amadey | 0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	D5E3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Player3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	EEFD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	D5E3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	D7D8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	E49B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	zyy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	D7D8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	F6EF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	EEFD.exe

Executes dropped EXE 40 IoCs

pid	Process
1964	D5E3.exe
1480	D5E3.exe
536	D7D8.exe
4884	D7D8.exe
2712	F4FA.exe
3348	E17D.exe
4976	D5E3.exe
2348	D7D8.exe
4840	E49B.exe
5116	Conhost.exe
4540	E9BD.exe
2812	zyy.exe
4324	ss31.exe
1468	build2.exe
4536	Player3.exe
664	build2.exe
4656	mstsca.exe
2044	zyy.exe
3692	zyy.exe
1276	D7D8.exe
3148	nbveek.exe
4060	EEFD.exe
4216	build3.exe
2712	F4FA.exe
432	F6EF.exe
1716	F990.exe
5092	FB75.exe
380	EEFD.exe
3748	build2.exe
5020	EEFD.exe
3520	build2.exe
4108	build3.exe
3172	build2.exe
1812	build2.exe
1008	build3.exe
4820	svcservice.exe
4300	7569.exe
4656	mstsca.exe
4684	nbveek.exe
3316	nbveek.exe

Loads dropped DLL 13 IoCs

pid	Process
1600	BackgroundTransferHost.exe
1060	rundll32.exe
664	build2.exe
664	build2.exe
1812	build2.exe
1812	build2.exe
4008	rundll32.exe
4008	rundll32.exe
3556	rundll32.exe
1764	rundll32.exe
1592	rundll32.exe
3520	build2.exe
3520	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1060	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7c7930bb-6d71-4ad5-bf74-8fc01aff984b\\D5E3.exe\" --AutoStart"	D5E3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	F6EF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	api.2ip.ua
51	api.2ip.ua
60	api.2ip.ua
61	api.2ip.ua
78	api.2ip.ua
83	api.2ip.ua
101	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2712	F4FA.exe
2712	F4FA.exe
2712	F4FA.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1480	1964	D5E3.exe	94
PID 536 set thread context of 4884	536	D7D8.exe	96
PID 2712 set thread context of 4976	2712	F4FA.exe	101
PID 1468 set thread context of 664	1468	build2.exe	113
PID 2348 set thread context of 1276	2348	D7D8.exe	114
PID 4656 set thread context of 4060	4656	mstsca.exe	116
PID 380 set thread context of 5020	380	EEFD.exe	136
PID 3748 set thread context of 3520	3748	build2.exe	137
PID 3172 set thread context of 1812	3172	build2.exe	155
PID 4008 set thread context of 1116	4008	rundll32.exe	194
PID 4008 set thread context of 2388	4008	rundll32.exe	199
PID 4008 set thread context of 2340	4008	rundll32.exe	200

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4924	4840	WerFault.exe	103
2388	1716	WerFault.exe	127
908	5092	WerFault.exe	130
2072	1600	WerFault.exe	143
1796	1060	WerFault.exe	145
616	432	WerFault.exe	129
3524	2712	WerFault.exe	118
4000	4300	WerFault.exe	176
1932	1764	WerFault.exe	183

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E9BD.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E9BD.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F4FA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	F4FA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F4FA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F4FA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E9BD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	F4FA.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4980	schtasks.exe
2420	schtasks.exe
1104	schtasks.exe
536	schtasks.exe
3828	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
3232	timeout.exe
3008	timeout.exe
2488	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\HELPDIR\	zyy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID\ = "{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}"	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID	zyy.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32	zyy.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\0	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}	zyy.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\0\win32	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID\ = "sqltest.Application"	Conhost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32\ = "ole32.dll"	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zyy.exe"	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID\ = "sqltest.Application"	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ = "Isqltest"	zyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application	Conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\ProxyStubClsid32	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID\ = "sqltest.Application"	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32\ = "ole32.dll"	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\HELPDIR	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zyy.exe"	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32\ = "ole32.dll"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID\ = "{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}"	zyy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\InprocHandler32	zyy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ = "sqltest.Application"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID\ = "sqltest.Application"	zyy.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}\1.0\FLAGS\ = "0"	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32	zyy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\ = "sqltest.Application"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zyy.exe"	zyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BE54215-DFC6-4D78-BF1A-E1F869104825}\TypeLib\Version = "1.0"	zyy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4BD8AC7-1474-45B9-87B4-845611FD1CAD}	zyy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\ProgID	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}\LocalServer32	Conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sqltest.Application\CLSID\ = "{069D06BB-F6A9-428D-9070-FCFF8F5BC5F4}"	Conhost.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	81	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	82	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3156	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2704	0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe
2704	0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found
3156	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3156	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2704	0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe
4540	E9BD.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found
Token: SeShutdownPrivilege	3156	Process not Found
Token: SeCreatePagefilePrivilege	3156	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1116	rundll32.exe
2388	rundll32.exe
2340	rundll32.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5116	Conhost.exe
2812	zyy.exe
2812	zyy.exe
5116	Conhost.exe
2044	zyy.exe
2044	zyy.exe
3692	zyy.exe
3692	zyy.exe
3156	Process not Found
3156	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1964	3156	Process not Found	93
PID 3156 wrote to memory of 1964	3156	Process not Found	93
PID 3156 wrote to memory of 1964	3156	Process not Found	93
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 1964 wrote to memory of 1480	1964	D5E3.exe	94
PID 3156 wrote to memory of 536	3156	Process not Found	95
PID 3156 wrote to memory of 536	3156	Process not Found	95
PID 3156 wrote to memory of 536	3156	Process not Found	95
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 536 wrote to memory of 4884	536	D7D8.exe	96
PID 1480 wrote to memory of 1060	1480	D5E3.exe	97
PID 1480 wrote to memory of 1060	1480	D5E3.exe	97
PID 1480 wrote to memory of 1060	1480	D5E3.exe	97
PID 1480 wrote to memory of 2712	1480	D5E3.exe	118
PID 1480 wrote to memory of 2712	1480	D5E3.exe	118
PID 1480 wrote to memory of 2712	1480	D5E3.exe	118
PID 3156 wrote to memory of 3348	3156	Process not Found	100
PID 3156 wrote to memory of 3348	3156	Process not Found	100
PID 3156 wrote to memory of 3348	3156	Process not Found	100
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 2712 wrote to memory of 4976	2712	F4FA.exe	101
PID 4884 wrote to memory of 2348	4884	D7D8.exe	102
PID 4884 wrote to memory of 2348	4884	D7D8.exe	102
PID 4884 wrote to memory of 2348	4884	D7D8.exe	102
PID 3156 wrote to memory of 4840	3156	Process not Found	103
PID 3156 wrote to memory of 4840	3156	Process not Found	103
PID 3156 wrote to memory of 4840	3156	Process not Found	103
PID 3348 wrote to memory of 2812	3348	Process not Found	104
PID 3348 wrote to memory of 2812	3348	Process not Found	104
PID 3348 wrote to memory of 2812	3348	Process not Found	104
PID 4840 wrote to memory of 5116	4840	E49B.exe	144
PID 4840 wrote to memory of 5116	4840	E49B.exe	144
PID 4840 wrote to memory of 5116	4840	E49B.exe	144
PID 3156 wrote to memory of 4540	3156	Process not Found	105
PID 3156 wrote to memory of 4540	3156	Process not Found	105
PID 3156 wrote to memory of 4540	3156	Process not Found	105
PID 4976 wrote to memory of 1468	4976	D5E3.exe	108
PID 4976 wrote to memory of 1468	4976	D5E3.exe	108
PID 4976 wrote to memory of 1468	4976	D5E3.exe	108
PID 3348 wrote to memory of 4324	3348	Process not Found	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe
"C:\Users\Admin\AppData\Local\Temp\0a1df7bd1cc61cf10a983f8bea2f4de4b4f1cc1a87c006ea474bb62131e10166.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2704

C:\Users\Admin\AppData\Local\Temp\D5E3.exe
C:\Users\Admin\AppData\Local\Temp\D5E3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\D5E3.exe
  C:\Users\Admin\AppData\Local\Temp\D5E3.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\7c7930bb-6d71-4ad5-bf74-8fc01aff984b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\D5E3.exe
    "C:\Users\Admin\AppData\Local\Temp\D5E3.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\D5E3.exe
      "C:\Users\Admin\AppData\Local\Temp\D5E3.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Users\Admin\AppData\Local\1f35956d-4e76-4b64-9007-580c0da395f3\build2.exe
        
        "C:\Users\Admin\AppData\Local\1f35956d-4e76-4b64-9007-580c0da395f3\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1468
      - C:\Users\Admin\AppData\Local\1f35956d-4e76-4b64-9007-580c0da395f3\build2.exe
        
        "C:\Users\Admin\AppData\Local\1f35956d-4e76-4b64-9007-580c0da395f3\build2.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\1f35956d-4e76-4b64-9007-580c0da395f3\build2.exe" & exit
        7⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\1f35956d-4e76-4b64-9007-580c0da395f3\build3.exe
        
        "C:\Users\Admin\AppData\Local\1f35956d-4e76-4b64-9007-580c0da395f3\build3.exe"
        5⤵
        Executes dropped EXE
        
        PID:4216
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:4980

C:\Users\Admin\AppData\Local\Temp\D7D8.exe
C:\Users\Admin\AppData\Local\Temp\D7D8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\D7D8.exe
  C:\Users\Admin\AppData\Local\Temp\D7D8.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Users\Admin\AppData\Local\Temp\D7D8.exe
    "C:\Users\Admin\AppData\Local\Temp\D7D8.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\D7D8.exe
      "C:\Users\Admin\AppData\Local\Temp\D7D8.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1276
    - - C:\Users\Admin\AppData\Local\add18c7c-6073-4e6c-8b10-cd1f9700ee7c\build2.exe
        
        "C:\Users\Admin\AppData\Local\add18c7c-6073-4e6c-8b10-cd1f9700ee7c\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3748
      - C:\Users\Admin\AppData\Local\add18c7c-6073-4e6c-8b10-cd1f9700ee7c\build2.exe
        
        "C:\Users\Admin\AppData\Local\add18c7c-6073-4e6c-8b10-cd1f9700ee7c\build2.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\add18c7c-6073-4e6c-8b10-cd1f9700ee7c\build2.exe" & exit
        7⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\add18c7c-6073-4e6c-8b10-cd1f9700ee7c\build3.exe
        
        "C:\Users\Admin\AppData\Local\add18c7c-6073-4e6c-8b10-cd1f9700ee7c\build3.exe"
        5⤵
        Executes dropped EXE
        
        PID:4108

C:\Users\Admin\AppData\Local\Temp\E17D.exe
C:\Users\Admin\AppData\Local\Temp\E17D.exe
1⤵
- Executes dropped EXE
PID:3348
- C:\Users\Admin\AppData\Local\Temp\zyy.exe
  "C:\Users\Admin\AppData\Local\Temp\zyy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\zyy.exe
    "C:\Users\Admin\AppData\Local\Temp\zyy.exe" -h
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3692
- C:\Users\Admin\AppData\Local\Temp\ss31.exe
  "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\Player3.exe
  "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4536
- - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3148
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2420
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
      4⤵
      PID:1404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4316
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        5⤵
        
        PID:4376
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        5⤵
        
        PID:4568
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:N"
        5⤵
        
        PID:5104
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:R" /E
        5⤵
        
        PID:4464
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4008
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:3556
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1764
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1764 -s 644
        6⤵
        Program crash
        
        PID:1932
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1592

C:\Users\Admin\AppData\Local\Temp\E49B.exe
C:\Users\Admin\AppData\Local\Temp\E49B.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\zyy.exe
  "C:\Users\Admin\AppData\Local\Temp\zyy.exe"
  2⤵
  PID:5116
- - C:\Users\Admin\AppData\Local\Temp\zyy.exe
    "C:\Users\Admin\AppData\Local\Temp\zyy.exe" -h
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1504
  2⤵
  - Program crash
  PID:4924

C:\Users\Admin\AppData\Local\Temp\E9BD.exe
C:\Users\Admin\AppData\Local\Temp\E9BD.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4840 -ip 4840
1⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\EEFD.exe
C:\Users\Admin\AppData\Local\Temp\EEFD.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4060
- C:\Users\Admin\AppData\Local\Temp\EEFD.exe
  "C:\Users\Admin\AppData\Local\Temp\EEFD.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\EEFD.exe
    "C:\Users\Admin\AppData\Local\Temp\EEFD.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5020
  - - C:\Users\Admin\AppData\Local\f7a91513-3b1c-4fce-81cf-8c602dcdc589\build2.exe
      "C:\Users\Admin\AppData\Local\f7a91513-3b1c-4fce-81cf-8c602dcdc589\build2.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3172
    - - C:\Users\Admin\AppData\Local\f7a91513-3b1c-4fce-81cf-8c602dcdc589\build2.exe
        
        "C:\Users\Admin\AppData\Local\f7a91513-3b1c-4fce-81cf-8c602dcdc589\build2.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:1812
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\f7a91513-3b1c-4fce-81cf-8c602dcdc589\build2.exe" & exit
        6⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:3008
  - - C:\Users\Admin\AppData\Local\f7a91513-3b1c-4fce-81cf-8c602dcdc589\build3.exe
      "C:\Users\Admin\AppData\Local\f7a91513-3b1c-4fce-81cf-8c602dcdc589\build3.exe"
      4⤵
      Executes dropped EXE
      PID:1008
    - - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:536

C:\Users\Admin\AppData\Local\Temp\F4FA.exe
C:\Users\Admin\AppData\Local\Temp\F4FA.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 676
  2⤵
  - Program crash
  PID:3524

C:\Users\Admin\AppData\Local\Temp\EEFD.exe
C:\Users\Admin\AppData\Local\Temp\EEFD.exe
1⤵
PID:4656

C:\Users\Admin\AppData\Local\Temp\F990.exe
C:\Users\Admin\AppData\Local\Temp\F990.exe
1⤵
- Executes dropped EXE
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 340
  2⤵
  - Program crash
  PID:2388

C:\Users\Admin\AppData\Local\Temp\F6EF.exe
C:\Users\Admin\AppData\Local\Temp\F6EF.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:432
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1116
  2⤵
  - Program crash
  PID:616

C:\Users\Admin\AppData\Local\Temp\FB75.exe
C:\Users\Admin\AppData\Local\Temp\FB75.exe
1⤵
- Executes dropped EXE
PID:5092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 340
  2⤵
  - Program crash
  PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1716 -ip 1716
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5092 -ip 5092
1⤵
PID:4356

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 600
    3⤵
    - Program crash
    PID:2072

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Loads dropped DLL
PID:1060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 600
  2⤵
  - Program crash
  PID:1796

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
1⤵
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1600 -ip 1600
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1060 -ip 1060
1⤵
PID:3700

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
- Loads dropped DLL
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 432 -ip 432
1⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2712 -ip 2712
1⤵
PID:924

C:\Users\Admin\AppData\Local\Temp\7569.exe
C:\Users\Admin\AppData\Local\Temp\7569.exe
1⤵
- Executes dropped EXE
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wtoahoepfise.dll,start
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  PID:4008
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 24185
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1116
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 24185
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2388
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 24185
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 400
  2⤵
  - Program crash
  PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4300 -ip 4300
1⤵
PID:1284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 1764 -ip 1764
1⤵
PID:1492

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4656
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3828

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:3316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery