amadey | 958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

iKZ01fY.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	iKZ01fY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	iKZ01fY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	iKZ01fY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	iKZ01fY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	iKZ01fY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	iKZ01fY.exe

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1900 3760 rundll32.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	3760	rundll32.exe

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4704-206-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-208-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-205-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-210-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-212-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-214-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-216-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-218-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-220-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-222-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-224-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-226-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-228-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-230-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-232-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-234-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-236-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-238-0x00000000024D0000-0x000000000250E000-memory.dmp	family_redline
behavioral1/memory/4704-244-0x0000000004CF0000-0x0000000004D00000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

70 212 rundll32.exe
Downloads MZ/PE file

flow	pid	process
70	212	rundll32.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

rhG89nG.exemnolyk.exelebro.exenbveek.exemeta2.exenbveek.exerandom.exeppi.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	rhG89nG.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	mnolyk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	lebro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	meta2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	ppi.exe

Executes dropped EXE 32 IoCs

Processes:

sLu31OQ.exesWc21ht.exesHM96fW.exeiKZ01fY.exeknJ83bI.exemHz45sc.exenqb30ZW.exerhG89nG.exemnolyk.exetruno.exenwy46uP11.exeepk21ea.exelebro.exenbveek.exemeta2.exenbveek.exeredline4.exe2209.exer3NzWQ1.exev0j0cw.exerh_0.exefxd.exerandom.exebuildd.exerandom.exeppi.exehjL23vi.exenEc81lq.exenbveek.exemnolyk.exeupdate.exedllhost.exe

pid	process
4856	sLu31OQ.exe
4932	sWc21ht.exe
4552	sHM96fW.exe
840	iKZ01fY.exe
4704	knJ83bI.exe
4292	mHz45sc.exe
1672	nqb30ZW.exe
2900	rhG89nG.exe
4824	mnolyk.exe
2636	truno.exe
4904	nwy46uP11.exe
4380	epk21ea.exe
2460	lebro.exe
5096	nbveek.exe
2928	meta2.exe
636	nbveek.exe
3496	redline4.exe
1868	2209.exe
1292	r3NzWQ1.exe
4712	v0j0cw.exe
3556	rh_0.exe
1416	fxd.exe
1952	random.exe
4408	buildd.exe
1364	random.exe
3736	ppi.exe
2576	hjL23vi.exe
3780	nEc81lq.exe
2864	nbveek.exe
452	mnolyk.exe
1496	update.exe
4496	dllhost.exe

Loads dropped DLL 9 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid	process
212	rundll32.exe
632	rundll32.exe
1072	rundll32.exe
4632	rundll32.exe
3496	rundll32.exe
3012	rundll32.exe
4712	rundll32.exe
4820	rundll32.exe
4508	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

iKZ01fY.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	iKZ01fY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	iKZ01fY.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 23 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exetruno.exedllhost.exemnolyk.exesLu31OQ.exesWc21ht.exesHM96fW.exenwy46uP11.exenbveek.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	truno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\truno.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005051\\truno.exe"	mnolyk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sLu31OQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	sWc21ht.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	sHM96fW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	sHM96fW.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	truno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	nwy46uP11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nwy46uP11.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	sLu31OQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	sWc21ht.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fxd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000260051\\fxd.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

AppLaunch.exeRegAsm.exe

pid process

1964 AppLaunch.exe
1964 AppLaunch.exe
1964 AppLaunch.exe
4956 RegAsm.exe
4956 RegAsm.exe
4956 RegAsm.exe

pid	process
1964	AppLaunch.exe
1964	AppLaunch.exe
1964	AppLaunch.exe
4956	RegAsm.exe
4956	RegAsm.exe
4956	RegAsm.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

nqb30ZW.exeredline4.exev0j0cw.exefxd.exeppi.exer3NzWQ1.exe

description	pid	process	target process
PID 1672 set thread context of 3164	1672	nqb30ZW.exe	AppLaunch.exe
PID 3496 set thread context of 728	3496	redline4.exe	vbc.exe
PID 4712 set thread context of 3552	4712	v0j0cw.exe	RegSvcs.exe
PID 1416 set thread context of 1964	1416	fxd.exe	AppLaunch.exe
PID 3736 set thread context of 4956	3736	ppi.exe	RegAsm.exe
PID 1292 set thread context of 2248	1292	r3NzWQ1.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4000	840	WerFault.exe	iKZ01fY.exe
4376	4704	WerFault.exe	knJ83bI.exe
2012	3496	WerFault.exe	redline4.exe
1068	4712	WerFault.exe	v0j0cw.exe
800	632	WerFault.exe	rundll32.exe
4292	4380	WerFault.exe	epk21ea.exe
3436	3496	WerFault.exe	rundll32.exe
400	4820	WerFault.exe	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

RegAsm.exeAppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4360	schtasks.exe
3356	schtasks.exe
3956	schtasks.exe
4240	schtasks.exe
3780	schtasks.exe
4884	schtasks.exe
4908	schtasks.exe
4164	schtasks.exe
3264	schtasks.exe
4400	schtasks.exe
4660	schtasks.exe
5100	schtasks.exe
2116	schtasks.exe
3756	schtasks.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

buildd.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	buildd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	buildd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	buildd.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 77 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	77	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 57 IoCs

Processes:

iKZ01fY.exeknJ83bI.exemHz45sc.exeAppLaunch.exevbc.exerundll32.exeRegSvcs.exepowershell.exeepk21ea.exehjL23vi.exenEc81lq.exer3NzWQ1.exeMSBuild.exeupdate.exepowershell.exepowershell.exepowershell.exedllhost.exe

pid	process
840	iKZ01fY.exe
840	iKZ01fY.exe
4704	knJ83bI.exe
4704	knJ83bI.exe
4292	mHz45sc.exe
4292	mHz45sc.exe
3164	AppLaunch.exe
3164	AppLaunch.exe
728	vbc.exe
728	vbc.exe
212	rundll32.exe
212	rundll32.exe
3552	RegSvcs.exe
3552	RegSvcs.exe
212	rundll32.exe
212	rundll32.exe
2264	powershell.exe
4380	epk21ea.exe
2264	powershell.exe
4380	epk21ea.exe
2576	hjL23vi.exe
2576	hjL23vi.exe
3780	nEc81lq.exe
3780	nEc81lq.exe
1292	r3NzWQ1.exe
2248	MSBuild.exe
2248	MSBuild.exe
1496	update.exe
2268	powershell.exe
2268	powershell.exe
3728	powershell.exe
3728	powershell.exe
4432	powershell.exe
4432	powershell.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe
4496	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

iKZ01fY.exeknJ83bI.exemHz45sc.exeepk21ea.exeAppLaunch.exevbc.exeRegSvcs.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	840	iKZ01fY.exe
Token: SeDebugPrivilege	4704	knJ83bI.exe
Token: SeDebugPrivilege	4292	mHz45sc.exe
Token: SeDebugPrivilege	4380	epk21ea.exe
Token: SeDebugPrivilege	3164	AppLaunch.exe
Token: SeDebugPrivilege	728	vbc.exe
Token: SeDebugPrivilege	3552	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	2580	wmic.exe
Token: SeSecurityPrivilege	2580	wmic.exe
Token: SeTakeOwnershipPrivilege	2580	wmic.exe
Token: SeLoadDriverPrivilege	2580	wmic.exe
Token: SeSystemProfilePrivilege	2580	wmic.exe
Token: SeSystemtimePrivilege	2580	wmic.exe
Token: SeProfSingleProcessPrivilege	2580	wmic.exe
Token: SeIncBasePriorityPrivilege	2580	wmic.exe
Token: SeCreatePagefilePrivilege	2580	wmic.exe
Token: SeBackupPrivilege	2580	wmic.exe
Token: SeRestorePrivilege	2580	wmic.exe
Token: SeShutdownPrivilege	2580	wmic.exe
Token: SeDebugPrivilege	2580	wmic.exe
Token: SeSystemEnvironmentPrivilege	2580	wmic.exe
Token: SeRemoteShutdownPrivilege	2580	wmic.exe
Token: SeUndockPrivilege	2580	wmic.exe
Token: SeManageVolumePrivilege	2580	wmic.exe
Token: 33	2580	wmic.exe
Token: 34	2580	wmic.exe
Token: 35	2580	wmic.exe
Token: 36	2580	wmic.exe
Token: SeIncreaseQuotaPrivilege	2580	wmic.exe
Token: SeSecurityPrivilege	2580	wmic.exe
Token: SeTakeOwnershipPrivilege	2580	wmic.exe
Token: SeLoadDriverPrivilege	2580	wmic.exe
Token: SeSystemProfilePrivilege	2580	wmic.exe
Token: SeSystemtimePrivilege	2580	wmic.exe
Token: SeProfSingleProcessPrivilege	2580	wmic.exe
Token: SeIncBasePriorityPrivilege	2580	wmic.exe
Token: SeCreatePagefilePrivilege	2580	wmic.exe
Token: SeBackupPrivilege	2580	wmic.exe
Token: SeRestorePrivilege	2580	wmic.exe
Token: SeShutdownPrivilege	2580	wmic.exe
Token: SeDebugPrivilege	2580	wmic.exe
Token: SeSystemEnvironmentPrivilege	2580	wmic.exe
Token: SeRemoteShutdownPrivilege	2580	wmic.exe
Token: SeUndockPrivilege	2580	wmic.exe
Token: SeManageVolumePrivilege	2580	wmic.exe
Token: 33	2580	wmic.exe
Token: 34	2580	wmic.exe
Token: 35	2580	wmic.exe
Token: 36	2580	wmic.exe
Token: SeIncreaseQuotaPrivilege	2988	WMIC.exe
Token: SeSecurityPrivilege	2988	WMIC.exe
Token: SeTakeOwnershipPrivilege	2988	WMIC.exe
Token: SeLoadDriverPrivilege	2988	WMIC.exe
Token: SeSystemProfilePrivilege	2988	WMIC.exe
Token: SeSystemtimePrivilege	2988	WMIC.exe
Token: SeProfSingleProcessPrivilege	2988	WMIC.exe
Token: SeIncBasePriorityPrivilege	2988	WMIC.exe
Token: SeCreatePagefilePrivilege	2988	WMIC.exe
Token: SeBackupPrivilege	2988	WMIC.exe
Token: SeRestorePrivilege	2988	WMIC.exe
Token: SeShutdownPrivilege	2988	WMIC.exe
Token: SeDebugPrivilege	2988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2988	WMIC.exe
Token: SeRemoteShutdownPrivilege	2988	WMIC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

random.exerandom.exe

pid process

1952 random.exe
1952 random.exe
1364 random.exe
1364 random.exe

pid	process
1952	random.exe
1952	random.exe
1364	random.exe
1364	random.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exesLu31OQ.exesWc21ht.exesHM96fW.exenqb30ZW.exerhG89nG.exemnolyk.execmd.exetruno.exenwy46uP11.exe

description	pid	process	target process
PID 4772 wrote to memory of 4856	4772	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe	sLu31OQ.exe
PID 4772 wrote to memory of 4856	4772	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe	sLu31OQ.exe
PID 4772 wrote to memory of 4856	4772	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe	sLu31OQ.exe
PID 4856 wrote to memory of 4932	4856	sLu31OQ.exe	sWc21ht.exe
PID 4856 wrote to memory of 4932	4856	sLu31OQ.exe	sWc21ht.exe
PID 4856 wrote to memory of 4932	4856	sLu31OQ.exe	sWc21ht.exe
PID 4932 wrote to memory of 4552	4932	sWc21ht.exe	sHM96fW.exe
PID 4932 wrote to memory of 4552	4932	sWc21ht.exe	sHM96fW.exe
PID 4932 wrote to memory of 4552	4932	sWc21ht.exe	sHM96fW.exe
PID 4552 wrote to memory of 840	4552	sHM96fW.exe	iKZ01fY.exe
PID 4552 wrote to memory of 840	4552	sHM96fW.exe	iKZ01fY.exe
PID 4552 wrote to memory of 840	4552	sHM96fW.exe	iKZ01fY.exe
PID 4552 wrote to memory of 4704	4552	sHM96fW.exe	knJ83bI.exe
PID 4552 wrote to memory of 4704	4552	sHM96fW.exe	knJ83bI.exe
PID 4552 wrote to memory of 4704	4552	sHM96fW.exe	knJ83bI.exe
PID 4932 wrote to memory of 4292	4932	sWc21ht.exe	mHz45sc.exe
PID 4932 wrote to memory of 4292	4932	sWc21ht.exe	mHz45sc.exe
PID 4932 wrote to memory of 4292	4932	sWc21ht.exe	mHz45sc.exe
PID 4856 wrote to memory of 1672	4856	sLu31OQ.exe	nqb30ZW.exe
PID 4856 wrote to memory of 1672	4856	sLu31OQ.exe	nqb30ZW.exe
PID 4856 wrote to memory of 1672	4856	sLu31OQ.exe	nqb30ZW.exe
PID 1672 wrote to memory of 3164	1672	nqb30ZW.exe	AppLaunch.exe
PID 1672 wrote to memory of 3164	1672	nqb30ZW.exe	AppLaunch.exe
PID 1672 wrote to memory of 3164	1672	nqb30ZW.exe	AppLaunch.exe
PID 1672 wrote to memory of 3164	1672	nqb30ZW.exe	AppLaunch.exe
PID 1672 wrote to memory of 3164	1672	nqb30ZW.exe	AppLaunch.exe
PID 4772 wrote to memory of 2900	4772	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe	rhG89nG.exe
PID 4772 wrote to memory of 2900	4772	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe	rhG89nG.exe
PID 4772 wrote to memory of 2900	4772	958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe	rhG89nG.exe
PID 2900 wrote to memory of 4824	2900	rhG89nG.exe	mnolyk.exe
PID 2900 wrote to memory of 4824	2900	rhG89nG.exe	mnolyk.exe
PID 2900 wrote to memory of 4824	2900	rhG89nG.exe	mnolyk.exe
PID 4824 wrote to memory of 3780	4824	mnolyk.exe	schtasks.exe
PID 4824 wrote to memory of 3780	4824	mnolyk.exe	schtasks.exe
PID 4824 wrote to memory of 3780	4824	mnolyk.exe	schtasks.exe
PID 4824 wrote to memory of 728	4824	mnolyk.exe	cmd.exe
PID 4824 wrote to memory of 728	4824	mnolyk.exe	cmd.exe
PID 4824 wrote to memory of 728	4824	mnolyk.exe	cmd.exe
PID 728 wrote to memory of 4672	728	cmd.exe	cmd.exe
PID 728 wrote to memory of 4672	728	cmd.exe	cmd.exe
PID 728 wrote to memory of 4672	728	cmd.exe	cmd.exe
PID 728 wrote to memory of 3640	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 3640	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 3640	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 3504	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 3504	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 3504	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 1688	728	cmd.exe	cmd.exe
PID 728 wrote to memory of 1688	728	cmd.exe	cmd.exe
PID 728 wrote to memory of 1688	728	cmd.exe	cmd.exe
PID 728 wrote to memory of 2236	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 2236	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 2236	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 4680	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 4680	728	cmd.exe	cacls.exe
PID 728 wrote to memory of 4680	728	cmd.exe	cacls.exe
PID 4824 wrote to memory of 2636	4824	mnolyk.exe	truno.exe
PID 4824 wrote to memory of 2636	4824	mnolyk.exe	truno.exe
PID 4824 wrote to memory of 2636	4824	mnolyk.exe	truno.exe
PID 2636 wrote to memory of 4904	2636	truno.exe	nwy46uP11.exe
PID 2636 wrote to memory of 4904	2636	truno.exe	nwy46uP11.exe
PID 2636 wrote to memory of 4904	2636	truno.exe	nwy46uP11.exe
PID 4904 wrote to memory of 4380	4904	nwy46uP11.exe	epk21ea.exe
PID 4904 wrote to memory of 4380	4904	nwy46uP11.exe	epk21ea.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe
"C:\Users\Admin\AppData\Local\Temp\958464805983bf05505a303c1ad9b9334e0925c62c8189027e0911a99ed7a29d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4772

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sLu31OQ.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sLu31OQ.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4856

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sWc21ht.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sWc21ht.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sHM96fW.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sHM96fW.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4552

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iKZ01fY.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iKZ01fY.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 1084
6⤵
- Program crash
PID:4000

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\knJ83bI.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\knJ83bI.exe
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1348
6⤵
- Program crash
PID:4376

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mHz45sc.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mHz45sc.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nqb30ZW.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nqb30ZW.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rhG89nG.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rhG89nG.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
"C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
4⤵
- Creates scheduled task(s)
PID:3780

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "Admin:N"&&CACLS "..\4f9dd6f8a7" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4672

C:\Windows\SysWOW64\cacls.exe
CACLS "mnolyk.exe" /P "Admin:N"
5⤵
PID:3640

C:\Windows\SysWOW64\cacls.exe
CACLS "mnolyk.exe" /P "Admin:R" /E
5⤵
PID:3504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1688

C:\Windows\SysWOW64\cacls.exe
CACLS "..\4f9dd6f8a7" /P "Admin:N"
5⤵
PID:2236

C:\Windows\SysWOW64\cacls.exe
CACLS "..\4f9dd6f8a7" /P "Admin:R" /E
5⤵
PID:4680

C:\Users\Admin\AppData\Local\Temp\1000005051\truno.exe
"C:\Users\Admin\AppData\Local\Temp\1000005051\truno.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2636

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nwy46uP11.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nwy46uP11.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\epk21ea.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\epk21ea.exe
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1296
7⤵
- Program crash
PID:4292

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hjL23vi.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hjL23vi.exe
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2576

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nEc81lq.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nEc81lq.exe
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3780

C:\Users\Admin\AppData\Local\Temp\1000006001\lebro.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\lebro.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2460

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:5096

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
6⤵
- Creates scheduled task(s)
PID:4360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit
6⤵
PID:3188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2432

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
7⤵
PID:3124

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
7⤵
PID:1520

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:N"
7⤵
PID:2732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3064

C:\Windows\SysWOW64\cacls.exe
CACLS "..\9e0894bcc4" /P "Admin:R" /E
7⤵
PID:3372

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe
"C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
PID:2928

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
PID:636

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
8⤵
- Creates scheduled task(s)
PID:4164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
8⤵
PID:1020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
9⤵
PID:5056

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
9⤵
PID:664

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
9⤵
PID:3348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
9⤵
PID:4636

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
9⤵
PID:4980

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
9⤵
PID:3480

C:\Users\Admin\AppData\Local\Temp\1000010001\2209.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\2209.exe"
8⤵
- Executes dropped EXE
PID:1868

C:\Users\Admin\AppData\Local\Temp\1000011001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000011001\random.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Users\Admin\AppData\Local\Temp\1000011001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000011001\random.exe" -h
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
8⤵
- Loads dropped DLL
PID:4712

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
9⤵
- Loads dropped DLL
PID:4820

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4820 -s 644
10⤵
- Program crash
PID:400

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
8⤵
- Loads dropped DLL
PID:4508

C:\Users\Admin\AppData\Local\Temp\1000129001\redline4.exe
"C:\Users\Admin\AppData\Local\Temp\1000129001\redline4.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 556
7⤵
- Program crash
PID:2012

C:\Users\Admin\AppData\Local\Temp\1000250001\r3NzWQ1.exe
"C:\Users\Admin\AppData\Local\Temp\1000250001\r3NzWQ1.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
7⤵
PID:4112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2248

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
9⤵
PID:336

C:\Windows\SysWOW64\chcp.com
chcp 1251
10⤵
PID:3916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
10⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
10⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
10⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432

C:\ProgramData\Dllhost\dllhost.exe
"C:\ProgramData\Dllhost\dllhost.exe"
9⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:3552

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:4884

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:3168

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:3264

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:1020

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:4908

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:1800

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:3356

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:4352

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:2116

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:1996

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:4240

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:1016

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:4660

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:3716

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:3956

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8761" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:3440

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8761" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:5100

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk265" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:2440

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk265" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:3756

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5348" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:1164

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3500" /TR "C:\ProgramData\Dllhost\dllhost.exe"
10⤵
PID:2180

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3500" /TR "C:\ProgramData\Dllhost\dllhost.exe"
11⤵
- Creates scheduled task(s)
PID:4400

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
10⤵
PID:3660

C:\Windows\SysWOW64\chcp.com
chcp 1251
11⤵
PID:212

C:\Users\Admin\AppData\Local\Temp\1000253001\v0j0cw.exe
"C:\Users\Admin\AppData\Local\Temp\1000253001\v0j0cw.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 148
7⤵
- Program crash
PID:1068

C:\Users\Admin\AppData\Local\Temp\1000257001\rh_0.exe
"C:\Users\Admin\AppData\Local\Temp\1000257001\rh_0.exe"
6⤵
- Executes dropped EXE
PID:3556

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\vcredist_e575757.dll",Options_RunDLL 09000603-0060-04b6-0d82-57898f9d4546
7⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:212

C:\Users\Admin\AppData\Local\Temp\1000260051\fxd.exe
"C:\Users\Admin\AppData\Local\Temp\1000260051\fxd.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
PID:1964

C:\Users\Admin\AppData\Local\Temp\1000261001\buildd.exe
"C:\Users\Admin\AppData\Local\Temp\1000261001\buildd.exe"
6⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4408

C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
7⤵
PID:2152

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\system32\cmd.exe
cmd /C "wmic cpu get name"
7⤵
PID:2012

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
8⤵
PID:3440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "" "start-process C:\Users\Admin\AppData\Local\Temp\rRRqpuu29e.exe"
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2264

C:\Users\Admin\AppData\Local\Temp\1000262001\ppi.exe
"C:\Users\Admin\AppData\Local\Temp\1000262001\ppi.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
7⤵
PID:4684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
7⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
PID:4956

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
6⤵
- Loads dropped DLL
PID:4632

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
7⤵
- Loads dropped DLL
PID:3496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3496 -s 644
8⤵
- Program crash
PID:3436

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
6⤵
- Loads dropped DLL
PID:3012

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 840 -ip 840
1⤵
PID:616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4704 -ip 4704
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3496 -ip 3496
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4712 -ip 4712
1⤵
PID:3416

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:1900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 604
3⤵
- Program crash
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 632 -ip 632
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4380 -ip 4380
1⤵
PID:4996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 3496 -ip 3496
1⤵
PID:3368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 4820 -ip 4820
1⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
1⤵
- Executes dropped EXE
PID:452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

Modify Registry

Scripting

Web Service

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery