djvu | 24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

MSBuild.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	MSBuild.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	3012	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	3012	rundll32.exe

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

63 5020 rundll32.exe
95 5020 rundll32.exe
133 5020 rundll32.exe
169 5020 rundll32.exe
242 1552 rundll32.exe
Downloads MZ/PE file

flow	pid	process
63	5020	rundll32.exe
95	5020	rundll32.exe
133	5020	rundll32.exe
169	5020	rundll32.exe
242	1552	rundll32.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

BEF3.exeD2ED.exeF397.exeBDA9.exeBEF3.exeBC41.exebuild2.exeyuzhenzhang.exeBC41.exeF397.exeCC45.exeyuzhenzhang.exebuild2.exebuild2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	BEF3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	D2ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	F397.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	BDA9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	BEF3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	BC41.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	yuzhenzhang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	BC41.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	F397.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	CC45.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	yuzhenzhang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	build2.exe

Executes dropped EXE 43 IoCs

Processes:

B078.exeBC41.exeBDA9.exeBEF3.exeBC41.exeC04B.exeC4D1.exeC6E5.exeBEF3.exeCC45.exeD2ED.exellpb1133.exellpb1133.exeDB2B.exeyuzhenzhang.exeyuzhenzhang.exeBEF3.exeDF05.exeyuzhenzhang.exeyuzhenzhang.exeBEF3.exeF397.exeF397.exeF397.exebuild2.exeF397.exebuild3.exeBC41.exebuild2.exebuild2.exeBC41.exebuild3.exebuild2.exebuild2.exesvcupdater.exe33D1.tmp.exebuild3.exebuild2.exe494A.exe7174.exe79A3.exeAvast security.exemstsca.exe

pid	process
3940	B078.exe
460	BC41.exe
1624	BDA9.exe
2372	BEF3.exe
4700	BC41.exe
3436	C04B.exe
4460	C4D1.exe
212	C6E5.exe
3684	BEF3.exe
4884	CC45.exe
2228	D2ED.exe
3788	llpb1133.exe
4368	llpb1133.exe
4800	DB2B.exe
4684	yuzhenzhang.exe
4264	yuzhenzhang.exe
1328	BEF3.exe
5096	DF05.exe
1900	yuzhenzhang.exe
3764	yuzhenzhang.exe
5040	BEF3.exe
4444	F397.exe
3644	F397.exe
4976	F397.exe
940	build2.exe
3124	F397.exe
3560	build3.exe
4984	BC41.exe
392	build2.exe
4000	build2.exe
3076	BC41.exe
632	build3.exe
1480	build2.exe
4420	build2.exe
2560	svcupdater.exe
3340	33D1.tmp.exe
4364	build3.exe
1164	build2.exe
3804	494A.exe
2912	7174.exe
848	79A3.exe
3460	Avast security.exe
4296	mstsca.exe

Loads dropped DLL 11 IoCs

Processes:

rundll32.exerundll32.exerundll32.exebuild2.exebuild2.exebuild2.exerundll32.exe

pid	process
5020	rundll32.exe
2240	rundll32.exe
2236	rundll32.exe
392	build2.exe
392	build2.exe
4420	build2.exe
4420	build2.exe
1164	build2.exe
1164	build2.exe
1552	rundll32.exe
1552	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3628 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3628	icacls.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
behavioral1/memory/3788-210-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect
behavioral1/memory/4368-213-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

BC41.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\15b6c9e9-944c-4a3f-8265-1eb35d219989\\BC41.exe\" --AutoStart"	BC41.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 api.2ip.ua
19 api.2ip.ua
35 api.2ip.ua
47 api.2ip.ua
66 api.2ip.ua
79 api.2ip.ua
12 api.2ip.ua

flow	ioc
13	api.2ip.ua
19	api.2ip.ua
35	api.2ip.ua
47	api.2ip.ua
66	api.2ip.ua
79	api.2ip.ua
12	api.2ip.ua

Suspicious use of SetThreadContext 11 IoCs

Processes:

BC41.exeBEF3.exeBEF3.exeF397.exeF397.exebuild2.exeBC41.exebuild2.exebuild2.exe33D1.tmp.exerundll32.exe

description	pid	process	target process
PID 460 set thread context of 4700	460	BC41.exe	BC41.exe
PID 2372 set thread context of 3684	2372	BEF3.exe	BEF3.exe
PID 1328 set thread context of 5040	1328	BEF3.exe	BEF3.exe
PID 4444 set thread context of 3644	4444	F397.exe	F397.exe
PID 4976 set thread context of 3124	4976	F397.exe	F397.exe
PID 940 set thread context of 392	940	build2.exe	build2.exe
PID 4984 set thread context of 3076	4984	BC41.exe	BC41.exe
PID 4000 set thread context of 4420	4000	build2.exe	build2.exe
PID 1480 set thread context of 1164	1480	build2.exe	build2.exe
PID 3340 set thread context of 5072	3340	33D1.tmp.exe	MSBuild.exe
PID 1552 set thread context of 3476	1552	rundll32.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3304	212	WerFault.exe	C6E5.exe
2128	5096	WerFault.exe	DF05.exe
4020	1624	WerFault.exe	BDA9.exe
3428	2236	WerFault.exe	rundll32.exe
2136	2240	WerFault.exe	rundll32.exe
4292	848	WerFault.exe	79A3.exe
3772	3804	WerFault.exe	494A.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

C4D1.exe24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exeDB2B.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C4D1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C4D1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DB2B.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DB2B.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DB2B.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C4D1.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exerundll32.exebuild2.exebuild2.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

540 schtasks.exe
4380 schtasks.exe
4660 schtasks.exe
4420 schtasks.exe
1864 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

4296 timeout.exe
4340 timeout.exe
4660 timeout.exe

pid	process
540	schtasks.exe
4380	schtasks.exe
4660	schtasks.exe
4420	schtasks.exe
1864	schtasks.exe

pid	process
4296	timeout.exe
4340	timeout.exe
4660	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000050561479100054656d7000003a0009000400efbe6b558a6c50561a792e00000000000000000000000000000000000000000000000000b94a0500540065006d007000000014000000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	49	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	50	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

1012

pid	process
1012

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe

pid	process
2792	24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe
2792	24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1012

pid	process
1012

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exeC4D1.exeDB2B.exe

pid	process
2792	24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe
4460	C4D1.exe
4800	DB2B.exe
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012
1012

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012
Token: SeShutdownPrivilege	1012
Token: SeCreatePagefilePrivilege	1012

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

3476 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

1012
1012

pid	process
3476	rundll32.exe

pid	process
1012
1012

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BC41.exeBEF3.exeBC41.exeCC45.exeBEF3.exeD2ED.exe

description	pid	process	target process
PID 1012 wrote to memory of 3940	1012		B078.exe
PID 1012 wrote to memory of 3940	1012		B078.exe
PID 1012 wrote to memory of 3940	1012		B078.exe
PID 1012 wrote to memory of 460	1012		BC41.exe
PID 1012 wrote to memory of 460	1012		BC41.exe
PID 1012 wrote to memory of 460	1012		BC41.exe
PID 1012 wrote to memory of 1624	1012		BDA9.exe
PID 1012 wrote to memory of 1624	1012		BDA9.exe
PID 1012 wrote to memory of 1624	1012		BDA9.exe
PID 1012 wrote to memory of 2372	1012		BEF3.exe
PID 1012 wrote to memory of 2372	1012		BEF3.exe
PID 1012 wrote to memory of 2372	1012		BEF3.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 460 wrote to memory of 4700	460	BC41.exe	BC41.exe
PID 1012 wrote to memory of 3436	1012		C04B.exe
PID 1012 wrote to memory of 3436	1012		C04B.exe
PID 1012 wrote to memory of 3436	1012		C04B.exe
PID 1012 wrote to memory of 4460	1012		C4D1.exe
PID 1012 wrote to memory of 4460	1012		C4D1.exe
PID 1012 wrote to memory of 4460	1012		C4D1.exe
PID 1012 wrote to memory of 212	1012		C6E5.exe
PID 1012 wrote to memory of 212	1012		C6E5.exe
PID 1012 wrote to memory of 212	1012		C6E5.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 2372 wrote to memory of 3684	2372	BEF3.exe	BEF3.exe
PID 1012 wrote to memory of 4884	1012		CC45.exe
PID 1012 wrote to memory of 4884	1012		CC45.exe
PID 1012 wrote to memory of 4884	1012		CC45.exe
PID 1012 wrote to memory of 2228	1012		D2ED.exe
PID 1012 wrote to memory of 2228	1012		D2ED.exe
PID 1012 wrote to memory of 2228	1012		D2ED.exe
PID 4700 wrote to memory of 3628	4700	BC41.exe	icacls.exe
PID 4700 wrote to memory of 3628	4700	BC41.exe	icacls.exe
PID 4700 wrote to memory of 3628	4700	BC41.exe	icacls.exe
PID 4884 wrote to memory of 3788	4884	CC45.exe	llpb1133.exe
PID 4884 wrote to memory of 3788	4884	CC45.exe	llpb1133.exe
PID 3684 wrote to memory of 1328	3684	BEF3.exe	BEF3.exe
PID 3684 wrote to memory of 1328	3684	BEF3.exe	BEF3.exe
PID 3684 wrote to memory of 1328	3684	BEF3.exe	BEF3.exe
PID 2228 wrote to memory of 4368	2228	D2ED.exe	llpb1133.exe
PID 2228 wrote to memory of 4368	2228	D2ED.exe	llpb1133.exe
PID 1012 wrote to memory of 4800	1012		DB2B.exe
PID 1012 wrote to memory of 4800	1012		DB2B.exe
PID 1012 wrote to memory of 4800	1012		DB2B.exe
PID 4884 wrote to memory of 4264	4884	CC45.exe	yuzhenzhang.exe
PID 4884 wrote to memory of 4264	4884	CC45.exe	yuzhenzhang.exe
PID 4884 wrote to memory of 4264	4884	CC45.exe	yuzhenzhang.exe
PID 2228 wrote to memory of 4684	2228	D2ED.exe	yuzhenzhang.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe
"C:\Users\Admin\AppData\Local\Temp\24c454f4e2e0bbf0f3f367e9c93e95178dc467dbdd5a59e2f0ef9d45a1a02d53.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2792

C:\Users\Admin\AppData\Local\Temp\B078.exe
C:\Users\Admin\AppData\Local\Temp\B078.exe
1⤵
- Executes dropped EXE
PID:3940

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\vcredist_e56f5de.dll",Options_RunDLL 0500cc00-0080-040b-0e12-f48326783b76
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:5020

C:\Users\Admin\AppData\Local\Temp\BC41.exe
C:\Users\Admin\AppData\Local\Temp\BC41.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:460

C:\Users\Admin\AppData\Local\Temp\BC41.exe
C:\Users\Admin\AppData\Local\Temp\BC41.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4700

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\15b6c9e9-944c-4a3f-8265-1eb35d219989" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:3628

C:\Users\Admin\AppData\Local\Temp\BC41.exe
"C:\Users\Admin\AppData\Local\Temp\BC41.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4984

C:\Users\Admin\AppData\Local\Temp\BC41.exe
"C:\Users\Admin\AppData\Local\Temp\BC41.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3076

C:\Users\Admin\AppData\Local\41a14bc4-1ba4-4cdf-b9c7-d34b8cd65c56\build2.exe
"C:\Users\Admin\AppData\Local\41a14bc4-1ba4-4cdf-b9c7-d34b8cd65c56\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1480

C:\Users\Admin\AppData\Local\41a14bc4-1ba4-4cdf-b9c7-d34b8cd65c56\build2.exe
"C:\Users\Admin\AppData\Local\41a14bc4-1ba4-4cdf-b9c7-d34b8cd65c56\build2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\41a14bc4-1ba4-4cdf-b9c7-d34b8cd65c56\build2.exe" & exit
7⤵
PID:2792

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:4660

C:\Users\Admin\AppData\Local\41a14bc4-1ba4-4cdf-b9c7-d34b8cd65c56\build3.exe
"C:\Users\Admin\AppData\Local\41a14bc4-1ba4-4cdf-b9c7-d34b8cd65c56\build3.exe"
5⤵
- Executes dropped EXE
PID:4364

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:4380

C:\Users\Admin\AppData\Local\Temp\BDA9.exe
C:\Users\Admin\AppData\Local\Temp\BDA9.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
2⤵
- Creates scheduled task(s)
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 696
2⤵
- Program crash
PID:4020

C:\Users\Admin\AppData\Local\Temp\BEF3.exe
C:\Users\Admin\AppData\Local\Temp\BEF3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2372

C:\Users\Admin\AppData\Local\Temp\BEF3.exe
C:\Users\Admin\AppData\Local\Temp\BEF3.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684

C:\Users\Admin\AppData\Local\Temp\BEF3.exe
"C:\Users\Admin\AppData\Local\Temp\BEF3.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1328

C:\Users\Admin\AppData\Local\Temp\BEF3.exe
"C:\Users\Admin\AppData\Local\Temp\BEF3.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:5040

C:\Users\Admin\AppData\Local\90355bc9-b44b-410f-9f49-e3648ec12c5a\build2.exe
"C:\Users\Admin\AppData\Local\90355bc9-b44b-410f-9f49-e3648ec12c5a\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:940

C:\Users\Admin\AppData\Local\90355bc9-b44b-410f-9f49-e3648ec12c5a\build2.exe
"C:\Users\Admin\AppData\Local\90355bc9-b44b-410f-9f49-e3648ec12c5a\build2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\90355bc9-b44b-410f-9f49-e3648ec12c5a\build2.exe" & exit
7⤵
PID:3988

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:4296

C:\Users\Admin\AppData\Local\90355bc9-b44b-410f-9f49-e3648ec12c5a\build3.exe
"C:\Users\Admin\AppData\Local\90355bc9-b44b-410f-9f49-e3648ec12c5a\build3.exe"
5⤵
- Executes dropped EXE
PID:3560

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:1864

C:\Users\Admin\AppData\Local\Temp\C04B.exe
C:\Users\Admin\AppData\Local\Temp\C04B.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Users\Admin\AppData\Local\Temp\C4D1.exe
C:\Users\Admin\AppData\Local\Temp\C4D1.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4460

C:\Users\Admin\AppData\Local\Temp\C6E5.exe
C:\Users\Admin\AppData\Local\Temp\C6E5.exe
1⤵
- Executes dropped EXE
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 448
2⤵
- Program crash
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 212 -ip 212
1⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\D2ED.exe
C:\Users\Admin\AppData\Local\Temp\D2ED.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4684

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe" -h
3⤵
- Executes dropped EXE
PID:3764

C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
2⤵
- Executes dropped EXE
PID:4368

C:\Users\Admin\AppData\Local\Temp\CC45.exe
C:\Users\Admin\AppData\Local\Temp\CC45.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884

C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
2⤵
- Executes dropped EXE
PID:3788

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4264

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe" -h
3⤵
- Executes dropped EXE
PID:1900

C:\Users\Admin\AppData\Local\Temp\DB2B.exe
C:\Users\Admin\AppData\Local\Temp\DB2B.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4800

C:\Users\Admin\AppData\Local\Temp\DF05.exe
C:\Users\Admin\AppData\Local\Temp\DF05.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 388
2⤵
- Program crash
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5096 -ip 5096
1⤵
PID:4664

C:\Users\Admin\AppData\Local\Temp\F397.exe
C:\Users\Admin\AppData\Local\Temp\F397.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4444

C:\Users\Admin\AppData\Local\Temp\F397.exe
C:\Users\Admin\AppData\Local\Temp\F397.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3644

C:\Users\Admin\AppData\Local\Temp\F397.exe
"C:\Users\Admin\AppData\Local\Temp\F397.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4976

C:\Users\Admin\AppData\Local\Temp\F397.exe
"C:\Users\Admin\AppData\Local\Temp\F397.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3124

C:\Users\Admin\AppData\Local\adbf6b45-2f22-4ee3-88c6-d7e572e5c1c4\build2.exe
"C:\Users\Admin\AppData\Local\adbf6b45-2f22-4ee3-88c6-d7e572e5c1c4\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4000

C:\Users\Admin\AppData\Local\adbf6b45-2f22-4ee3-88c6-d7e572e5c1c4\build2.exe
"C:\Users\Admin\AppData\Local\adbf6b45-2f22-4ee3-88c6-d7e572e5c1c4\build2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\adbf6b45-2f22-4ee3-88c6-d7e572e5c1c4\build2.exe" & exit
7⤵
PID:3476

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:4340

C:\Users\Admin\AppData\Local\adbf6b45-2f22-4ee3-88c6-d7e572e5c1c4\build3.exe
"C:\Users\Admin\AppData\Local\adbf6b45-2f22-4ee3-88c6-d7e572e5c1c4\build3.exe"
5⤵
- Executes dropped EXE
PID:632

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1624 -ip 1624
1⤵
PID:4332

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:2584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 600
3⤵
- Program crash
PID:3428

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:5032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 600
3⤵
- Program crash
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2236 -ip 2236
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2240 -ip 2240
1⤵
PID:4980

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Users\Admin\AppData\Local\Temp\33D1.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\33D1.tmp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:5072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:4396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Sun\Avast security.exe"
4⤵
PID:1412

C:\Users\Admin\AppData\Roaming\Sun\Avast security.exe
"C:\Users\Admin\AppData\Roaming\Sun\Avast security.exe"
5⤵
- Executes dropped EXE
PID:3460

C:\Users\Admin\AppData\Local\Temp\494A.exe
C:\Users\Admin\AppData\Local\Temp\494A.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:1552

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14164
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 484
2⤵
- Program crash
PID:3772

C:\Users\Admin\AppData\Local\Temp\7174.exe
C:\Users\Admin\AppData\Local\Temp\7174.exe
1⤵
- Executes dropped EXE
PID:2912

C:\Users\Admin\AppData\Local\Temp\79A3.exe
C:\Users\Admin\AppData\Local\Temp\79A3.exe
1⤵
- Executes dropped EXE
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1536
2⤵
- Program crash
PID:4292

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5052

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2312

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1160

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 848 -ip 848
1⤵
PID:3860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4008

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5000

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3932

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3804 -ip 3804
1⤵
PID:3152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4400

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:4660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery