PID 3208 wrote to memory of 1300	3208	is-BIONS.tmp	224
PID 3208 wrote to memory of 1300	3208	is-BIONS.tmp	224
PID 3208 wrote to memory of 1300	3208	is-BIONS.tmp	224
PID 5096 wrote to memory of 4320	5096	P4H8kl9RvTiQ9aY1fyJ5me_1.exe	225
PID 5096 wrote to memory of 4320	5096	P4H8kl9RvTiQ9aY1fyJ5me_1.exe	225
PID 5096 wrote to memory of 4320	5096	P4H8kl9RvTiQ9aY1fyJ5me_1.exe	225

C:\Users\Admin\AppData\Local\Temp\6069a4aea1cda39a5473e5f4d5345208.exe
"C:\Users\Admin\AppData\Local\Temp\6069a4aea1cda39a5473e5f4d5345208.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 816
  2⤵
  - Program crash
  PID:5024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 788
  2⤵
  - Program crash
  PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 584
  2⤵
  - Program crash
  PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 760
  2⤵
  - Program crash
  PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1120
  2⤵
  - Program crash
  PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1392
  2⤵
  - Program crash
  PID:1148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1452
  2⤵
  - Program crash
  PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1708
  2⤵
  - Program crash
  PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1748
  2⤵
  - Program crash
  PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1816
  2⤵
  - Program crash
  PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1840
  2⤵
  - Program crash
  PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1904
  2⤵
  - Program crash
  PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1844
  2⤵
  - Program crash
  PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1904
  2⤵
  - Program crash
  PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1504
  2⤵
  - Program crash
  PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1744
  2⤵
  - Program crash
  PID:2604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1512
  2⤵
  - Program crash
  PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1940
  2⤵
  - Program crash
  PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1964
  2⤵
  - Program crash
  PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1512
  2⤵
  - Program crash
  PID:3720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1988
  2⤵
  - Program crash
  PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1996
  2⤵
  - Program crash
  PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1812
  2⤵
  - Program crash
  PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1796
  2⤵
  - Program crash
  PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1788
  2⤵
  - Program crash
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1996
  2⤵
  - Program crash
  PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1728
  2⤵
  - Program crash
  PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1952
  2⤵
  - Program crash
  PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1732
  2⤵
  - Program crash
  PID:3900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2020
  2⤵
  - Program crash
  PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1792
  2⤵
  - Program crash
  PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1972
  2⤵
  - Program crash
  PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1912
  2⤵
  - Program crash
  PID:2428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2144
  2⤵
  - Program crash
  PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2204
  2⤵
  - Program crash
  PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2248
  2⤵
  - Program crash
  PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2268
  2⤵
  - Program crash
  PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2288
  2⤵
  - Program crash
  PID:4252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2340
  2⤵
  - Program crash
  PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2164
  2⤵
  - Program crash
  PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2300
  2⤵
  - Program crash
  PID:3380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2308
  2⤵
  - Program crash
  PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2384
  2⤵
  - Program crash
  PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2224
  2⤵
  - Program crash
  PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2292
  2⤵
  - Program crash
  PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2344
  2⤵
  - Program crash
  PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2348
  2⤵
  - Program crash
  PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2264
  2⤵
  - Program crash
  PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1944
  2⤵
  - Program crash
  PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1512
  2⤵
  - Program crash
  PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2336
  2⤵
  - Program crash
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2232
  2⤵
  - Program crash
  PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1476
  2⤵
  - Program crash
  PID:316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2184
  2⤵
  - Program crash
  PID:1140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2292
  2⤵
  - Program crash
  PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1312
  2⤵
  - Program crash
  PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3672
  2⤵
  - Program crash
  PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3720
  2⤵
  - Program crash
  PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3872
  2⤵
  - Program crash
  PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3916
  2⤵
  - Program crash
  PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3972
  2⤵
  - Program crash
  PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 4008
  2⤵
  - Program crash
  PID:3116
- C:\Users\Admin\Pictures\Minor Policy\r13hjE8Crkq7EU3AfdoQ2QGo.exe
  "C:\Users\Admin\Pictures\Minor Policy\r13hjE8Crkq7EU3AfdoQ2QGo.exe"
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Users\Admin\Pictures\Minor Policy\pREoY0OVPs02owNSI7mWh8Js.exe
  "C:\Users\Admin\Pictures\Minor Policy\pREoY0OVPs02owNSI7mWh8Js.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1272
- C:\Users\Admin\Pictures\Minor Policy\HZuhItls9SqPLo6sEtCqnsyA.exe
  "C:\Users\Admin\Pictures\Minor Policy\HZuhItls9SqPLo6sEtCqnsyA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\is-UM3G9.tmp\is-BIONS.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-UM3G9.tmp\is-BIONS.tmp" /SL4 $E0050 "C:\Users\Admin\Pictures\Minor Policy\HZuhItls9SqPLo6sEtCqnsyA.exe" 2377859 52736
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
      "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe"
      4⤵
      Executes dropped EXE
      PID:1300
    - - C:\Users\Admin\AppData\Roaming\{1ca2f389-1ab8-11ed-aebb-806e6f6e6963}\Z6Tg9iUl.exe
        
        5⤵
        
        PID:2928
- C:\Users\Admin\Pictures\Minor Policy\0oEWhwEmQ7_W0mjmQh3V9fnn.exe
  "C:\Users\Admin\Pictures\Minor Policy\0oEWhwEmQ7_W0mjmQh3V9fnn.exe"
  2⤵
  - Executes dropped EXE
  PID:2272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    3⤵
    PID:2988
- C:\Users\Admin\Pictures\Minor Policy\ZSJWjNw1edEt9wRVo4oqoF9b.exe
  "C:\Users\Admin\Pictures\Minor Policy\ZSJWjNw1edEt9wRVo4oqoF9b.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- - C:\Users\Admin\Documents\jd1epbJLSclpIj6IF1nNuQx8.exe
    "C:\Users\Admin\Documents\jd1epbJLSclpIj6IF1nNuQx8.exe"
    3⤵
    PID:1980
  - - C:\Users\Admin\Pictures\Minor Policy\V5M3G8by0KKniGZm8Uk88arX.exe
      "C:\Users\Admin\Pictures\Minor Policy\V5M3G8by0KKniGZm8Uk88arX.exe"
      4⤵
      PID:4180
    - - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\B2Gd.CpL",
        5⤵
        
        PID:1312
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\B2Gd.CpL",
        6⤵
        
        PID:1040
  - - C:\Users\Admin\Pictures\Minor Policy\bwKBie9s9BqJWJs0l25tyQOA.exe
      "C:\Users\Admin\Pictures\Minor Policy\bwKBie9s9BqJWJs0l25tyQOA.exe"
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\7zSEF8B.tmp\Install.exe
        
        .\Install.exe
        5⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\7zS111D.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        6⤵
        
        PID:392
  - - C:\Users\Admin\Pictures\Minor Policy\TFiEUdG5Lpr8tJ5Ja30fZmnP.exe
      "C:\Users\Admin\Pictures\Minor Policy\TFiEUdG5Lpr8tJ5Ja30fZmnP.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=747
      4⤵
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\is-6GPS0.tmp\TFiEUdG5Lpr8tJ5Ja30fZmnP.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6GPS0.tmp\TFiEUdG5Lpr8tJ5Ja30fZmnP.tmp" /SL5="$B007C,11860388,791040,C:\Users\Admin\Pictures\Minor Policy\TFiEUdG5Lpr8tJ5Ja30fZmnP.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=747
        5⤵
        
        PID:4720
  - - C:\Users\Admin\Pictures\Minor Policy\ALqIzJo0vdwM9Gxm8A5BWvgk.exe
      "C:\Users\Admin\Pictures\Minor Policy\ALqIzJo0vdwM9Gxm8A5BWvgk.exe"
      4⤵
      PID:404
  - - C:\Users\Admin\Pictures\Minor Policy\lONkLqHQMdF94OKglNzennQB.exe
      "C:\Users\Admin\Pictures\Minor Policy\lONkLqHQMdF94OKglNzennQB.exe"
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\is-NSQ3C.tmp\lONkLqHQMdF94OKglNzennQB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NSQ3C.tmp\lONkLqHQMdF94OKglNzennQB.tmp" /SL5="$10254,140559,56832,C:\Users\Admin\Pictures\Minor Policy\lONkLqHQMdF94OKglNzennQB.exe"
        5⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\is-C428Q.tmp\PowerOff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-C428Q.tmp\PowerOff.exe" /S /UID=95
        6⤵
        
        PID:2816
  - - C:\Users\Admin\Pictures\Minor Policy\YjMprqu5xAcbla1gyJnKqqzr.exe
      "C:\Users\Admin\Pictures\Minor Policy\YjMprqu5xAcbla1gyJnKqqzr.exe"
      4⤵
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\is-LDEAP.tmp\is-V7VHH.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LDEAP.tmp\is-V7VHH.tmp" /SL4 $10256 "C:\Users\Admin\Pictures\Minor Policy\YjMprqu5xAcbla1gyJnKqqzr.exe" 2377859 52736
        5⤵
        
        PID:1292
  - - C:\Users\Admin\Pictures\Minor Policy\4teNqIv2lkZ33ZMSMGh57zMH.exe
      "C:\Users\Admin\Pictures\Minor Policy\4teNqIv2lkZ33ZMSMGh57zMH.exe"
      4⤵
      PID:3232
  - - C:\Users\Admin\Pictures\Minor Policy\FJ4RKqXx0Acs6TkycEqaPf7b.exe
      "C:\Users\Admin\Pictures\Minor Policy\FJ4RKqXx0Acs6TkycEqaPf7b.exe"
      4⤵
      PID:1404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 340
        5⤵
        
        PID:1072
  - - C:\Users\Admin\Pictures\Minor Policy\UnVxJS6rJx6oQrGaO8w0NyPG.exe
      "C:\Users\Admin\Pictures\Minor Policy\UnVxJS6rJx6oQrGaO8w0NyPG.exe"
      4⤵
      PID:4816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 4044
  2⤵
  - Program crash
  PID:1964
- C:\Users\Admin\Pictures\Minor Policy\P4H8kl9RvTiQ9aY1fyJ5me_1.exe
  "C:\Users\Admin\Pictures\Minor Policy\P4H8kl9RvTiQ9aY1fyJ5me_1.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\B2Gd.CpL",
    3⤵
    PID:4320
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\B2Gd.CpL",
      4⤵
      PID:4028
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\B2Gd.CpL",
        5⤵
        
        PID:4440
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\B2Gd.CpL",
        6⤵
        
        PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 4052
  2⤵
  - Program crash
  PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1928
  2⤵
  PID:904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1960
  2⤵
  PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2112
  2⤵
  PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1812
  2⤵
  PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 2240
  2⤵
  PID:3740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3868
  2⤵
  PID:260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3672
  2⤵
  PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4772 -ip 4772
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4772 -ip 4772
1⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4772 -ip 4772
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4772 -ip 4772
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4772 -ip 4772
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4772 -ip 4772
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4772 -ip 4772
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4772 -ip 4772
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4772 -ip 4772
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4772 -ip 4772
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4772 -ip 4772
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4772 -ip 4772
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4772 -ip 4772
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4772 -ip 4772
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4772 -ip 4772
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4772 -ip 4772
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4772 -ip 4772
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4772 -ip 4772
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4772 -ip 4772
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4772 -ip 4772
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4772 -ip 4772
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4772 -ip 4772
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4772 -ip 4772
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4772 -ip 4772
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4772 -ip 4772
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4772 -ip 4772
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4772 -ip 4772
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4772 -ip 4772
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4772 -ip 4772
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4772 -ip 4772
1⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4772 -ip 4772
1⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4772 -ip 4772
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 4772 -ip 4772
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 4772 -ip 4772
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4772 -ip 4772
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4772 -ip 4772
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4772 -ip 4772
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4772 -ip 4772
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4772 -ip 4772
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4772 -ip 4772
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4772 -ip 4772
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4772 -ip 4772
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4772 -ip 4772
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4772 -ip 4772
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4772 -ip 4772
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4772 -ip 4772
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4772 -ip 4772
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 4772 -ip 4772
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4772 -ip 4772
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4772 -ip 4772
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 4772 -ip 4772
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4772 -ip 4772
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 4772 -ip 4772
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4772 -ip 4772
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4772 -ip 4772
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4772 -ip 4772
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4772 -ip 4772
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4772 -ip 4772
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4772 -ip 4772
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4772 -ip 4772
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4772 -ip 4772
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4772 -ip 4772
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4772 -ip 4772
1⤵
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 4772 -ip 4772
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4772 -ip 4772
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4772 -ip 4772
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4772 -ip 4772
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4772 -ip 4772
1⤵
PID:3396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4772 -ip 4772
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4772 -ip 4772
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 1404 -ip 1404
1⤵
PID:2608

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1DA0.dll
1⤵
PID:920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1DA0.dll
  2⤵
  PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 4772 -ip 4772
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\236D.exe
C:\Users\Admin\AppData\Local\Temp\236D.exe
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery