dcrat | 4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

MSBuild.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	MSBuild.exe

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 2604 rundll32.exe
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

96 2844 rundll32.exe
123 2844 rundll32.exe
249 4408 rundll32.exe
Downloads MZ/PE file

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	2604	rundll32.exe

flow	pid	process
96	2844	rundll32.exe
123	2844	rundll32.exe
249	4408	rundll32.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

15C2.exeFCC7.exeyuzhenzhang.exeF840.exebuild2.exeEEB.exe35FF.exeFCC7.exeF840.exe35FF.exebuild2.exebuild2.exeFB20.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	15C2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	FCC7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	yuzhenzhang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	F840.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	EEB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	35FF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	FCC7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	F840.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	35FF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	FB20.exe

Executes dropped EXE 37 IoCs

Processes:

E6FA.exeF840.exeFB20.exeFCC7.exeFE8D.exeF840.exe360.exe69D.exeFCC7.exeEEB.exe15C2.exellpb1133.exellpb1133.exe1A86.exeyuzhenzhang.exe1E9E.exeyuzhenzhang.exeFCC7.exe35FF.exeFCC7.exeF840.exe35FF.exe35FF.exeF840.exe35FF.exebuild2.exebuild2.exebuild2.exebuild2.exe6179.tmp.exebuild2.exebuild2.exe995E.exeBFB3.exeCA82.exeAvast security.exesvcupdater.exe

pid	process
3600	E6FA.exe
2464	F840.exe
4504	FB20.exe
228	FCC7.exe
2696	FE8D.exe
1860	F840.exe
2072	360.exe
3256	69D.exe
5084	FCC7.exe
1044	EEB.exe
3352	15C2.exe
3152	llpb1133.exe
4536	llpb1133.exe
1224	1A86.exe
2672	yuzhenzhang.exe
4164	1E9E.exe
4624	yuzhenzhang.exe
4780	FCC7.exe
3556	35FF.exe
1340	FCC7.exe
4816	F840.exe
3656	35FF.exe
2576	35FF.exe
2812	F840.exe
4972	35FF.exe
2248	build2.exe
2112	build2.exe
4888	build2.exe
3680	build2.exe
2808	6179.tmp.exe
3592	build2.exe
3904	build2.exe
1352	995E.exe
4744	BFB3.exe
3740	CA82.exe
1796	Avast security.exe
3208	svcupdater.exe

Loads dropped DLL 10 IoCs

Processes:

rundll32.exerundll32.exebuild2.exebuild2.exebuild2.exerundll32.exe

pid	process
2844	rundll32.exe
4420	rundll32.exe
2112	build2.exe
2112	build2.exe
3592	build2.exe
3592	build2.exe
3904	build2.exe
3904	build2.exe
4408	rundll32.exe
4408	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3312 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3312	icacls.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
behavioral1/memory/3152-204-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
behavioral1/memory/4536-211-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 10 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

F840.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1636f605-3991-4364-8192-6402864c181c\\F840.exe\" --AutoStart"	F840.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

84 api.2ip.ua
85 api.2ip.ua
86 api.2ip.ua
99 api.2ip.ua
104 api.2ip.ua
109 api.2ip.ua
117 api.2ip.ua

flow	ioc
84	api.2ip.ua
85	api.2ip.ua
86	api.2ip.ua
99	api.2ip.ua
104	api.2ip.ua
109	api.2ip.ua
117	api.2ip.ua

Suspicious use of SetThreadContext 11 IoCs

Processes:

F840.exeFCC7.exeFCC7.exe35FF.exeF840.exe35FF.exebuild2.exebuild2.exebuild2.exe6179.tmp.exerundll32.exe

description	pid	process	target process
PID 2464 set thread context of 1860	2464	F840.exe	F840.exe
PID 228 set thread context of 5084	228	FCC7.exe	FCC7.exe
PID 4780 set thread context of 1340	4780	FCC7.exe	FCC7.exe
PID 3556 set thread context of 3656	3556	35FF.exe	35FF.exe
PID 4816 set thread context of 2812	4816	F840.exe	F840.exe
PID 2576 set thread context of 4972	2576	35FF.exe	35FF.exe
PID 2248 set thread context of 2112	2248	build2.exe	build2.exe
PID 4888 set thread context of 3592	4888	build2.exe	build2.exe
PID 3680 set thread context of 3904	3680	build2.exe	build2.exe
PID 2808 set thread context of 4456	2808	6179.tmp.exe	MSBuild.exe
PID 4408 set thread context of 5108	4408	rundll32.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3440	3256	WerFault.exe	69D.exe
2168	3352	WerFault.exe	15C2.exe
2544	4504	WerFault.exe	FB20.exe
4176	4164	WerFault.exe	1E9E.exe
2124	4420	WerFault.exe	rundll32.exe
3324	3740	WerFault.exe	CA82.exe
1476	1352	WerFault.exe	995E.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe360.exe1A86.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	360.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	360.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1A86.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1A86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1A86.exe

Checks processor information in registry 2 TTPs 31 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exerundll32.exebuild2.exerundll32.exebuild2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4776 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

3492 timeout.exe
3276 timeout.exe
2168 timeout.exe

pid	process
4776	schtasks.exe

pid	process
3492	timeout.exe
3276	timeout.exe
2168	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000005056b315100054656d7000003a0009000400efbe0c55ec985056b3152e00000000000000000000000000000000000000000000000000d46a4800540065006d007000000014000000
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 98 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

676

description	flow	ioc
HTTP User-Agent header	98	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
676

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe

pid	process
4556	4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe
4556	4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

676

pid	process
676

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe360.exe1A86.exe

pid	process
4556	4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe
2072	360.exe
1224	1A86.exe
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676
676

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MSBuild.exe

description	pid	process
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeShutdownPrivilege	676
Token: SeCreatePagefilePrivilege	676
Token: SeDebugPrivilege	4456	MSBuild.exe
Token: SeShutdownPrivilege	676

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

rundll32.exerundll32.exe

pid process

5108 rundll32.exe
676
676
676
676
4408 rundll32.exe
676
676
676
676
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

676
676

pid	process
5108	rundll32.exe
676
676
676
676
4408	rundll32.exe
676
676
676
676

pid	process
676
676

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

F840.exeFCC7.exeEEB.exe15C2.exeE6FA.exeF840.exe

description	pid	process	target process
PID 676 wrote to memory of 3600	676		E6FA.exe
PID 676 wrote to memory of 3600	676		E6FA.exe
PID 676 wrote to memory of 3600	676		E6FA.exe
PID 676 wrote to memory of 2464	676		F840.exe
PID 676 wrote to memory of 2464	676		F840.exe
PID 676 wrote to memory of 2464	676		F840.exe
PID 676 wrote to memory of 4504	676		FB20.exe
PID 676 wrote to memory of 4504	676		FB20.exe
PID 676 wrote to memory of 4504	676		FB20.exe
PID 676 wrote to memory of 228	676		FCC7.exe
PID 676 wrote to memory of 228	676		FCC7.exe
PID 676 wrote to memory of 228	676		FCC7.exe
PID 676 wrote to memory of 2696	676		FE8D.exe
PID 676 wrote to memory of 2696	676		FE8D.exe
PID 676 wrote to memory of 2696	676		FE8D.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 2464 wrote to memory of 1860	2464	F840.exe	F840.exe
PID 676 wrote to memory of 2072	676		360.exe
PID 676 wrote to memory of 2072	676		360.exe
PID 676 wrote to memory of 2072	676		360.exe
PID 676 wrote to memory of 3256	676		69D.exe
PID 676 wrote to memory of 3256	676		69D.exe
PID 676 wrote to memory of 3256	676		69D.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 228 wrote to memory of 5084	228	FCC7.exe	FCC7.exe
PID 676 wrote to memory of 1044	676		EEB.exe
PID 676 wrote to memory of 1044	676		EEB.exe
PID 676 wrote to memory of 1044	676		EEB.exe
PID 676 wrote to memory of 3352	676		15C2.exe
PID 676 wrote to memory of 3352	676		15C2.exe
PID 676 wrote to memory of 3352	676		15C2.exe
PID 1044 wrote to memory of 3152	1044	EEB.exe	llpb1133.exe
PID 1044 wrote to memory of 3152	1044	EEB.exe	llpb1133.exe
PID 3352 wrote to memory of 4536	3352	15C2.exe	llpb1133.exe
PID 3352 wrote to memory of 4536	3352	15C2.exe	llpb1133.exe
PID 676 wrote to memory of 1224	676		1A86.exe
PID 676 wrote to memory of 1224	676		1A86.exe
PID 676 wrote to memory of 1224	676		1A86.exe
PID 1044 wrote to memory of 2672	1044	EEB.exe	yuzhenzhang.exe
PID 1044 wrote to memory of 2672	1044	EEB.exe	yuzhenzhang.exe
PID 1044 wrote to memory of 2672	1044	EEB.exe	yuzhenzhang.exe
PID 676 wrote to memory of 4164	676		1E9E.exe
PID 676 wrote to memory of 4164	676		1E9E.exe
PID 676 wrote to memory of 4164	676		1E9E.exe
PID 3600 wrote to memory of 2844	3600	E6FA.exe	rundll32.exe
PID 3600 wrote to memory of 2844	3600	E6FA.exe	rundll32.exe
PID 1860 wrote to memory of 3312	1860	F840.exe	icacls.exe
PID 1860 wrote to memory of 3312	1860	F840.exe	icacls.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe
"C:\Users\Admin\AppData\Local\Temp\4a576cc0846e12cadf2e2b3595c064549c2da2d5d71b4049b93f2262d4854703.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4556

C:\Users\Admin\AppData\Local\Temp\E6FA.exe
C:\Users\Admin\AppData\Local\Temp\E6FA.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\vcredist_e571f7e.dll",Options_RunDLL 0800cc00-0020-0410-0c6c-5732ffe9e8a5
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
PID:2844

C:\Users\Admin\AppData\Local\Temp\F840.exe
C:\Users\Admin\AppData\Local\Temp\F840.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2464

C:\Users\Admin\AppData\Local\Temp\F840.exe
C:\Users\Admin\AppData\Local\Temp\F840.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\1636f605-3991-4364-8192-6402864c181c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:3312

C:\Users\Admin\AppData\Local\Temp\F840.exe
"C:\Users\Admin\AppData\Local\Temp\F840.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4816

C:\Users\Admin\AppData\Local\Temp\F840.exe
"C:\Users\Admin\AppData\Local\Temp\F840.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2812

C:\Users\Admin\AppData\Local\078c5691-253e-4a6a-bec2-7e98ed41c4da\build2.exe
"C:\Users\Admin\AppData\Local\078c5691-253e-4a6a-bec2-7e98ed41c4da\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4888

C:\Users\Admin\AppData\Local\078c5691-253e-4a6a-bec2-7e98ed41c4da\build2.exe
"C:\Users\Admin\AppData\Local\078c5691-253e-4a6a-bec2-7e98ed41c4da\build2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\078c5691-253e-4a6a-bec2-7e98ed41c4da\build2.exe" & exit
7⤵
PID:2272

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:3276

C:\Users\Admin\AppData\Local\Temp\FB20.exe
C:\Users\Admin\AppData\Local\Temp\FB20.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4504

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
2⤵
- Creates scheduled task(s)
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 1028
2⤵
- Program crash
PID:2544

C:\Users\Admin\AppData\Local\Temp\FCC7.exe
C:\Users\Admin\AppData\Local\Temp\FCC7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:228

C:\Users\Admin\AppData\Local\Temp\FCC7.exe
C:\Users\Admin\AppData\Local\Temp\FCC7.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5084

C:\Users\Admin\AppData\Local\Temp\FCC7.exe
"C:\Users\Admin\AppData\Local\Temp\FCC7.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4780

C:\Users\Admin\AppData\Local\Temp\FCC7.exe
"C:\Users\Admin\AppData\Local\Temp\FCC7.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:1340

C:\Users\Admin\AppData\Local\b9ca5985-4c81-47a6-95cf-45d70d733a60\build2.exe
"C:\Users\Admin\AppData\Local\b9ca5985-4c81-47a6-95cf-45d70d733a60\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2248

C:\Users\Admin\AppData\Local\b9ca5985-4c81-47a6-95cf-45d70d733a60\build2.exe
"C:\Users\Admin\AppData\Local\b9ca5985-4c81-47a6-95cf-45d70d733a60\build2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b9ca5985-4c81-47a6-95cf-45d70d733a60\build2.exe" & exit
7⤵
PID:2052

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:3492

C:\Users\Admin\AppData\Local\Temp\FE8D.exe
C:\Users\Admin\AppData\Local\Temp\FE8D.exe
1⤵
- Executes dropped EXE
PID:2696

C:\Users\Admin\AppData\Local\Temp\360.exe
C:\Users\Admin\AppData\Local\Temp\360.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2072

C:\Users\Admin\AppData\Local\Temp\69D.exe
C:\Users\Admin\AppData\Local\Temp\69D.exe
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 456
2⤵
- Program crash
PID:3440

C:\Users\Admin\AppData\Local\Temp\EEB.exe
C:\Users\Admin\AppData\Local\Temp\EEB.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044

C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
2⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2672

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe" -h
3⤵
- Executes dropped EXE
PID:4624

C:\Users\Admin\AppData\Local\Temp\15C2.exe
C:\Users\Admin\AppData\Local\Temp\15C2.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352

C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
2⤵
- Executes dropped EXE
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 1524
2⤵
- Program crash
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3256 -ip 3256
1⤵
PID:4252

C:\Users\Admin\AppData\Local\Temp\1A86.exe
C:\Users\Admin\AppData\Local\Temp\1A86.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3352 -ip 3352
1⤵
PID:3916

C:\Users\Admin\AppData\Local\Temp\1E9E.exe
C:\Users\Admin\AppData\Local\Temp\1E9E.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 448
2⤵
- Program crash
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4504 -ip 4504
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4164 -ip 4164
1⤵
PID:1820

C:\Users\Admin\AppData\Local\Temp\35FF.exe
C:\Users\Admin\AppData\Local\Temp\35FF.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3556

C:\Users\Admin\AppData\Local\Temp\35FF.exe
C:\Users\Admin\AppData\Local\Temp\35FF.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3656

C:\Users\Admin\AppData\Local\Temp\35FF.exe
"C:\Users\Admin\AppData\Local\Temp\35FF.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2576

C:\Users\Admin\AppData\Local\Temp\35FF.exe
"C:\Users\Admin\AppData\Local\Temp\35FF.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4972

C:\Users\Admin\AppData\Local\52491b0b-b5ed-40c8-a9c5-d4fb24cfabf7\build2.exe
"C:\Users\Admin\AppData\Local\52491b0b-b5ed-40c8-a9c5-d4fb24cfabf7\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3680

C:\Users\Admin\AppData\Local\52491b0b-b5ed-40c8-a9c5-d4fb24cfabf7\build2.exe
"C:\Users\Admin\AppData\Local\52491b0b-b5ed-40c8-a9c5-d4fb24cfabf7\build2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\52491b0b-b5ed-40c8-a9c5-d4fb24cfabf7\build2.exe" & exit
7⤵
PID:2180

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:2168

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:4304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 600
3⤵
- Program crash
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4420 -ip 4420
1⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\6179.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\6179.tmp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:3212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:4420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Adobe\Avast security.exe"
4⤵
PID:2104

C:\Users\Admin\AppData\Roaming\Adobe\Avast security.exe
"C:\Users\Admin\AppData\Roaming\Adobe\Avast security.exe"
5⤵
- Executes dropped EXE
PID:1796

C:\Users\Admin\AppData\Local\Temp\995E.exe
C:\Users\Admin\AppData\Local\Temp\995E.exe
1⤵
- Executes dropped EXE
PID:1352

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- outlook_office_path
- outlook_win_path
PID:4408

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14149
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5108

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:3972

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 480
2⤵
- Program crash
PID:1476

C:\Users\Admin\AppData\Local\Temp\BFB3.exe
C:\Users\Admin\AppData\Local\Temp\BFB3.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Users\Admin\AppData\Local\Temp\CA82.exe
C:\Users\Admin\AppData\Local\Temp\CA82.exe
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1472
2⤵
- Program crash
PID:3324

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2540

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2276

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1540

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3740 -ip 3740
1⤵
PID:4492

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3520

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2196

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1352 -ip 1352
1⤵
PID:3104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery