dcrat | 9b3bf352cba2cd6fd814ff336a0bb2d2192d07b4404f22d99192ec17012ebae4

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

MSBuild.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	MSBuild.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MSBuild.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	5096	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	5096	rundll32.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

7174.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7174.exe
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

56 3924 rundll32.exe
89 3924 rundll32.exe
276 3752 rundll32.exe
277 3752 rundll32.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7174.exe

flow	pid	process
56	3924	rundll32.exe
89	3924	rundll32.exe
276	3752	rundll32.exe
277	3752	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

7174.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7174.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7174.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

yuzhenzhang.exeB30A.exeEFAD.exeF2EA.exeC4C2.exeyuzhenzhang.exeEFAD.exeF2EA.exebuild2.exeBE0A.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	yuzhenzhang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	B30A.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	EFAD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	F2EA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	C4C2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	yuzhenzhang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	EFAD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	F2EA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	BE0A.exe

Executes dropped EXE 38 IoCs

Processes:

B1D0.exeB30A.exeB3E5.exeB7BF.exeB946.exeBE0A.exeC4C2.exeC84D.exellpb1133.exellpb1133.exeCABF.exeyuzhenzhang.exeyuzhenzhang.exeyuzhenzhang.exeyuzhenzhang.exeEFAD.exeEFAD.exeF2EA.exeF2EA.exeEFAD.exeF2EA.exeEFAD.exeF2EA.exebuild2.exebuild2.exebuild2.exebuild2.exe2942.tmp.exe4FA2.exe5E1A.exebuild3.exebuild3.exe7174.exe74E0.exe7781.exeAvast security.exesvcupdater.exemstsca.exe

pid	process
624	B1D0.exe
5068	B30A.exe
1524	B3E5.exe
2744	B7BF.exe
3024	B946.exe
1048	BE0A.exe
5020	C4C2.exe
224	C84D.exe
3652	llpb1133.exe
3352	llpb1133.exe
892	CABF.exe
4248	yuzhenzhang.exe
1772	yuzhenzhang.exe
3852	yuzhenzhang.exe
2464	yuzhenzhang.exe
4460	EFAD.exe
2028	EFAD.exe
4196	F2EA.exe
1212	F2EA.exe
3388	EFAD.exe
1164	F2EA.exe
4140	EFAD.exe
3968	F2EA.exe
5000	build2.exe
4660	build2.exe
4800	build2.exe
4092	build2.exe
1928	2942.tmp.exe
1660	4FA2.exe
1252	5E1A.exe
3920	build3.exe
2804	build3.exe
4636	7174.exe
340	74E0.exe
4544	7781.exe
1876	Avast security.exe
2540	svcupdater.exe
4512	mstsca.exe

Loads dropped DLL 7 IoCs

Processes:

rundll32.exerundll32.exerundll32.exebuild2.exerundll32.exe

pid process

3924 rundll32.exe
4520 rundll32.exe
1828 rundll32.exe
4092 build2.exe
4092 build2.exe
3752 rundll32.exe
3752 rundll32.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

628 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3924	rundll32.exe
4520	rundll32.exe
1828	rundll32.exe
4092	build2.exe
4092	build2.exe
3752	rundll32.exe
3752	rundll32.exe

pid	process
628	icacls.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe	vmprotect
behavioral2/memory/3652-186-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect
behavioral2/memory/3352-187-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

F2EA.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\4634ff94-3fa9-4cd1-8bcc-98707f9eebd5\\F2EA.exe\" --AutoStart"	F2EA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

7174.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7174.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 api.2ip.ua
50 api.2ip.ua
55 api.2ip.ua
57 api.2ip.ua
253 ip-api.com
257 icanhazip.com
40 api.2ip.ua

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7174.exe

flow	ioc
42	api.2ip.ua
50	api.2ip.ua
55	api.2ip.ua
57	api.2ip.ua
253	ip-api.com
257	icanhazip.com
40	api.2ip.ua

Suspicious use of SetThreadContext 10 IoCs

Processes:

EFAD.exeF2EA.exeEFAD.exeF2EA.exebuild2.exebuild2.exe2942.tmp.exe74E0.exe7781.exerundll32.exe

description	pid	process	target process
PID 4460 set thread context of 2028	4460	EFAD.exe	EFAD.exe
PID 4196 set thread context of 1212	4196	F2EA.exe	F2EA.exe
PID 3388 set thread context of 4140	3388	EFAD.exe	EFAD.exe
PID 1164 set thread context of 3968	1164	F2EA.exe	F2EA.exe
PID 5000 set thread context of 4800	5000	build2.exe	build2.exe
PID 4660 set thread context of 4092	4660	build2.exe	build2.exe
PID 1928 set thread context of 3508	1928	2942.tmp.exe	MSBuild.exe
PID 340 set thread context of 4168	340	74E0.exe	AppLaunch.exe
PID 4544 set thread context of 1896	4544	7781.exe	AppLaunch.exe
PID 3752 set thread context of 3144	3752	rundll32.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1548	3024	WerFault.exe	B946.exe
1832	892	WerFault.exe	CABF.exe
4760	5068	WerFault.exe	B30A.exe
2160	4520	WerFault.exe	rundll32.exe
3060	1828	WerFault.exe
3152	4800	WerFault.exe	build2.exe
3012	1660	WerFault.exe	4FA2.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

file.exeB7BF.exeC84D.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B7BF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B7BF.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B7BF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C84D.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C84D.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C84D.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exerundll32.exe7174.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7174.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	7174.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	7174.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7174.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4756 schtasks.exe
4928 schtasks.exe
4112 schtasks.exe
3668 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3000 timeout.exe

pid	process
4756	schtasks.exe
4928	schtasks.exe
4112	schtasks.exe
3668	schtasks.exe

pid	process
3000	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000505664b0100054656d7000003a0009000400efbe6b558a6c505669b02e000000000000000000000000000000000000000000000000006762b000540065006d007000000014000000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	35	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

700

pid	process
700

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
4272	file.exe
4272	file.exe
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

700
Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

file.exeB7BF.exeC84D.exe

pid process

4272 file.exe
2744 B7BF.exe
224 C84D.exe
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700

pid	process
700

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

3144 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

700
700

pid	process
3144	rundll32.exe

pid	process
700
700

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BE0A.exeC4C2.exeyuzhenzhang.exeyuzhenzhang.exeB30A.exeEFAD.exeB1D0.exe

description	pid	process	target process
PID 700 wrote to memory of 624	700		B1D0.exe
PID 700 wrote to memory of 624	700		B1D0.exe
PID 700 wrote to memory of 624	700		B1D0.exe
PID 700 wrote to memory of 5068	700		B30A.exe
PID 700 wrote to memory of 5068	700		B30A.exe
PID 700 wrote to memory of 5068	700		B30A.exe
PID 700 wrote to memory of 1524	700		B3E5.exe
PID 700 wrote to memory of 1524	700		B3E5.exe
PID 700 wrote to memory of 1524	700		B3E5.exe
PID 700 wrote to memory of 2744	700		B7BF.exe
PID 700 wrote to memory of 2744	700		B7BF.exe
PID 700 wrote to memory of 2744	700		B7BF.exe
PID 700 wrote to memory of 3024	700		B946.exe
PID 700 wrote to memory of 3024	700		B946.exe
PID 700 wrote to memory of 3024	700		B946.exe
PID 700 wrote to memory of 1048	700		BE0A.exe
PID 700 wrote to memory of 1048	700		BE0A.exe
PID 700 wrote to memory of 1048	700		BE0A.exe
PID 700 wrote to memory of 5020	700		C4C2.exe
PID 700 wrote to memory of 5020	700		C4C2.exe
PID 700 wrote to memory of 5020	700		C4C2.exe
PID 700 wrote to memory of 224	700		C84D.exe
PID 700 wrote to memory of 224	700		C84D.exe
PID 700 wrote to memory of 224	700		C84D.exe
PID 1048 wrote to memory of 3652	1048	BE0A.exe	llpb1133.exe
PID 1048 wrote to memory of 3652	1048	BE0A.exe	llpb1133.exe
PID 5020 wrote to memory of 3352	5020	C4C2.exe	llpb1133.exe
PID 5020 wrote to memory of 3352	5020	C4C2.exe	llpb1133.exe
PID 700 wrote to memory of 892	700		CABF.exe
PID 700 wrote to memory of 892	700		CABF.exe
PID 700 wrote to memory of 892	700		CABF.exe
PID 5020 wrote to memory of 4248	5020	C4C2.exe	yuzhenzhang.exe
PID 5020 wrote to memory of 4248	5020	C4C2.exe	yuzhenzhang.exe
PID 5020 wrote to memory of 4248	5020	C4C2.exe	yuzhenzhang.exe
PID 1048 wrote to memory of 1772	1048	BE0A.exe	yuzhenzhang.exe
PID 1048 wrote to memory of 1772	1048	BE0A.exe	yuzhenzhang.exe
PID 1048 wrote to memory of 1772	1048	BE0A.exe	yuzhenzhang.exe
PID 1772 wrote to memory of 3852	1772	yuzhenzhang.exe	yuzhenzhang.exe
PID 1772 wrote to memory of 3852	1772	yuzhenzhang.exe	yuzhenzhang.exe
PID 1772 wrote to memory of 3852	1772	yuzhenzhang.exe	yuzhenzhang.exe
PID 4248 wrote to memory of 2464	4248	yuzhenzhang.exe	yuzhenzhang.exe
PID 4248 wrote to memory of 2464	4248	yuzhenzhang.exe	yuzhenzhang.exe
PID 4248 wrote to memory of 2464	4248	yuzhenzhang.exe	yuzhenzhang.exe
PID 5068 wrote to memory of 3668	5068	B30A.exe	schtasks.exe
PID 5068 wrote to memory of 3668	5068	B30A.exe	schtasks.exe
PID 5068 wrote to memory of 3668	5068	B30A.exe	schtasks.exe
PID 700 wrote to memory of 4460	700		EFAD.exe
PID 700 wrote to memory of 4460	700		EFAD.exe
PID 700 wrote to memory of 4460	700		EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 4460 wrote to memory of 2028	4460	EFAD.exe	EFAD.exe
PID 700 wrote to memory of 4196	700		F2EA.exe
PID 700 wrote to memory of 4196	700		F2EA.exe
PID 700 wrote to memory of 4196	700		F2EA.exe
PID 624 wrote to memory of 3924	624	B1D0.exe	rundll32.exe
PID 624 wrote to memory of 3924	624	B1D0.exe	rundll32.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4272

C:\Users\Admin\AppData\Local\Temp\B1D0.exe
C:\Users\Admin\AppData\Local\Temp\B1D0.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\vcredist_e56f60d.dll",Options_RunDLL 0800cc00-00c0-04b9-0e2b-3edf63ce1556
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:3924

C:\Users\Admin\AppData\Local\Temp\B30A.exe
C:\Users\Admin\AppData\Local\Temp\B30A.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
2⤵
- DcRat
- Creates scheduled task(s)
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1016
2⤵
- Program crash
PID:4760

C:\Users\Admin\AppData\Local\Temp\B3E5.exe
C:\Users\Admin\AppData\Local\Temp\B3E5.exe
1⤵
- Executes dropped EXE
PID:1524

C:\Users\Admin\AppData\Local\Temp\B7BF.exe
C:\Users\Admin\AppData\Local\Temp\B7BF.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2744

C:\Users\Admin\AppData\Local\Temp\B946.exe
C:\Users\Admin\AppData\Local\Temp\B946.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 448
2⤵
- Program crash
PID:1548

C:\Users\Admin\AppData\Local\Temp\BE0A.exe
C:\Users\Admin\AppData\Local\Temp\BE0A.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
2⤵
- Executes dropped EXE
PID:3652

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe" -h
3⤵
- Executes dropped EXE
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3024 -ip 3024
1⤵
PID:5064

C:\Users\Admin\AppData\Local\Temp\C4C2.exe
C:\Users\Admin\AppData\Local\Temp\C4C2.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020

C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
2⤵
- Executes dropped EXE
PID:3352

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248

C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe
"C:\Users\Admin\AppData\Local\Temp\yuzhenzhang.exe" -h
3⤵
- Executes dropped EXE
PID:2464

C:\Users\Admin\AppData\Local\Temp\C84D.exe
C:\Users\Admin\AppData\Local\Temp\C84D.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:224

C:\Users\Admin\AppData\Local\Temp\CABF.exe
C:\Users\Admin\AppData\Local\Temp\CABF.exe
1⤵
- Executes dropped EXE
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 448
2⤵
- Program crash
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 892 -ip 892
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5068 -ip 5068
1⤵
PID:3180

C:\Users\Admin\AppData\Local\Temp\EFAD.exe
C:\Users\Admin\AppData\Local\Temp\EFAD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460

C:\Users\Admin\AppData\Local\Temp\EFAD.exe
C:\Users\Admin\AppData\Local\Temp\EFAD.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2028

C:\Users\Admin\AppData\Local\Temp\EFAD.exe
"C:\Users\Admin\AppData\Local\Temp\EFAD.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3388

C:\Users\Admin\AppData\Local\Temp\EFAD.exe
"C:\Users\Admin\AppData\Local\Temp\EFAD.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4140

C:\Users\Admin\AppData\Local\905e401d-90d5-4ea3-9386-1f21fa4df122\build2.exe
"C:\Users\Admin\AppData\Local\905e401d-90d5-4ea3-9386-1f21fa4df122\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5000

C:\Users\Admin\AppData\Local\905e401d-90d5-4ea3-9386-1f21fa4df122\build2.exe
"C:\Users\Admin\AppData\Local\905e401d-90d5-4ea3-9386-1f21fa4df122\build2.exe"
6⤵
- Executes dropped EXE
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 892
7⤵
- Program crash
PID:3152

C:\Users\Admin\AppData\Local\905e401d-90d5-4ea3-9386-1f21fa4df122\build3.exe
"C:\Users\Admin\AppData\Local\905e401d-90d5-4ea3-9386-1f21fa4df122\build3.exe"
5⤵
- Executes dropped EXE
PID:3920

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:4756

C:\Users\Admin\AppData\Local\Temp\F2EA.exe
C:\Users\Admin\AppData\Local\Temp\F2EA.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4196

C:\Users\Admin\AppData\Local\Temp\F2EA.exe
C:\Users\Admin\AppData\Local\Temp\F2EA.exe
2⤵
- DcRat
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:1212

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\4634ff94-3fa9-4cd1-8bcc-98707f9eebd5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:628

C:\Users\Admin\AppData\Local\Temp\F2EA.exe
"C:\Users\Admin\AppData\Local\Temp\F2EA.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1164

C:\Users\Admin\AppData\Local\Temp\F2EA.exe
"C:\Users\Admin\AppData\Local\Temp\F2EA.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3968

C:\Users\Admin\AppData\Local\90d4b30b-b46e-447b-8503-581fe1c1fb49\build2.exe
"C:\Users\Admin\AppData\Local\90d4b30b-b46e-447b-8503-581fe1c1fb49\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4660

C:\Users\Admin\AppData\Local\90d4b30b-b46e-447b-8503-581fe1c1fb49\build2.exe
"C:\Users\Admin\AppData\Local\90d4b30b-b46e-447b-8503-581fe1c1fb49\build2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\90d4b30b-b46e-447b-8503-581fe1c1fb49\build2.exe" & exit
7⤵
PID:3076

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:3000

C:\Users\Admin\AppData\Local\90d4b30b-b46e-447b-8503-581fe1c1fb49\build3.exe
"C:\Users\Admin\AppData\Local\90d4b30b-b46e-447b-8503-581fe1c1fb49\build3.exe"
5⤵
- Executes dropped EXE
PID:2804

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- DcRat
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:4272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 604
3⤵
- Program crash
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4520 -ip 4520
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1828 -ip 1828
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 600
1⤵
- Program crash
PID:3060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Loads dropped DLL
PID:1828

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4800 -ip 4800
1⤵
PID:3540

C:\Users\Admin\AppData\Local\Temp\2942.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\2942.tmp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:3508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:1364

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Avast security.exe"
4⤵
PID:3400

C:\Users\Admin\AppData\Roaming\Microsoft\Avast security.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Avast security.exe"
5⤵
- Executes dropped EXE
PID:1876

C:\Users\Admin\AppData\Local\Temp\4FA2.exe
C:\Users\Admin\AppData\Local\Temp\4FA2.exe
1⤵
- Executes dropped EXE
PID:1660

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:3752

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14164
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 680
2⤵
- Program crash
PID:3012

C:\Users\Admin\AppData\Local\Temp\5E1A.exe
C:\Users\Admin\AppData\Local\Temp\5E1A.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Users\Admin\AppData\Local\Temp\7174.exe
C:\Users\Admin\AppData\Local\Temp\7174.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
PID:4636

C:\Users\Admin\AppData\Local\Temp\74E0.exe
C:\Users\Admin\AppData\Local\Temp\74E0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4168

C:\Users\Admin\AppData\Local\Temp\7781.exe
C:\Users\Admin\AppData\Local\Temp\7781.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:532

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4432

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3612

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1020

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2456

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4504

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:992

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3900

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1660 -ip 1660
1⤵
PID:2464

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
- Executes dropped EXE
PID:2540

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- DcRat
- Creates scheduled task(s)
PID:4112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery