amadey | 9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45

Modify Existing Service

T1031

Disabling Security Tools

Processes:

loda.exenika.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	nika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	nika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	nika.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	nika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	nika.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

redline2.exe

description pid process target process

PID 4528 created 2464 4528 redline2.exe taskhostw.exe

description	pid	process	target process
PID 4528 created 2464	4528	redline2.exe	taskhostw.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

58 4164 rundll32.exe
59 3852 rundll32.exe
Downloads MZ/PE file

flow	pid	process
58	4164	rundll32.exe
59	3852	rundll32.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

mian.exelebro.exemeta2.exenbveek.exedwn.exeCBqrmoFax.exemnolyk.exenbveek.exeNOTallowedtocrypt.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	mian.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	lebro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	meta2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dwn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	CBqrmoFax.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	mnolyk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	NOTallowedtocrypt.exe

Executes dropped EXE 36 IoCs

Processes:

hook.exeloda.exeredko.exeaniam.exemian.exemnolyk.exeani.exenika.exerepa.exelebro.exenbveek.exemeta3.exemeta2.exenbveek.exeredline2.execc.exeredline1.exevideo.exemeta4.exeredline4.exeredline3.exemnolyk.exenbveek.exeAurora.exeredline3.exeEngine.exeNOTallowedtocrypt.exemeta5.exe76y5trfed675ytg.exedwn.exemeta5.exeCBqrmoFax.exentlhost.exeRussian.exe.pifnbveek.exemnolyk.exe

pid	process
4568	hook.exe
2236	loda.exe
1916	redko.exe
944	aniam.exe
4476	mian.exe
1384	mnolyk.exe
4164	ani.exe
4992	nika.exe
3264	repa.exe
2224	lebro.exe
4896	nbveek.exe
3448	meta3.exe
512	meta2.exe
2208	nbveek.exe
4528	redline2.exe
4268	cc.exe
480	redline1.exe
4476	video.exe
396	meta4.exe
2648	redline4.exe
1220	redline3.exe
2684	mnolyk.exe
1280	nbveek.exe
2980	Aurora.exe
1996	redline3.exe
3676	Engine.exe
4044	NOTallowedtocrypt.exe
1488	meta5.exe
308	76y5trfed675ytg.exe
5032	dwn.exe
4076	meta5.exe
3252	CBqrmoFax.exe
3288	ntlhost.exe
1356	Russian.exe.pif
3008	nbveek.exe
4576	mnolyk.exe

Loads dropped DLL 7 IoCs

Processes:

redline2.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

4528 redline2.exe
3852 rundll32.exe
3104 rundll32.exe
3732 rundll32.exe
5072 rundll32.exe
5084 rundll32.exe
3368 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4528	redline2.exe
3852	rundll32.exe
3104	rundll32.exe
3732	rundll32.exe
5072	rundll32.exe
5084	rundll32.exe
3368	rundll32.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SETUP_22269\Engine.exe	upx
C:\Users\Admin\AppData\Local\Temp\SETUP_22269\Engine.exe	upx
behavioral1/memory/3676-302-0x0000000000400000-0x0000000000558000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\SETUP_22269\Engine.exe	upx
behavioral1/memory/3676-353-0x0000000000400000-0x0000000000558000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

Modify Registry

Processes:

loda.exenika.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	nika.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

hook.exeaniam.exeNOTallowedtocrypt.exeiexplore.exevideo.exe76y5trfed675ytg.exe9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exedwn.exemnolyk.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hook.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	aniam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	NOTallowedtocrypt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	video.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	76y5trfed675ytg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	76y5trfed675ytg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	76y5trfed675ytg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hook.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	aniam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	NOTallowedtocrypt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	NOTallowedtocrypt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	NOTallowedtocrypt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	76y5trfed675ytg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwn.exe"	dwn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\repa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000015051\\repa.exe"	mnolyk.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

40 api.ipify.org

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

flow	ioc
40	api.ipify.org

Suspicious use of SetThreadContext 8 IoCs

Processes:

redline2.exemeta4.exeredline4.exeredline3.exeAurora.exe76y5trfed675ytg.exeiexplore.exemeta5.exe

description	pid	process	target process
PID 4528 set thread context of 3404	4528	redline2.exe	ngentask.exe
PID 396 set thread context of 3816	396	meta4.exe	vbc.exe
PID 2648 set thread context of 2308	2648	redline4.exe	vbc.exe
PID 1220 set thread context of 1996	1220	redline3.exe	redline3.exe
PID 2980 set thread context of 4164	2980	Aurora.exe	rundll32.exe
PID 308 set thread context of 3564	308	76y5trfed675ytg.exe	iexplore.exe
PID 3564 set thread context of 1392	3564	iexplore.exe	svchost.exe
PID 1488 set thread context of 4076	1488	meta5.exe	meta5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4632	3036	WerFault.exe	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe
4652	396	WerFault.exe	meta4.exe
3156	2648	WerFault.exe	redline4.exe
1392	4528	WerFault.exe	redline2.exe
4588	4528	WerFault.exe	redline2.exe
4824	4268	WerFault.exe	cc.exe
692	3852	WerFault.exe	rundll32.exe
1772	3732	WerFault.exe	rundll32.exe
5004	3368	WerFault.exe	rundll32.exe
4656	1356	WerFault.exe	Russian.exe.pif
2792	1356	WerFault.exe	Russian.exe.pif

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

meta5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	meta5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	meta5.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	meta5.exe

Checks processor information in registry 2 TTPs 58 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Aurora.exerundll32.exerundll32.exesvchost.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Aurora.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	Aurora.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Aurora.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	Aurora.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Aurora.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2000 schtasks.exe
5072 schtasks.exe
4588 schtasks.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 87 Go-http-client/1.1

pid	process
2000	schtasks.exe
5072	schtasks.exe
4588	schtasks.exe

description	flow	ioc
HTTP User-Agent header	87	Go-http-client/1.1

Modifies registry class 4 IoCs

Processes:

NOTallowedtocrypt.exerundll32.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NOTallowedtocrypt.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{12C7EA37-D772-46B5-8330-CB45E3A2CBA7}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{8BC83914-874A-4B88-8AD1-0473AE221BD7}	svchost.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

3340 reg.exe
1328 reg.exe
2968 reg.exe

pid	process
3340	reg.exe
1328	reg.exe
2968	reg.exe

NTFS ADS 3 IoCs

Processes:

dwn.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\16de06bfb4\programs.bat:start	dwn.exe
File created	C:\Users\Admin\Documents\Documents:ApplicationData	dwn.exe
File opened for modification	C:\Users\Admin\Documents\Documents:ApplicationData	dwn.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3860 PING.EXE

pid	process
3860	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

loda.exeredko.exenika.exeani.exerepa.exeredline2.exerundll32.exemeta3.exerundll32.exevbc.exe

pid	process
2236	loda.exe
2236	loda.exe
1916	redko.exe
1916	redko.exe
4992	nika.exe
4992	nika.exe
4164	ani.exe
3264	repa.exe
3264	repa.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4164	rundll32.exe
3448	meta3.exe
3448	meta3.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
4528	redline2.exe
3852	rundll32.exe
3852	rundll32.exe
2308	vbc.exe
2308	vbc.exe
4164	rundll32.exe
4164	rundll32.exe

Suspicious behavior: MapViewOfSection 25 IoCs

Processes:

76y5trfed675ytg.exeiexplore.exemeta5.exeexplorer.exeexplorer.exe

pid	process
308	76y5trfed675ytg.exe
3564	iexplore.exe
4076	meta5.exe
2756
2756
2756
2756
2756
2756
640	explorer.exe
640	explorer.exe
2756
2756
2756
2756
4328	explorer.exe
4328	explorer.exe
2756
2756
2756
2756
2756
2756
2756
2756

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

loda.exeredko.exenika.exeani.exerepa.exemeta3.exevbc.exevbc.exeredline3.exeAUDIODG.EXEpowershell.exepowershell.exepowershell.exeCBqrmoFax.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2236	loda.exe
Token: SeDebugPrivilege	1916	redko.exe
Token: SeDebugPrivilege	4992	nika.exe
Token: SeDebugPrivilege	4164	ani.exe
Token: SeDebugPrivilege	3264	repa.exe
Token: SeDebugPrivilege	3448	meta3.exe
Token: SeDebugPrivilege	3816	vbc.exe
Token: SeDebugPrivilege	2308	vbc.exe
Token: SeDebugPrivilege	1996	redline3.exe
Token: 33	3076	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3076	AUDIODG.EXE
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeDebugPrivilege	3252	CBqrmoFax.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756
Token: SeShutdownPrivilege	2756
Token: SeCreatePagefilePrivilege	2756

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

rundll32.exeRussian.exe.pif

pid process

4164 rundll32.exe
1356 Russian.exe.pif
2756
2756
1356 Russian.exe.pif
1356 Russian.exe.pif
2756
2756
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Russian.exe.pif

pid process

1356 Russian.exe.pif
1356 Russian.exe.pif
1356 Russian.exe.pif
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

OpenWith.exeiexplore.exe

pid process

1956 OpenWith.exe
3564 iexplore.exe

pid	process
4164	rundll32.exe
1356	Russian.exe.pif
2756
2756
1356	Russian.exe.pif
1356	Russian.exe.pif
2756
2756

pid	process
1356	Russian.exe.pif
1356	Russian.exe.pif
1356	Russian.exe.pif

pid	process
1956	OpenWith.exe
3564	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exehook.exeaniam.exemian.exemnolyk.execmd.exelebro.exenbveek.execmd.exe

description	pid	process	target process
PID 3036 wrote to memory of 4568	3036	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe	hook.exe
PID 3036 wrote to memory of 4568	3036	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe	hook.exe
PID 3036 wrote to memory of 4568	3036	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe	hook.exe
PID 4568 wrote to memory of 2236	4568	hook.exe	loda.exe
PID 4568 wrote to memory of 2236	4568	hook.exe	loda.exe
PID 4568 wrote to memory of 1916	4568	hook.exe	redko.exe
PID 4568 wrote to memory of 1916	4568	hook.exe	redko.exe
PID 4568 wrote to memory of 1916	4568	hook.exe	redko.exe
PID 3036 wrote to memory of 944	3036	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe	aniam.exe
PID 3036 wrote to memory of 944	3036	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe	aniam.exe
PID 3036 wrote to memory of 944	3036	9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe	aniam.exe
PID 944 wrote to memory of 4476	944	aniam.exe	mian.exe
PID 944 wrote to memory of 4476	944	aniam.exe	mian.exe
PID 944 wrote to memory of 4476	944	aniam.exe	mian.exe
PID 4476 wrote to memory of 1384	4476	mian.exe	mnolyk.exe
PID 4476 wrote to memory of 1384	4476	mian.exe	mnolyk.exe
PID 4476 wrote to memory of 1384	4476	mian.exe	mnolyk.exe
PID 944 wrote to memory of 4164	944	aniam.exe	ani.exe
PID 944 wrote to memory of 4164	944	aniam.exe	ani.exe
PID 944 wrote to memory of 4164	944	aniam.exe	ani.exe
PID 1384 wrote to memory of 2000	1384	mnolyk.exe	schtasks.exe
PID 1384 wrote to memory of 2000	1384	mnolyk.exe	schtasks.exe
PID 1384 wrote to memory of 2000	1384	mnolyk.exe	schtasks.exe
PID 1384 wrote to memory of 1188	1384	mnolyk.exe	cmd.exe
PID 1384 wrote to memory of 1188	1384	mnolyk.exe	cmd.exe
PID 1384 wrote to memory of 1188	1384	mnolyk.exe	cmd.exe
PID 1188 wrote to memory of 1448	1188	cmd.exe	cmd.exe
PID 1188 wrote to memory of 1448	1188	cmd.exe	cmd.exe
PID 1188 wrote to memory of 1448	1188	cmd.exe	cmd.exe
PID 1188 wrote to memory of 3736	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 3736	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 3736	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 4236	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 4236	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 4236	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 1060	1188	cmd.exe	cmd.exe
PID 1188 wrote to memory of 1060	1188	cmd.exe	cmd.exe
PID 1188 wrote to memory of 1060	1188	cmd.exe	cmd.exe
PID 1188 wrote to memory of 2080	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 2080	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 2080	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 5020	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 5020	1188	cmd.exe	cacls.exe
PID 1188 wrote to memory of 5020	1188	cmd.exe	cacls.exe
PID 1384 wrote to memory of 4992	1384	mnolyk.exe	nika.exe
PID 1384 wrote to memory of 4992	1384	mnolyk.exe	nika.exe
PID 1384 wrote to memory of 3264	1384	mnolyk.exe	repa.exe
PID 1384 wrote to memory of 3264	1384	mnolyk.exe	repa.exe
PID 1384 wrote to memory of 3264	1384	mnolyk.exe	repa.exe
PID 1384 wrote to memory of 2224	1384	mnolyk.exe	lebro.exe
PID 1384 wrote to memory of 2224	1384	mnolyk.exe	lebro.exe
PID 1384 wrote to memory of 2224	1384	mnolyk.exe	lebro.exe
PID 2224 wrote to memory of 4896	2224	lebro.exe	nbveek.exe
PID 2224 wrote to memory of 4896	2224	lebro.exe	nbveek.exe
PID 2224 wrote to memory of 4896	2224	lebro.exe	nbveek.exe
PID 4896 wrote to memory of 5072	4896	nbveek.exe	schtasks.exe
PID 4896 wrote to memory of 5072	4896	nbveek.exe	schtasks.exe
PID 4896 wrote to memory of 5072	4896	nbveek.exe	schtasks.exe
PID 4896 wrote to memory of 5004	4896	nbveek.exe	cmd.exe
PID 4896 wrote to memory of 5004	4896	nbveek.exe	cmd.exe
PID 4896 wrote to memory of 5004	4896	nbveek.exe	cmd.exe
PID 5004 wrote to memory of 1268	5004	cmd.exe	cmd.exe
PID 5004 wrote to memory of 1268	5004	cmd.exe	cmd.exe
PID 5004 wrote to memory of 1268	5004	cmd.exe	cmd.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2464

C:\Windows\SysWOW64\fontview.exe
"C:\Windows\SYSWOW64\fontview.exe"
2⤵
PID:3268

C:\Users\Admin\AppData\Local\Temp\9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe
"C:\Users\Admin\AppData\Local\Temp\9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aniam.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aniam.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mian.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mian.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F
5⤵
- Creates scheduled task(s)
PID:2000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:1448

C:\Windows\SysWOW64\cacls.exe
CACLS "mnolyk.exe" /P "Admin:N"
6⤵
PID:3736

C:\Windows\SysWOW64\cacls.exe
CACLS "mnolyk.exe" /P "Admin:R" /E
6⤵
PID:4236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:1060

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5eb6b96734" /P "Admin:N"
6⤵
PID:2080

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5eb6b96734" /P "Admin:R" /E
6⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\1000014001\nika.exe
"C:\Users\Admin\AppData\Local\Temp\1000014001\nika.exe"
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Users\Admin\AppData\Local\Temp\1000015051\repa.exe
"C:\Users\Admin\AppData\Local\Temp\1000015051\repa.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Users\Admin\AppData\Local\Temp\1000018001\lebro.exe
"C:\Users\Admin\AppData\Local\Temp\1000018001\lebro.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
7⤵
- Creates scheduled task(s)
PID:5072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit
7⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
8⤵
PID:2836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:1268

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
8⤵
PID:1368

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:N"
8⤵
PID:1220

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:4900

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:R" /E
8⤵
PID:4284

C:\Users\Admin\AppData\Local\Temp\1000003001\meta3.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\meta3.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe
"C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
PID:512

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
PID:2208

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
9⤵
- Creates scheduled task(s)
PID:4588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
9⤵
PID:4956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
10⤵
PID:4628

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
10⤵
PID:1840

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
10⤵
PID:4360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
10⤵
PID:2400

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
10⤵
PID:3668

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
10⤵
PID:2376

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
9⤵
- Loads dropped DLL
PID:5084

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
10⤵
- Loads dropped DLL
PID:3368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3368 -s 680
11⤵
- Program crash
PID:5004

C:\Users\Admin\AppData\Local\Temp\1000043001\redline2.exe
"C:\Users\Admin\AppData\Local\Temp\1000043001\redline2.exe"
7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
8⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 720
8⤵
- Program crash
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 948
8⤵
- Program crash
PID:4588

C:\Users\Admin\AppData\Local\Temp\1000063001\cc.exe
"C:\Users\Admin\AppData\Local\Temp\1000063001\cc.exe"
7⤵
- Executes dropped EXE
PID:4268

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\nsis_unse57c043.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8E37AEwhAFUAaABCvhcASwBDAHhDADDvADkASi0CWUiD|+wo6AQCAABI|4PEKMPMzMxM|4lEJBhIiVQkvxBIiUwkCF0BSP+LRCQwSIkEJPaBAThIbwAISMdE2yQQLQHrDoEBEEjXg8ABjwEQgQFASO05lgBzJZ8Diwwk|0gDyEiLwUiL9UyrAVR7AAPRSIt|yooJiAjrwWYFv2VIiwQlYPPwM||JSItQGEg70f90NkiDwiBIi|8CSDvCdCpmg|94SBh1GkyLQP9QZkGDOGt0B+4REUt1CBEQeBAu|3QFSIsA69VI64tI|QDBagBAU1X|VldBVEFVQVb7QVddAWaBOU1a|02L+EyL8kiL79kPhfzz8ExjSf88QYE8CVBFAO8AD4Xq8|BBi4T7CYjz8IXASI087wEPhNZqEYO8Cd2MLQEPhMfz8ESL|2cgRItfHIt3|yREi08YTAPh|0wD2UgD8TPJv0WFyQ+EpDkBi||EQYsQRTPSSP8D04oChMB0HX9BwcoND77A+gDvAUQD0L8RdexB|4H6qvwNfHQO|4PBAUmDwARB|zvJc2nrxovB|w+3DE5FiyyLf0wD63RYM+2qEN90UUGLFMEA0zP|yYoCTIvC6w|bwcnIEQPI5RABQfuKANUQ7TPAM|bPQTsMtuAQpgCDxv8Bg|gIcu7rCv9Ii8tB|9VJie8E94PF5BDEBDvvbxhyr2YBQV9B|15BXUFcX15dfVszF0iB7GABZAD|i+noZv7||0jfhcAPhJh1IEyN+q8BiysQyDP|6Jv+fSCNXwRMjUVG|zPSi8v|VCRofoAgTIvgD4RrdSC9RagQM8CL05EgSK+JfCQgpiBwgCBIn4vwD4RLdSCmIFD|SI1WCESNR0DvSI2MJIURSIvYd+h8|X4gjVZI3iC1EOIhzPPw6GfvIESfiwaNVwhBIKYgWF7KIYmEJICHEt7z8HuLDtogWImMJHERbAcwkSDoMe8gi5wtMv9Mi106SIP7bP1IiiAwTIlkJDh3TIukGjJMiVyEAbeEJNyHEYaSjRGN3UdLMIwk8PPwSYtv1Ojp|AUwipx4MvdIjYR4MkGA8yG|jU9sRDAYpAKDv+kBdfOBvHgyIf9SZXh1TYuEJN30IjGUJPg1AcJI|zvYcjiD+mx23zNEjUlA+gCUQdO4AJgApiBAyiL4dPMZRLYwwDFJjVQk|WyRIEmD6Gzoa+6CMEiLzqYgeEiFf|90EotVQkyOMP4bMUiNTCRA|9cHSIHEdCFhJC0ILQE=
8⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3852 -s 648
9⤵
- Program crash
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 712
8⤵
- Program crash
PID:4824

C:\Users\Admin\AppData\Local\Temp\1000090001\redline1.exe
"C:\Users\Admin\AppData\Local\Temp\1000090001\redline1.exe"
7⤵
- Executes dropped EXE
PID:480

C:\Users\Admin\AppData\Local\Temp\SETUP_22269\Engine.exe
C:\Users\Admin\AppData\Local\Temp\SETUP_22269\Engine.exe /TH_ID=_3928 /OriginExe="C:\Users\Admin\AppData\Local\Temp\1000090001\redline1.exe"
8⤵
- Executes dropped EXE
PID:3676

C:\Windows\SysWOW64\CmD.exe
C:\Windows\system32\CmD.exe /c cmd < 80
9⤵
PID:1800

C:\Windows\SysWOW64\cmd.exe
cmd
10⤵
PID:2716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell get-process avastui
11⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell get-process avgui
11⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\SysWOW64\certutil.exe
certutil -decode 5 5fbHlM
11⤵
PID:692

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^BYLhzgJfvHMGFGbkIYAzlXUMcmgLOfzNNBjXWVOwahotMobsaoVUFcQEtYSUZYBuhYTtzmgNlmwWOQZjwXaFxnosKI$" 5fbHlM
11⤵
PID:1840

C:\Users\Admin\AppData\Local\Temp\q25jy1i2.aam\15157\Russian.exe.pif
15157\\Russian.exe.pif 15157\\N
11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 1884
12⤵
- Program crash
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 1860
12⤵
- Program crash
PID:2792

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 18
11⤵
- Runs ping.exe
PID:3860

C:\Users\Admin\AppData\Local\Temp\1000125001\video.exe
"C:\Users\Admin\AppData\Local\Temp\1000125001\video.exe"
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4476

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
8⤵
- Executes dropped EXE
PID:3288

C:\Users\Admin\AppData\Local\Temp\1000126001\meta4.exe
"C:\Users\Admin\AppData\Local\Temp\1000126001\meta4.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 556
8⤵
- Program crash
PID:4652

C:\Users\Admin\AppData\Local\Temp\1000129001\redline4.exe
"C:\Users\Admin\AppData\Local\Temp\1000129001\redline4.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 556
8⤵
- Program crash
PID:3156

C:\Users\Admin\AppData\Local\Temp\1000135001\redline3.exe
"C:\Users\Admin\AppData\Local\Temp\1000135001\redline3.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1220

C:\Users\Admin\AppData\Local\Temp\1000135001\redline3.exe
C:\Users\Admin\AppData\Local\Temp\1000135001\redline3.exe
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Users\Admin\AppData\Local\Temp\1000136001\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\1000136001\Aurora.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:2980

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
8⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4164

C:\Users\Admin\AppData\Local\Temp\1000137001\NOTallowedtocrypt.exe
"C:\Users\Admin\AppData\Local\Temp\1000137001\NOTallowedtocrypt.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:4044

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
8⤵
PID:3036

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
9⤵
- UAC bypass
- Modifies registry key
PID:2968

C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe
"C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe"
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:308

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
9⤵
PID:4940

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
10⤵
- UAC bypass
- Modifies registry key
PID:3340

\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe"
9⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
10⤵
PID:4616

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
11⤵
- UAC bypass
- Modifies registry key
PID:1328

C:\Windows\SysWOW64\svchost.exe
svchost.exe
10⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\dwn.exe
"C:\Users\Admin\AppData\Local\Temp\dwn.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
PID:5032

C:\Users\Admin\AppData\Roaming\CBqrmoFax.exe
"C:\Users\Admin\AppData\Roaming\CBqrmoFax.exe"
11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAzAA==
12⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAQwBCAHEAcgBtAG8ARgBhAHgALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
12⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe
"C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1488

C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe
"C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe"
8⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4076

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
7⤵
- Loads dropped DLL
PID:3104

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
8⤵
- Loads dropped DLL
PID:3732

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3732 -s 684
9⤵
- Program crash
PID:1772

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
7⤵
- Loads dropped DLL
PID:5072

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ani.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ani.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 448
2⤵
- Program crash
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3036 -ip 3036
1⤵
PID:4168

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
1⤵
- Executes dropped EXE
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 396 -ip 396
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2648 -ip 2648
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4528 -ip 4528
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4528 -ip 4528
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4268 -ip 4268
1⤵
PID:1240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3084

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x52c 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 3852 -ip 3852
1⤵
PID:4756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 3732 -ip 3732
1⤵
PID:4996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 3368 -ip 3368
1⤵
PID:4360

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4236

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4092

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:640

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2588

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4328

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1468

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:3008

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4312

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1356 -ip 1356
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1356 -ip 1356
1⤵
PID:2096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

Bypass User Account Control

T1088

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery