betabot | 7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/3920-190-0x0000000003A30000-0x0000000003ACD000-memory.dmp	family_vidar
behavioral2/memory/3920-191-0x0000000000400000-0x0000000001DDD000-memory.dmp	family_vidar
behavioral2/memory/3920-227-0x0000000000400000-0x0000000001DDD000-memory.dmp	family_vidar

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\77cg15c9so17.exe	C60F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\77cg15c9so17.exe\DisableExceptionChainValidation	C60F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "vkupwuasgf.exe"	explorer.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	CF09.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70exe.exe

Executes dropped EXE 16 IoCs

pid	Process
3132	setup.exe
4456	WerFault.exe
3984	WerFault.exe
3612	setup_install.exe
3196	Mon108166492cc.exe
4852	Mon1010787a8e41.exe
4640	Mon1010d117630.exe
2884	Mon100785fd63739.exe
2184	Mon10589f756fdde.exe
1632	Mon10ab7036e57f455.exe
3224	Mon106dc47d7f4c0.exe
3920	Mon1043829e64.exe
1480	Mon100785fd63739.tmp
3336	C60F.exe
2192	CF09.exe
2724	WindowsUpdater.exe

Loads dropped DLL 13 IoCs

pid	Process
4456	WerFault.exe
4456	WerFault.exe
4456	WerFault.exe
4456	WerFault.exe
3612	setup_install.exe
3612	setup_install.exe
3612	setup_install.exe
3612	setup_install.exe
3612	setup_install.exe
3612	setup_install.exe
1480	Mon100785fd63739.tmp
2724	WindowsUpdater.exe
2724	WindowsUpdater.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\77cg15c9so17.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\77cg15c9so17.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	C60F.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3336	C60F.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
4988	3612	WerFault.exe
1708	3920	WerFault.exe	105
4692	3920	WerFault.exe	105
4428	3920	WerFault.exe	105
4112	3920	WerFault.exe	105
1536	3920	WerFault.exe	105
3748	3920	WerFault.exe	105
1392	2184	WerFault.exe	99
224	3920	WerFault.exe	105
1208	3920	WerFault.exe	105
3256	3920	WerFault.exe	105
3336	3920	WerFault.exe	105
2080	3920	WerFault.exe	105
3524	3920	WerFault.exe	105
5044	3920	WerFault.exe	105
2572	3920	WerFault.exe	105
3572	3920	WerFault.exe	105
4604	3920	WerFault.exe	105
1120	3920	WerFault.exe	105
4428	4852	WerFault.exe	109
536	4640	WerFault.exe	98
4860	3088	WerFault.exe	166
2348	728	WerFault.exe	177
4128	2408	WerFault.exe	183
1372	3628	WerFault.exe	187
5004	3500	WerFault.exe	195

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon10589f756fdde.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon10589f756fdde.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon10589f756fdde.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C60F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C60F.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1208	WerFault.exe
1208	WerFault.exe
1208	WerFault.exe
2184	Mon10589f756fdde.exe
2184	Mon10589f756fdde.exe
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
2184	Mon10589f756fdde.exe
3336	C60F.exe
3336	C60F.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe
3088	explorer.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	Mon108166492cc.exe
Token: SeDebugPrivilege	1632	Mon10ab7036e57f455.exe
Token: SeDebugPrivilege	1208	WerFault.exe
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeDebugPrivilege	3336	C60F.exe
Token: SeRestorePrivilege	3336	C60F.exe
Token: SeBackupPrivilege	3336	C60F.exe
Token: SeLoadDriverPrivilege	3336	C60F.exe
Token: SeCreatePagefilePrivilege	3336	C60F.exe
Token: SeShutdownPrivilege	3336	C60F.exe
Token: SeTakeOwnershipPrivilege	3336	C60F.exe
Token: SeChangeNotifyPrivilege	3336	C60F.exe
Token: SeCreateTokenPrivilege	3336	C60F.exe
Token: SeMachineAccountPrivilege	3336	C60F.exe
Token: SeSecurityPrivilege	3336	C60F.exe
Token: SeAssignPrimaryTokenPrivilege	3336	C60F.exe
Token: SeCreateGlobalPrivilege	3336	C60F.exe
Token: 33	3336	C60F.exe
Token: SeDebugPrivilege	3088	explorer.exe
Token: SeRestorePrivilege	3088	explorer.exe
Token: SeBackupPrivilege	3088	explorer.exe
Token: SeLoadDriverPrivilege	3088	explorer.exe
Token: SeCreatePagefilePrivilege	3088	explorer.exe
Token: SeShutdownPrivilege	3088	explorer.exe
Token: SeTakeOwnershipPrivilege	3088	explorer.exe
Token: SeChangeNotifyPrivilege	3088	explorer.exe
Token: SeCreateTokenPrivilege	3088	explorer.exe
Token: SeMachineAccountPrivilege	3088	explorer.exe
Token: SeSecurityPrivilege	3088	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3088	explorer.exe
Token: SeCreateGlobalPrivilege	3088	explorer.exe
Token: 33	3088	explorer.exe
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3132	2460	7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70exe.exe	91
PID 2460 wrote to memory of 3132	2460	7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70exe.exe	91
PID 2460 wrote to memory of 3132	2460	7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70exe.exe	91
PID 3132 wrote to memory of 4456	3132	setup.exe	121
PID 3132 wrote to memory of 4456	3132	setup.exe	121
PID 3132 wrote to memory of 4456	3132	setup.exe	121
PID 4456 wrote to memory of 4924	4456	WerFault.exe	126
PID 4456 wrote to memory of 4924	4456	WerFault.exe	126
PID 4456 wrote to memory of 4924	4456	WerFault.exe	126
PID 4924 wrote to memory of 3984	4924	cmd.exe	136
PID 4924 wrote to memory of 3984	4924	cmd.exe	136
PID 4924 wrote to memory of 3984	4924	cmd.exe	136
PID 3984 wrote to memory of 3612	3984	WerFault.exe	123
PID 3984 wrote to memory of 3612	3984	WerFault.exe	123
PID 3984 wrote to memory of 3612	3984	WerFault.exe	123
PID 3612 wrote to memory of 5008	3612	setup_install.exe	131
PID 3612 wrote to memory of 5008	3612	setup_install.exe	131
PID 3612 wrote to memory of 5008	3612	setup_install.exe	131
PID 3612 wrote to memory of 4752	3612	setup_install.exe	117
PID 3612 wrote to memory of 4752	3612	setup_install.exe	117
PID 3612 wrote to memory of 4752	3612	setup_install.exe	117
PID 3612 wrote to memory of 848	3612	setup_install.exe	116
PID 3612 wrote to memory of 848	3612	setup_install.exe	116
PID 3612 wrote to memory of 848	3612	setup_install.exe	116
PID 3612 wrote to memory of 2652	3612	setup_install.exe	115
PID 3612 wrote to memory of 2652	3612	setup_install.exe	115
PID 3612 wrote to memory of 2652	3612	setup_install.exe	115
PID 3612 wrote to memory of 968	3612	setup_install.exe	114
PID 3612 wrote to memory of 968	3612	setup_install.exe	114
PID 3612 wrote to memory of 968	3612	setup_install.exe	114
PID 3612 wrote to memory of 920	3612	setup_install.exe	113
PID 3612 wrote to memory of 920	3612	setup_install.exe	113
PID 3612 wrote to memory of 920	3612	setup_install.exe	113
PID 3612 wrote to memory of 2316	3612	setup_install.exe	112
PID 3612 wrote to memory of 2316	3612	setup_install.exe	112
PID 3612 wrote to memory of 2316	3612	setup_install.exe	112
PID 3612 wrote to memory of 3572	3612	setup_install.exe	156
PID 3612 wrote to memory of 3572	3612	setup_install.exe	156
PID 3612 wrote to memory of 3572	3612	setup_install.exe	156
PID 3612 wrote to memory of 3800	3612	setup_install.exe	110
PID 3612 wrote to memory of 3800	3612	setup_install.exe	110
PID 3612 wrote to memory of 3800	3612	setup_install.exe	110
PID 3800 wrote to memory of 3196	3800	cmd.exe	97
PID 3800 wrote to memory of 3196	3800	cmd.exe	97
PID 4752 wrote to memory of 4852	4752	cmd.exe	109
PID 4752 wrote to memory of 4852	4752	cmd.exe	109
PID 4752 wrote to memory of 4852	4752	cmd.exe	109
PID 2316 wrote to memory of 4640	2316	cmd.exe	98
PID 2316 wrote to memory of 4640	2316	cmd.exe	98
PID 2316 wrote to memory of 4640	2316	cmd.exe	98
PID 920 wrote to memory of 2884	920	cmd.exe	108
PID 920 wrote to memory of 2884	920	cmd.exe	108
PID 920 wrote to memory of 2884	920	cmd.exe	108
PID 5008 wrote to memory of 1208	5008	WerFault.exe	138
PID 5008 wrote to memory of 1208	5008	WerFault.exe	138
PID 5008 wrote to memory of 1208	5008	WerFault.exe	138
PID 3572 wrote to memory of 1632	3572	WerFault.exe	100
PID 3572 wrote to memory of 1632	3572	WerFault.exe	100
PID 848 wrote to memory of 2184	848	cmd.exe	99
PID 848 wrote to memory of 2184	848	cmd.exe	99
PID 848 wrote to memory of 2184	848	cmd.exe	99
PID 2652 wrote to memory of 3224	2652	cmd.exe	101
PID 2652 wrote to memory of 3224	2652	cmd.exe	101
PID 968 wrote to memory of 3920	968	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70exe.exe
"C:\Users\Admin\AppData\Local\Temp\7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70exe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Local\Temp\7zSC3C0C777\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC3C0C777\setup_install.exe"
    3⤵
    PID:4456

C:\Users\Admin\AppData\Local\Temp\8572490dc48c4520c7.exe
C:\Users\Admin\AppData\Local\Temp\8572490dc48c4520c7.exe
1⤵
PID:3984
- C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3612

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon108166492cc.exe
Mon108166492cc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon1010d117630.exe
Mon1010d117630.exe
1⤵
- Executes dropped EXE
PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 900
  2⤵
  - Program crash
  PID:536

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon10589f756fdde.exe
Mon10589f756fdde.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 372
  2⤵
  - Program crash
  PID:1392

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon10ab7036e57f455.exe
Mon10ab7036e57f455.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon106dc47d7f4c0.exe
Mon106dc47d7f4c0.exe
1⤵
- Executes dropped EXE
PID:3224

C:\Users\Admin\AppData\Local\Temp\is-M82BS.tmp\Mon100785fd63739.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M82BS.tmp\Mon100785fd63739.tmp" /SL5="$60162,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon100785fd63739.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 580
1⤵
- Program crash
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3612 -ip 3612
1⤵
PID:2956

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon1043829e64.exe
Mon1043829e64.exe
1⤵
- Executes dropped EXE
PID:3920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 824
  2⤵
  - Program crash
  PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 860
  2⤵
  - Program crash
  PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 872
  2⤵
  - Program crash
  PID:4428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 864
  2⤵
  - Program crash
  PID:4112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1016
  2⤵
  - Program crash
  PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1056
  2⤵
  - Program crash
  PID:3748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1524
  2⤵
  - Program crash
  PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1596
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1780
  2⤵
  - Program crash
  PID:3256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1740
  2⤵
  - Program crash
  PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1616
  2⤵
  - Program crash
  PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1600
  2⤵
  - Program crash
  PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1536
  2⤵
  - Program crash
  PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1600
  2⤵
  - Program crash
  PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1656
  2⤵
  - Program crash
  - Suspicious use of WriteProcessMemory
  PID:3572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1612
  2⤵
  - Program crash
  PID:4604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1048
  2⤵
  - Program crash
  PID:1120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon100785fd63739.exe
Mon100785fd63739.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Users\Admin\AppData\Local\Temp\7zS09FD2D47\Mon1010787a8e41.exe
Mon1010787a8e41.exe
1⤵
- Executes dropped EXE
PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 28528
  2⤵
  - Program crash
  PID:4428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon108166492cc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10ab7036e57f455.exe
1⤵
PID:3572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon1010d117630.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon100785fd63739.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon1043829e64.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon106dc47d7f4c0.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\ProgramData\Java Updater\77cg15c9so17.exe
  /prstb
  2⤵
  PID:64
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 1148
      4⤵
      Program crash
      PID:2348
- C:\ProgramData\Java Updater\77cg15c9so17.exe
  /prstb
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:2408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1144
      4⤵
      Program crash
      PID:4128
- C:\ProgramData\Java Updater\77cg15c9so17.exe
  /prstb
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:3628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 1112
      4⤵
      Program crash
      PID:1372
- C:\ProgramData\Java Updater\77cg15c9so17.exe
  /prstb
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:3500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1140
      4⤵
      Program crash
      PID:5004
- C:\ProgramData\Java Updater\77cg15c9so17.exe
  /prstb
  2⤵
  PID:2932
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:3360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10589f756fdde.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon1010787a8e41.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3920 -ip 3920
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3920 -ip 3920
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\8572490dc48c4520c7.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3920 -ip 3920
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3920 -ip 3920
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3920 -ip 3920
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3920 -ip 3920
1⤵
- Suspicious use of WriteProcessMemory
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2184 -ip 2184
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3920 -ip 3920
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3920 -ip 3920
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3920 -ip 3920
1⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3920 -ip 3920
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3920 -ip 3920
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3920 -ip 3920
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3920 -ip 3920
1⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3920 -ip 3920
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3920 -ip 3920
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3920 -ip 3920
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3920 -ip 3920
1⤵
PID:1908

C:\Users\Admin\AppData\Local\Temp\C60F.exe
C:\Users\Admin\AppData\Local\Temp\C60F.exe
1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3336
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - Modifies firewall policy service
  - Sets file execution options in registry
  - Checks BIOS information in registry
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1080
    3⤵
    - Program crash
    PID:4860

C:\Users\Admin\AppData\Local\Temp\CF09.exe
C:\Users\Admin\AppData\Local\Temp\CF09.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2192
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4852 -ip 4852
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4640 -ip 4640
1⤵
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3088 -ip 3088
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 728 -ip 728
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2408 -ip 2408
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3628 -ip 3628
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3500 -ip 3500
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery