djvu | 1eab7c51b272877d1b2add88dffdda0303aa05a4a26d7b14d32b5008df446e19

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	D684.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	yuzhenzhang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	build3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	FDF7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	DB86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	C9CE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	F9DF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	FDF7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	F9DF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	C9CE.exe

Executes dropped EXE 34 IoCs

pid	Process
796	B8A6.exe
1692	C9CE.exe
3268	CB65.exe
400	C9CE.exe
3200	CF00.exe
2296	D1A1.exe
4440	D684.exe
2916	DB86.exe
3516	llpb1133.exe
4376	llpb1133.exe
3572	E0F6.exe
1076	yuzhenzhang.exe
3184	E3D5.exe
4632	yuzhenzhang.exe
4028	F9DF.exe
3672	FDF7.exe
4316	F9DF.exe
1612	C9CE.exe
2632	F9DF.exe
1456	FDF7.exe
380	C9CE.exe
216	FDF7.exe
2544	svcupdater.exe
1140	F9DF.exe
2064	build2.exe
5060	build2.exe
1496	build3.exe
1120	build3.exe
5080	FDF7.exe
3088	2B36.tmp.exe
4368	build2.exe
2800	build2.exe
896	build2.exe
3268	build3.exe

Loads dropped DLL 4 IoCs

pid	Process
4520	rundll32.exe
3032	rundll32.exe
2800	build2.exe
2800	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4592	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0006000000022e2e-170.dat	vmprotect
behavioral2/files/0x0006000000022e2e-171.dat	vmprotect
behavioral2/files/0x0006000000022e2e-174.dat	vmprotect
behavioral2/files/0x0006000000022e2e-176.dat	vmprotect
behavioral2/memory/4376-187-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect
behavioral2/memory/3516-188-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3601c3cf-7255-41f8-9677-289125673562\\C9CE.exe\" --AutoStart"	C9CE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	api.2ip.ua
57	api.2ip.ua
70	api.2ip.ua
26	api.2ip.ua
27	api.2ip.ua
46	api.2ip.ua
52	api.2ip.ua

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 400	1692	C9CE.exe	88
PID 4028 set thread context of 4316	4028	F9DF.exe	117
PID 3672 set thread context of 1456	3672	FDF7.exe	126
PID 1612 set thread context of 380	1612	C9CE.exe	127
PID 2632 set thread context of 1140	2632	F9DF.exe	129
PID 216 set thread context of 5080	216	FDF7.exe	136
PID 2064 set thread context of 4368	2064	build2.exe	139
PID 5060 set thread context of 2800	5060	build2.exe	138
PID 3088 set thread context of 444	3088	2B36.tmp.exe	146

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
904	2296	WerFault.exe	90
4388	4440	WerFault.exe	91
1800	3184	WerFault.exe	100
3116	3268	WerFault.exe	87
4448	3032	WerFault.exe	120
1500	4368	WerFault.exe	139

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF00.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E0F6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF00.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E0F6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E0F6.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2072	schtasks.exe
1716	schtasks.exe
2700	schtasks.exe
4676	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1624	timeout.exe
3264	timeout.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4652	file.exe
4652	file.exe
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found
2020	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2020	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4652	file.exe
3200	CF00.exe
3572	E0F6.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found
Token: SeShutdownPrivilege	2020	Process not Found
Token: SeCreatePagefilePrivilege	2020	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 796	2020	Process not Found	84
PID 2020 wrote to memory of 796	2020	Process not Found	84
PID 2020 wrote to memory of 796	2020	Process not Found	84
PID 2020 wrote to memory of 1692	2020	Process not Found	86
PID 2020 wrote to memory of 1692	2020	Process not Found	86
PID 2020 wrote to memory of 1692	2020	Process not Found	86
PID 2020 wrote to memory of 3268	2020	Process not Found	87
PID 2020 wrote to memory of 3268	2020	Process not Found	87
PID 2020 wrote to memory of 3268	2020	Process not Found	87
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 1692 wrote to memory of 400	1692	C9CE.exe	88
PID 2020 wrote to memory of 3200	2020	Process not Found	89
PID 2020 wrote to memory of 3200	2020	Process not Found	89
PID 2020 wrote to memory of 3200	2020	Process not Found	89
PID 2020 wrote to memory of 2296	2020	Process not Found	90
PID 2020 wrote to memory of 2296	2020	Process not Found	90
PID 2020 wrote to memory of 2296	2020	Process not Found	90
PID 2020 wrote to memory of 4440	2020	Process not Found	91
PID 2020 wrote to memory of 4440	2020	Process not Found	91
PID 2020 wrote to memory of 4440	2020	Process not Found	91
PID 2020 wrote to memory of 2916	2020	Process not Found	93
PID 2020 wrote to memory of 2916	2020	Process not Found	93
PID 2020 wrote to memory of 2916	2020	Process not Found	93
PID 2916 wrote to memory of 3516	2916	DB86.exe	96
PID 2916 wrote to memory of 3516	2916	DB86.exe	96
PID 4440 wrote to memory of 4376	4440	D684.exe	97
PID 4440 wrote to memory of 4376	4440	D684.exe	97
PID 2020 wrote to memory of 3572	2020	Process not Found	99
PID 2020 wrote to memory of 3572	2020	Process not Found	99
PID 2020 wrote to memory of 3572	2020	Process not Found	99
PID 2916 wrote to memory of 1076	2916	DB86.exe	98
PID 2916 wrote to memory of 1076	2916	DB86.exe	98
PID 2916 wrote to memory of 1076	2916	DB86.exe	98
PID 2020 wrote to memory of 3184	2020	Process not Found	100
PID 2020 wrote to memory of 3184	2020	Process not Found	100
PID 2020 wrote to memory of 3184	2020	Process not Found	100
PID 400 wrote to memory of 4592	400	C9CE.exe	104
PID 400 wrote to memory of 4592	400	C9CE.exe	104
PID 400 wrote to memory of 4592	400	C9CE.exe	104
PID 1076 wrote to memory of 4632	1076	yuzhenzhang.exe	106
PID 1076 wrote to memory of 4632	1076	yuzhenzhang.exe	106
PID 1076 wrote to memory of 4632	1076	yuzhenzhang.exe	106
PID 796 wrote to memory of 4520	796	B8A6.exe	107
PID 796 wrote to memory of 4520	796	B8A6.exe	107
PID 3268 wrote to memory of 2072	3268	build3.exe	110
PID 3268 wrote to memory of 2072	3268	build3.exe	110
PID 3268 wrote to memory of 2072	3268	build3.exe	110
PID 2020 wrote to memory of 4028	2020	Process not Found	115
PID 2020 wrote to memory of 4028	2020	Process not Found	115
PID 2020 wrote to memory of 4028	2020	Process not Found	115
PID 2020 wrote to memory of 3672	2020	Process not Found	116
PID 2020 wrote to memory of 3672	2020	Process not Found	116
PID 2020 wrote to memory of 3672	2020	Process not Found	116
PID 4028 wrote to memory of 4316	4028	F9DF.exe	117
PID 4028 wrote to memory of 4316	4028	F9DF.exe	117
PID 4028 wrote to memory of 4316	4028	F9DF.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4652

C:\Users\Admin\AppData\Local\Temp\B8A6.exe
C:\Users\Admin\AppData\Local\Temp\B8A6.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\system32\rundll32.exe
  "C:\Users\Admin\AppData\Roaming\vcredist_e56f32f.dll",Options_RunDLL 0900cc00-0000-04af-10ff-d4c41b53ded4
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - outlook_office_path
  - outlook_win_path
  PID:4520

C:\Users\Admin\AppData\Local\Temp\C9CE.exe
C:\Users\Admin\AppData\Local\Temp\C9CE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\C9CE.exe
  C:\Users\Admin\AppData\Local\Temp\C9CE.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\3601c3cf-7255-41f8-9677-289125673562" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\C9CE.exe
    "C:\Users\Admin\AppData\Local\Temp\C9CE.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\C9CE.exe
      "C:\Users\Admin\AppData\Local\Temp\C9CE.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:380
    - - C:\Users\Admin\AppData\Local\941338a9-2720-4dc3-9b19-40d7bfc4ea84\build2.exe
        
        "C:\Users\Admin\AppData\Local\941338a9-2720-4dc3-9b19-40d7bfc4ea84\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5060
      - C:\Users\Admin\AppData\Local\941338a9-2720-4dc3-9b19-40d7bfc4ea84\build2.exe
        
        "C:\Users\Admin\AppData\Local\941338a9-2720-4dc3-9b19-40d7bfc4ea84\build2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\941338a9-2720-4dc3-9b19-40d7bfc4ea84\build2.exe" & exit
        7⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\941338a9-2720-4dc3-9b19-40d7bfc4ea84\build3.exe
        
        "C:\Users\Admin\AppData\Local\941338a9-2720-4dc3-9b19-40d7bfc4ea84\build3.exe"
        5⤵
        Executes dropped EXE
        
        PID:1120

C:\Users\Admin\AppData\Local\Temp\CB65.exe
C:\Users\Admin\AppData\Local\Temp\CB65.exe
1⤵
- Executes dropped EXE
PID:3268
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Creates scheduled task(s)
  PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 1072
  2⤵
  - Program crash
  PID:3116

C:\Users\Admin\AppData\Local\Temp\CF00.exe
C:\Users\Admin\AppData\Local\Temp\CF00.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3200

C:\Users\Admin\AppData\Local\Temp\D1A1.exe
C:\Users\Admin\AppData\Local\Temp\D1A1.exe
1⤵
- Executes dropped EXE
PID:2296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 340
  2⤵
  - Program crash
  PID:904

C:\Users\Admin\AppData\Local\Temp\D684.exe
C:\Users\Admin\AppData\Local\Temp\D684.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
  "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1500
  2⤵
  - Program crash
  PID:4388

C:\Users\Admin\AppData\Local\Temp\DB86.exe
C:\Users\Admin\AppData\Local\Temp\DB86.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
  "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
  "C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
    "C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe" -h
    3⤵
    - Executes dropped EXE
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2296 -ip 2296
1⤵
PID:1884

C:\Users\Admin\AppData\Local\Temp\E0F6.exe
C:\Users\Admin\AppData\Local\Temp\E0F6.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3572

C:\Users\Admin\AppData\Local\Temp\E3D5.exe
C:\Users\Admin\AppData\Local\Temp\E3D5.exe
1⤵
- Executes dropped EXE
PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 340
  2⤵
  - Program crash
  PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4440 -ip 4440
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3184 -ip 3184
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3268 -ip 3268
1⤵
PID:3936

C:\Users\Admin\AppData\Local\Temp\F9DF.exe
C:\Users\Admin\AppData\Local\Temp\F9DF.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\F9DF.exe
  C:\Users\Admin\AppData\Local\Temp\F9DF.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4316
- - C:\Users\Admin\AppData\Local\Temp\F9DF.exe
    "C:\Users\Admin\AppData\Local\Temp\F9DF.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\F9DF.exe
      "C:\Users\Admin\AppData\Local\Temp\F9DF.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1140
    - - C:\Users\Admin\AppData\Local\599d6a1d-c9d1-4f87-82bf-48acaf40db22\build2.exe
        
        "C:\Users\Admin\AppData\Local\599d6a1d-c9d1-4f87-82bf-48acaf40db22\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2064
      - C:\Users\Admin\AppData\Local\599d6a1d-c9d1-4f87-82bf-48acaf40db22\build2.exe
        
        "C:\Users\Admin\AppData\Local\599d6a1d-c9d1-4f87-82bf-48acaf40db22\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 888
        7⤵
        Program crash
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\599d6a1d-c9d1-4f87-82bf-48acaf40db22\build3.exe
        
        "C:\Users\Admin\AppData\Local\599d6a1d-c9d1-4f87-82bf-48acaf40db22\build3.exe"
        5⤵
        Executes dropped EXE
        
        PID:1496
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1716

C:\Users\Admin\AppData\Local\Temp\FDF7.exe
C:\Users\Admin\AppData\Local\Temp\FDF7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3672
- C:\Users\Admin\AppData\Local\Temp\FDF7.exe
  C:\Users\Admin\AppData\Local\Temp\FDF7.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\FDF7.exe
    "C:\Users\Admin\AppData\Local\Temp\FDF7.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\FDF7.exe
      "C:\Users\Admin\AppData\Local\Temp\FDF7.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5080
    - - C:\Users\Admin\AppData\Local\d683655a-ba7d-4769-8c9c-639264711043\build2.exe
        
        "C:\Users\Admin\AppData\Local\d683655a-ba7d-4769-8c9c-639264711043\build2.exe"
        5⤵
        Executes dropped EXE
        
        PID:896
      - C:\Users\Admin\AppData\Local\d683655a-ba7d-4769-8c9c-639264711043\build2.exe
        
        "C:\Users\Admin\AppData\Local\d683655a-ba7d-4769-8c9c-639264711043\build2.exe"
        6⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\d683655a-ba7d-4769-8c9c-639264711043\build2.exe" & exit
        7⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\d683655a-ba7d-4769-8c9c-639264711043\build3.exe
        
        "C:\Users\Admin\AppData\Local\d683655a-ba7d-4769-8c9c-639264711043\build3.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3268
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:2700

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 600
    3⤵
    - Program crash
    PID:4448

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3032 -ip 3032
1⤵
PID:4944

C:\Users\Admin\AppData\Local\Temp\2B36.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\2B36.tmp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1388
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Win32Sync\Avast security.exe"
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Roaming\Win32Sync\Avast security.exe
        
        "C:\Users\Admin\AppData\Roaming\Win32Sync\Avast security.exe"
        5⤵
        
        PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4368 -ip 4368
1⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\88A4.exe
C:\Users\Admin\AppData\Local\Temp\88A4.exe
1⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\C2A0.exe
C:\Users\Admin\AppData\Local\Temp\C2A0.exe
1⤵
PID:392

C:\Users\Admin\AppData\Local\Temp\CF05.exe
C:\Users\Admin\AppData\Local\Temp\CF05.exe
1⤵
PID:2012

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1716

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2388

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3024

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4520

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:4296
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3116

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4060

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3740

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery