64831a005b4eccebf7893444b55dd515b4aa54f705cdebd74443340049ce00be

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys"	mbamservice.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mbamservice.exe

Executes dropped EXE 8 IoCs

pid	Process
4160	7z2201.exe
4736	7z.exe
3688	7z.exe
760	rs.exe
3932	rs.tmp
4252	mbamservice.exe
4196	mbamservice.exe
4936	mbamtray.exe

Loads dropped DLL 51 IoCs

pid	Process
4736	7z.exe
3688	7z.exe
3932	rs.tmp
3932	rs.tmp
3932	rs.tmp
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4936	mbamtray.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 61 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\""	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32	mbamservice.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\H:	mbamservice.exe
File opened (read-only)	\??\P:	mbamservice.exe
File opened (read-only)	\??\U:	mbamservice.exe
File opened (read-only)	\??\Z:	mbamservice.exe
File opened (read-only)	\??\T:	mbamservice.exe
File opened (read-only)	\??\Y:	mbamservice.exe
File opened (read-only)	\??\A:	mbamservice.exe
File opened (read-only)	\??\E:	mbamservice.exe
File opened (read-only)	\??\I:	mbamservice.exe
File opened (read-only)	\??\L:	mbamservice.exe
File opened (read-only)	\??\N:	mbamservice.exe
File opened (read-only)	\??\S:	mbamservice.exe
File opened (read-only)	\??\B:	mbamservice.exe
File opened (read-only)	\??\G:	mbamservice.exe
File opened (read-only)	\??\M:	mbamservice.exe
File opened (read-only)	\??\O:	mbamservice.exe
File opened (read-only)	\??\Q:	mbamservice.exe
File opened (read-only)	\??\V:	mbamservice.exe
File opened (read-only)	\??\J:	mbamservice.exe
File opened (read-only)	\??\K:	mbamservice.exe
File opened (read-only)	\??\R:	mbamservice.exe
File opened (read-only)	\??\W:	mbamservice.exe
File opened (read-only)	\??\X:	mbamservice.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	mbamservice.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	mbamservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mng.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tk.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tr.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-ERKVE.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\en.ttt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ms.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\is-3RDC5.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-JPTQF.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\de.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fr.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\kab.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-6214A.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.cat	mbamservice.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ca.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\co.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\is-KNEUR.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\7-zip.chm	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-H6OEM.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\af.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\is-HPBAI.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\an.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ka.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ky.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ru.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\is-EP4M4.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\is-5HMQI.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-OAGNA.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-4FUAE.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-0GA8E.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\he.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\readme.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-0IB3P.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\cy.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\fur.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\da.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ug.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-QB14A.tmp	rs.tmp
File opened for modification	C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-J45DJ.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-9KMFM.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\ro.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tg.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\th.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-DQVS4.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\is-RQ5T0.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\es.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\hy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tk.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-JT8Q9.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-U7TIV.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-TI4PR.tmp	rs.tmp
File created	C:\Program Files (x86)\7-Zip\Lang\gu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sa.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7z.sfx	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\nn.txt	7z2201.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-TMGLR.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\scenegraph\is-ILT9J.tmp	rs.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\is-3KEU9.tmp	rs.tmp
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ast.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ky.txt	7z2201.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ELAMBKUP	mbamservice.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	mbamservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	4936	WerFault.exe	265

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mbamservice.exe

Delays execution with timeout.exe 18 IoCs

evasion

pid	Process
4776	timeout.exe
3964	timeout.exe
1476	timeout.exe
2060	timeout.exe
1052	timeout.exe
1692	timeout.exe
964	timeout.exe
1808	timeout.exe
3052	timeout.exe
2052	timeout.exe
3096	timeout.exe
464	timeout.exe
4728	timeout.exe
1660	timeout.exe
1424	timeout.exe
1564	timeout.exe
2972	timeout.exe
4040	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
4868	tasklist.exe
1904	tasklist.exe
1316	tasklist.exe
4868	tasklist.exe
3372	tasklist.exe
1680	tasklist.exe
2720	tasklist.exe
1960	tasklist.exe
3800	tasklist.exe
1480	tasklist.exe
5056	tasklist.exe
2148	tasklist.exe
3296	tasklist.exe
400	tasklist.exe
2948	tasklist.exe
1692	tasklist.exe
4660	tasklist.exe
1504	tasklist.exe
4728	tasklist.exe
3396	tasklist.exe
3080	tasklist.exe
1856	tasklist.exe
4996	tasklist.exe
4868	tasklist.exe
4760	tasklist.exe
1328	tasklist.exe
3868	tasklist.exe
3900	tasklist.exe
4728	tasklist.exe
4040	tasklist.exe
4828	tasklist.exe
676	tasklist.exe
1372	tasklist.exe
3344	tasklist.exe
4440	tasklist.exe
2340	tasklist.exe
4924	tasklist.exe
4924	tasklist.exe
996	tasklist.exe
2084	tasklist.exe
5036	tasklist.exe
4808	tasklist.exe
2752	tasklist.exe
1504	tasklist.exe
4448	tasklist.exe
2972	tasklist.exe
4204	tasklist.exe
3868	tasklist.exe
4948	tasklist.exe
4208	tasklist.exe
1788	tasklist.exe
4568	tasklist.exe
2932	tasklist.exe
4264	tasklist.exe
2716	tasklist.exe
3900	tasklist.exe
4380	tasklist.exe
2148	tasklist.exe
4160	tasklist.exe
4456	tasklist.exe
4864	tasklist.exe
3868	tasklist.exe
2724	tasklist.exe
2668	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	rs.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	rs.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	rs.tmp

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	mbamservice.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A10434E2-CAA7-48C4-9770-E9F215C51ECC}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{503084FD-0743-46C7-833F-D0057E8AC505}\ = "_ICleanControllerEventsV5"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\ProgID\ = "MB.ScanController.1"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\ProgID\ = "MB.UpdateController.1"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DAE713-FD88-4ADB-9406-04CB574D543C}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F3822FA-CCD5-4934-AB6D-3382B2F91DB9}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{834906DC-FA0F-4F61-BC62-24B0BEB3769C}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAB53395-8218-47FF-91B7-144994C0AD83}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{983849D5-BFE9-43E9-A9A0-CBAFBC917F39}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{562B1FA7-13DE-40A1-8839-AB2C5FA3129C}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E32ABD9A-1CBD-44A5-8A62-55D347D3C4F0}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3498D9E4-6476-4AC0-B53A-75BC9955EF37}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02143C0F-1656-4B2E-95E7-EA8178A29E2E}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620A01DD-16D2-4A83-B02C-E29BE38B3029}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\ = "_IScanControllerEventsV6"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A9108FB-A377-47EC-96E3-3CB8B1FB7272}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{32DF4C97-FE35-41AA-B18F-583AA53723A3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66328184-6592-46BE-B950-4FDA4417DF2E}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAB53395-8218-47FF-91B7-144994C0AD83}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\VersionIndependentProgID	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABC1D1AF-23ED-4483-BDA4-90BCC21DFBDB}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CFA1689-38D3-4AE9-B1E8-B039EB7AD988}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A9108FB-A377-47EC-96E3-3CB8B1FB7272}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90F4450A-B7B2-417C-8ABB-BBD1BDFBFC27}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4EA13DC-F9D2-4DB9-A19F-2B462FFC81F3}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E1BA0B73-14BD-4C9D-98CA-99355BD4EB24}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F128CCB-D86F-4998-803A-7CD58474FE2C}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732}\1.0\HELPDIR	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A10434E2-CAA7-48C4-9770-E9F215C51ECC}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC97FF29-5CE2-4897-8175-94672057E02D}\TypeLib\ = "{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{834906DC-FA0F-4F61-BC62-24B0BEB3769C}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79CAE9D0-99AA-4FEB-B6B1-1AC1A2D8F874}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1097B101-1FF8-4DD8-A6C1-6C39FB2EA5D6}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A153977-1A37-4EF7-9226-9E128FA51AE1}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7DAEEB9-30B6-4AC4-BB74-7763C950D8EC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53260A87-5F77-4449-95F1-77A210A2A6D8}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\TypeLib\ = "{C731375E-3199-4C88-8326-9F81D3224DAD}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC97FF29-5CE2-4897-8175-94672057E02D}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18C5830A-FF78-4172-9DFB-E4016D1C1F31}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2D4A69C-14CA-4825-9376-5B4215AF5C5E}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.LicenseController.1\CLSID	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\ProgID\ = "MB.SPController.1"	mbamservice.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4936	mbamtray.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3628	powershell.exe
3628	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe
4196	mbamservice.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4736	7z.exe
Token: 35	4736	7z.exe
Token: SeSecurityPrivilege	4736	7z.exe
Token: SeSecurityPrivilege	4736	7z.exe
Token: SeRestorePrivilege	3688	7z.exe
Token: 35	3688	7z.exe
Token: SeSecurityPrivilege	3688	7z.exe
Token: SeSecurityPrivilege	3688	7z.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: 33	4252	mbamservice.exe
Token: SeIncBasePriorityPrivilege	4252	mbamservice.exe
Token: 33	4196	mbamservice.exe
Token: SeIncBasePriorityPrivilege	4196	mbamservice.exe
Token: SeRestorePrivilege	4196	mbamservice.exe
Token: SeTakeOwnershipPrivilege	4196	mbamservice.exe
Token: SeRestorePrivilege	4196	mbamservice.exe
Token: SeBackupPrivilege	4196	mbamservice.exe
Token: SeRestorePrivilege	4196	mbamservice.exe
Token: SeBackupPrivilege	4196	mbamservice.exe
Token: SeRestorePrivilege	4196	mbamservice.exe
Token: SeTakeOwnershipPrivilege	4196	mbamservice.exe
Token: SeDebugPrivilege	3900	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	3372	tasklist.exe
Token: SeDebugPrivilege	3800	tasklist.exe
Token: SeDebugPrivilege	1444	tasklist.exe
Token: SeDebugPrivilege	676	tasklist.exe
Token: SeDebugPrivilege	4160	tasklist.exe
Token: SeDebugPrivilege	996	tasklist.exe
Token: SeDebugPrivilege	3080	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	2340	tasklist.exe
Token: SeDebugPrivilege	4924	tasklist.exe
Token: SeDebugPrivilege	4760	tasklist.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeDebugPrivilege	4232	tasklist.exe
Token: SeDebugPrivilege	1856	tasklist.exe
Token: SeDebugPrivilege	3748	tasklist.exe
Token: SeDebugPrivilege	1788	tasklist.exe
Token: SeDebugPrivilege	4456	tasklist.exe
Token: SeDebugPrivilege	1680	tasklist.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeDebugPrivilege	1572	tasklist.exe
Token: SeDebugPrivilege	1548	tasklist.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	4040	tasklist.exe
Token: SeDebugPrivilege	3596	tasklist.exe
Token: SeDebugPrivilege	4140	tasklist.exe
Token: SeDebugPrivilege	4448	tasklist.exe
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeDebugPrivilege	4224	tasklist.exe
Token: SeDebugPrivilege	1972	tasklist.exe
Token: SeDebugPrivilege	2720	tasklist.exe
Token: SeDebugPrivilege	1216	tasklist.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	1808	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	3868	tasklist.exe
Token: SeDebugPrivilege	5056	tasklist.exe
Token: SeDebugPrivilege	2716	tasklist.exe
Token: SeDebugPrivilege	4760	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3932	rs.tmp
4936	mbamtray.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4936	mbamtray.exe
4936	mbamtray.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2808	3440	Patch MB 4.6.x.xxx.exe	87
PID 3440 wrote to memory of 2808	3440	Patch MB 4.6.x.xxx.exe	87
PID 2808 wrote to memory of 4160	2808	cmd.exe	88
PID 2808 wrote to memory of 4160	2808	cmd.exe	88
PID 2808 wrote to memory of 4160	2808	cmd.exe	88
PID 2808 wrote to memory of 2088	2808	cmd.exe	90
PID 2808 wrote to memory of 2088	2808	cmd.exe	90
PID 2808 wrote to memory of 1100	2808	cmd.exe	89
PID 2808 wrote to memory of 1100	2808	cmd.exe	89
PID 1100 wrote to memory of 1500	1100	cmd.exe	93
PID 1100 wrote to memory of 1500	1100	cmd.exe	93
PID 2808 wrote to memory of 3664	2808	cmd.exe	91
PID 2808 wrote to memory of 3664	2808	cmd.exe	91
PID 3664 wrote to memory of 4188	3664	cmd.exe	92
PID 3664 wrote to memory of 4188	3664	cmd.exe	92
PID 2808 wrote to memory of 3460	2808	cmd.exe	95
PID 2808 wrote to memory of 3460	2808	cmd.exe	95
PID 2808 wrote to memory of 4736	2808	cmd.exe	96
PID 2808 wrote to memory of 4736	2808	cmd.exe	96
PID 2808 wrote to memory of 4736	2808	cmd.exe	96
PID 3460 wrote to memory of 3056	3460	cmd.exe	97
PID 3460 wrote to memory of 3056	3460	cmd.exe	97
PID 3460 wrote to memory of 368	3460	cmd.exe	98
PID 3460 wrote to memory of 368	3460	cmd.exe	98
PID 3460 wrote to memory of 4004	3460	cmd.exe	99
PID 3460 wrote to memory of 4004	3460	cmd.exe	99
PID 3460 wrote to memory of 2240	3460	cmd.exe	100
PID 3460 wrote to memory of 2240	3460	cmd.exe	100
PID 3460 wrote to memory of 4604	3460	cmd.exe	105
PID 3460 wrote to memory of 4604	3460	cmd.exe	105
PID 4604 wrote to memory of 3660	4604	cmd.exe	104
PID 4604 wrote to memory of 3660	4604	cmd.exe	104
PID 4604 wrote to memory of 5024	4604	cmd.exe	101
PID 4604 wrote to memory of 5024	4604	cmd.exe	101
PID 2808 wrote to memory of 3688	2808	cmd.exe	102
PID 2808 wrote to memory of 3688	2808	cmd.exe	102
PID 2808 wrote to memory of 3688	2808	cmd.exe	102
PID 3460 wrote to memory of 3964	3460	cmd.exe	103
PID 3460 wrote to memory of 3964	3460	cmd.exe	103
PID 2808 wrote to memory of 3628	2808	cmd.exe	108
PID 2808 wrote to memory of 3628	2808	cmd.exe	108
PID 2808 wrote to memory of 1176	2808	cmd.exe	110
PID 2808 wrote to memory of 1176	2808	cmd.exe	110
PID 1176 wrote to memory of 760	1176	powershell.exe	112
PID 1176 wrote to memory of 760	1176	powershell.exe	112
PID 1176 wrote to memory of 760	1176	powershell.exe	112
PID 760 wrote to memory of 3932	760	rs.exe	114
PID 760 wrote to memory of 3932	760	rs.exe	114
PID 760 wrote to memory of 3932	760	rs.exe	114
PID 3460 wrote to memory of 4040	3460	cmd.exe	116
PID 3460 wrote to memory of 4040	3460	cmd.exe	116
PID 3460 wrote to memory of 3096	3460	cmd.exe	118
PID 3460 wrote to memory of 3096	3460	cmd.exe	118
PID 3460 wrote to memory of 464	3460	cmd.exe	119
PID 3460 wrote to memory of 464	3460	cmd.exe	119
PID 3460 wrote to memory of 4728	3460	cmd.exe	120
PID 3460 wrote to memory of 4728	3460	cmd.exe	120
PID 3460 wrote to memory of 4776	3460	cmd.exe	122
PID 3460 wrote to memory of 4776	3460	cmd.exe	122
PID 3460 wrote to memory of 1660	3460	cmd.exe	125
PID 3460 wrote to memory of 1660	3460	cmd.exe	125
PID 3460 wrote to memory of 1808	3460	cmd.exe	127
PID 3460 wrote to memory of 1808	3460	cmd.exe	127
PID 3460 wrote to memory of 1424	3460	cmd.exe	128

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2088	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe
"C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\074YBV47.bat" "C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe""
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\findstr.exe
      findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:1500
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\system32\findstr.exe
      findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\system32\mode.com
      mode con:cols=86 lines=36
      4⤵
      PID:3056
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:368
  - - C:\Windows\system32\mode.com
      mode 70,4
      4⤵
      PID:4004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul
      4⤵
      PID:2240
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c echo prompt $H|cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4604
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4040
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3096
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:464
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4728
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4776
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1660
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1808
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1424
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:964
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1476
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2060
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1052
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3052
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1564
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2052
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1692
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4428
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3576
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4380
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4456
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4692
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1572
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1904
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2716
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5008
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5004
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3800
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3664
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1808
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3940
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2764
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3336
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3632
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4924
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4620
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2420
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4304
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4568
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5056
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4868
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:624
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1072
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4468
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3212
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2764
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3360
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1212
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1524
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1428
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3296
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3236
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:396
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2764
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4784
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4868
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\ck.7z" -o"C:\ProgramData" -pnghfvjdfnhmgfdfGDFGdfkjxhfsdg6ujdshjflksd -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pFHFiuhyt6gfhjdgdgfduh675rgkhidfgHFDSSyg6f5s7dg -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\rs.exe
      "C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\is-VBHGV.tmp\rs.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VBHGV.tmp\rs.tmp" /SL5="$16002E,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        
        PID:3932
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\BaltimoreCyberTrustRoot.crt"
        6⤵
        
        PID:2648
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\DigiCertEVRoot.crt"
        6⤵
        
        PID:4772
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service /Protected
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Registers COM server for autorun
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"
1⤵
PID:3660

C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1264
    3⤵
    - Program crash
    PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4936 -ip 4936
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery