risepro | ff2c2ae77e1b00829710601852b7dd95c4db15f332838807605e53bde54692df

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	B53zhsCKae4yhkKy8qFy_hNN.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5216	netsh.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	B53zhsCKae4yhkKy8qFy_hNN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	B53zhsCKae4yhkKy8qFy_hNN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	nsxF0D5.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	is0aLNVKAk6npM3zJpN9xPpJ.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	OAC8K1C8MMpBEQ3Wg8ronRdg.exe

Executes dropped EXE 19 IoCs

pid	Process
3796	47ac0emFNG2XoPifo4ZL_7bZ.exe
5516	67gnySFCBoBJZMmu7VuDrEUx.exe
5524	B53zhsCKae4yhkKy8qFy_hNN.exe
5544	aP_z3dUuiKh9HlR5B7OMhrVx.exe
5568	nEW5tktzCAakNvDH2R3tXMwC.exe
5556	juXnxJcUwMAHTwcPU603sRIs.exe
5892	juXnxJcUwMAHTwcPU603sRIs.tmp
2216	7t_0EqxkxxDaUy5S_J7GBjE9.exe
2704	s72el_FHKuIJ13PnzHDXtxRY.exe
5496	rN8DtEvvh5N1Ws2Wx3_izxgW.exe
2520	wdY_ggvF_dnyDUCWGBRxNUIv.exe
1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe
2796	iTpFsbykx98m0wzmeOrY51iF.exe
3772	is0aLNVKAk6npM3zJpN9xPpJ.exe
2364	X_FGT85pip3bL71in2VOK81a.exe
2556	qtsimpleftproutine.exe
3528	qtsimpleftproutine.exe
2816	Xz7lc5RqEwKTTOdTHCYPuwqm.exe
1712	Xz7lc5RqEwKTTOdTHCYPuwqm.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Wine	B53zhsCKae4yhkKy8qFy_hNN.exe

Loads dropped DLL 5 IoCs

pid	Process
5892	juXnxJcUwMAHTwcPU603sRIs.tmp
5892	juXnxJcUwMAHTwcPU603sRIs.tmp
5892	juXnxJcUwMAHTwcPU603sRIs.tmp
5544	aP_z3dUuiKh9HlR5B7OMhrVx.exe
5544	aP_z3dUuiKh9HlR5B7OMhrVx.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral30/memory/4260-0-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-1-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-9-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-12-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-14-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-15-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-16-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-17-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-18-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-19-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-20-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-28-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-148-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-572-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-733-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida
behavioral30/memory/4260-760-0x00007FF759F60000-0x00007FF75AA74000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	OAC8K1C8MMpBEQ3Wg8ronRdg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Drops Chrome extension 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\enlkbjlfeiapjjhhmdggmadklnbehdlg\1.5.4_0\manifest.json	is0aLNVKAk6npM3zJpN9xPpJ.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgmhkjfpialldbnnihoodfehhlmpplgf\1.5.6_0\manifest.json	is0aLNVKAk6npM3zJpN9xPpJ.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\difpelfbkngealhghppkgcpkgbgohhph\1.2.1_0\manifest.json	is0aLNVKAk6npM3zJpN9xPpJ.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eodoalbllilnnodleadlaicldmjoamak\1.2.1_0\manifest.json	is0aLNVKAk6npM3zJpN9xPpJ.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	api.myip.com
28	api.myip.com
29	ipinfo.io
30	ipinfo.io
116	api.myip.com
118	ipinfo.io

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy	s72el_FHKuIJ13PnzHDXtxRY.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	s72el_FHKuIJ13PnzHDXtxRY.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	s72el_FHKuIJ13PnzHDXtxRY.exe
File opened for modification	C:\Windows\System32\GroupPolicy	is0aLNVKAk6npM3zJpN9xPpJ.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	is0aLNVKAk6npM3zJpN9xPpJ.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	is0aLNVKAk6npM3zJpN9xPpJ.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	s72el_FHKuIJ13PnzHDXtxRY.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	is0aLNVKAk6npM3zJpN9xPpJ.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4260	setup.exe
5524	B53zhsCKae4yhkKy8qFy_hNN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 3068	2796	iTpFsbykx98m0wzmeOrY51iF.exe	120

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1768	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
872	5516	WerFault.exe	93
6028	2364	WerFault.exe	105
3632	3068	WerFault.exe	120
4244	5544	WerFault.exe	111
4184	2152	WerFault.exe	168
1104	2152	WerFault.exe	168
5260	5040	WerFault.exe	188
5164	2536	WerFault.exe	206

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	nEW5tktzCAakNvDH2R3tXMwC.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	nEW5tktzCAakNvDH2R3tXMwC.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	nEW5tktzCAakNvDH2R3tXMwC.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aP_z3dUuiKh9HlR5B7OMhrVx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aP_z3dUuiKh9HlR5B7OMhrVx.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4808	schtasks.exe
5280	schtasks.exe
3092	schtasks.exe
5356	schtasks.exe
2188	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	nsxF0D5.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4260	setup.exe
4260	setup.exe
5568	nEW5tktzCAakNvDH2R3tXMwC.exe
5568	nEW5tktzCAakNvDH2R3tXMwC.exe
5524	B53zhsCKae4yhkKy8qFy_hNN.exe
5524	B53zhsCKae4yhkKy8qFy_hNN.exe
5892	juXnxJcUwMAHTwcPU603sRIs.tmp
5892	juXnxJcUwMAHTwcPU603sRIs.tmp
1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe
1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe
2704	s72el_FHKuIJ13PnzHDXtxRY.exe
2704	s72el_FHKuIJ13PnzHDXtxRY.exe
2364	X_FGT85pip3bL71in2VOK81a.exe
2364	X_FGT85pip3bL71in2VOK81a.exe
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
5544	aP_z3dUuiKh9HlR5B7OMhrVx.exe
5544	aP_z3dUuiKh9HlR5B7OMhrVx.exe
2216	7t_0EqxkxxDaUy5S_J7GBjE9.exe
2216	7t_0EqxkxxDaUy5S_J7GBjE9.exe
3204	Process not Found
3204	Process not Found
5496	rN8DtEvvh5N1Ws2Wx3_izxgW.exe
5496	rN8DtEvvh5N1Ws2Wx3_izxgW.exe
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp
2704	nsxF0D5.tmp

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5568	nEW5tktzCAakNvDH2R3tXMwC.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeDebugPrivilege	4320	8E41.exe
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeDebugPrivilege	2816	Xz7lc5RqEwKTTOdTHCYPuwqm.exe
Token: SeImpersonatePrivilege	2816	Xz7lc5RqEwKTTOdTHCYPuwqm.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5892	juXnxJcUwMAHTwcPU603sRIs.tmp
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3796	4260	setup.exe	95
PID 4260 wrote to memory of 3796	4260	setup.exe	95
PID 4260 wrote to memory of 5516	4260	setup.exe	93
PID 4260 wrote to memory of 5516	4260	setup.exe	93
PID 4260 wrote to memory of 5516	4260	setup.exe	93
PID 4260 wrote to memory of 5524	4260	setup.exe	94
PID 4260 wrote to memory of 5524	4260	setup.exe	94
PID 4260 wrote to memory of 5524	4260	setup.exe	94
PID 4260 wrote to memory of 5544	4260	setup.exe	111
PID 4260 wrote to memory of 5544	4260	setup.exe	111
PID 4260 wrote to memory of 5544	4260	setup.exe	111
PID 4260 wrote to memory of 5568	4260	setup.exe	96
PID 4260 wrote to memory of 5568	4260	setup.exe	96
PID 4260 wrote to memory of 5568	4260	setup.exe	96
PID 4260 wrote to memory of 5556	4260	setup.exe	97
PID 4260 wrote to memory of 5556	4260	setup.exe	97
PID 4260 wrote to memory of 5556	4260	setup.exe	97
PID 5556 wrote to memory of 5892	5556	juXnxJcUwMAHTwcPU603sRIs.exe	99
PID 5556 wrote to memory of 5892	5556	juXnxJcUwMAHTwcPU603sRIs.exe	99
PID 5556 wrote to memory of 5892	5556	juXnxJcUwMAHTwcPU603sRIs.exe	99
PID 4260 wrote to memory of 2216	4260	setup.exe	100
PID 4260 wrote to memory of 2216	4260	setup.exe	100
PID 4260 wrote to memory of 2216	4260	setup.exe	100
PID 4260 wrote to memory of 2704	4260	setup.exe	109
PID 4260 wrote to memory of 2704	4260	setup.exe	109
PID 4260 wrote to memory of 5496	4260	setup.exe	108
PID 4260 wrote to memory of 5496	4260	setup.exe	108
PID 4260 wrote to memory of 5496	4260	setup.exe	108
PID 4260 wrote to memory of 2520	4260	setup.exe	107
PID 4260 wrote to memory of 2520	4260	setup.exe	107
PID 4260 wrote to memory of 2520	4260	setup.exe	107
PID 4260 wrote to memory of 1108	4260	setup.exe	102
PID 4260 wrote to memory of 1108	4260	setup.exe	102
PID 4260 wrote to memory of 1108	4260	setup.exe	102
PID 4260 wrote to memory of 2796	4260	setup.exe	101
PID 4260 wrote to memory of 2796	4260	setup.exe	101
PID 4260 wrote to memory of 2796	4260	setup.exe	101
PID 4260 wrote to memory of 3772	4260	setup.exe	106
PID 4260 wrote to memory of 3772	4260	setup.exe	106
PID 4260 wrote to memory of 3772	4260	setup.exe	106
PID 4260 wrote to memory of 2364	4260	setup.exe	105
PID 4260 wrote to memory of 2364	4260	setup.exe	105
PID 4260 wrote to memory of 2364	4260	setup.exe	105
PID 5892 wrote to memory of 2556	5892	juXnxJcUwMAHTwcPU603sRIs.tmp	112
PID 5892 wrote to memory of 2556	5892	juXnxJcUwMAHTwcPU603sRIs.tmp	112
PID 5892 wrote to memory of 2556	5892	juXnxJcUwMAHTwcPU603sRIs.tmp	112
PID 5892 wrote to memory of 3528	5892	juXnxJcUwMAHTwcPU603sRIs.tmp	113
PID 5892 wrote to memory of 3528	5892	juXnxJcUwMAHTwcPU603sRIs.tmp	113
PID 5892 wrote to memory of 3528	5892	juXnxJcUwMAHTwcPU603sRIs.tmp	113
PID 1108 wrote to memory of 4808	1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe	116
PID 1108 wrote to memory of 4808	1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe	116
PID 1108 wrote to memory of 4808	1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe	116
PID 1108 wrote to memory of 5280	1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe	117
PID 1108 wrote to memory of 5280	1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe	117
PID 1108 wrote to memory of 5280	1108	OAC8K1C8MMpBEQ3Wg8ronRdg.exe	117
PID 2796 wrote to memory of 5428	2796	iTpFsbykx98m0wzmeOrY51iF.exe	119
PID 2796 wrote to memory of 5428	2796	iTpFsbykx98m0wzmeOrY51iF.exe	119
PID 2796 wrote to memory of 5428	2796	iTpFsbykx98m0wzmeOrY51iF.exe	119
PID 2796 wrote to memory of 3068	2796	iTpFsbykx98m0wzmeOrY51iF.exe	120
PID 2796 wrote to memory of 3068	2796	iTpFsbykx98m0wzmeOrY51iF.exe	120
PID 2796 wrote to memory of 3068	2796	iTpFsbykx98m0wzmeOrY51iF.exe	120
PID 2796 wrote to memory of 3068	2796	iTpFsbykx98m0wzmeOrY51iF.exe	120
PID 2796 wrote to memory of 3068	2796	iTpFsbykx98m0wzmeOrY51iF.exe	120
PID 2796 wrote to memory of 3068	2796	iTpFsbykx98m0wzmeOrY51iF.exe	120

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\Documents\GuardFox\67gnySFCBoBJZMmu7VuDrEUx.exe
  "C:\Users\Admin\Documents\GuardFox\67gnySFCBoBJZMmu7VuDrEUx.exe"
  2⤵
  - Executes dropped EXE
  PID:5516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 340
    3⤵
    - Program crash
    PID:872
- C:\Users\Admin\Documents\GuardFox\B53zhsCKae4yhkKy8qFy_hNN.exe
  "C:\Users\Admin\Documents\GuardFox\B53zhsCKae4yhkKy8qFy_hNN.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5524
- C:\Users\Admin\Documents\GuardFox\47ac0emFNG2XoPifo4ZL_7bZ.exe
  "C:\Users\Admin\Documents\GuardFox\47ac0emFNG2XoPifo4ZL_7bZ.exe"
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Users\Admin\Documents\GuardFox\nEW5tktzCAakNvDH2R3tXMwC.exe
  "C:\Users\Admin\Documents\GuardFox\nEW5tktzCAakNvDH2R3tXMwC.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5568
- C:\Users\Admin\Documents\GuardFox\juXnxJcUwMAHTwcPU603sRIs.exe
  "C:\Users\Admin\Documents\GuardFox\juXnxJcUwMAHTwcPU603sRIs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Users\Admin\AppData\Local\Temp\is-Q6S6J.tmp\juXnxJcUwMAHTwcPU603sRIs.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-Q6S6J.tmp\juXnxJcUwMAHTwcPU603sRIs.tmp" /SL5="$80160,7495338,54272,C:\Users\Admin\Documents\GuardFox\juXnxJcUwMAHTwcPU603sRIs.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Users\Admin\AppData\Local\QT Simple FTP Routine\qtsimpleftproutine.exe
      "C:\Users\Admin\AppData\Local\QT Simple FTP Routine\qtsimpleftproutine.exe" -i
      4⤵
      Executes dropped EXE
      PID:2556
  - - C:\Users\Admin\AppData\Local\QT Simple FTP Routine\qtsimpleftproutine.exe
      "C:\Users\Admin\AppData\Local\QT Simple FTP Routine\qtsimpleftproutine.exe" -s
      4⤵
      Executes dropped EXE
      PID:3528
- C:\Users\Admin\Documents\GuardFox\7t_0EqxkxxDaUy5S_J7GBjE9.exe
  "C:\Users\Admin\Documents\GuardFox\7t_0EqxkxxDaUy5S_J7GBjE9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Users\Admin\Documents\GuardFox\iTpFsbykx98m0wzmeOrY51iF.exe
  "C:\Users\Admin\Documents\GuardFox\iTpFsbykx98m0wzmeOrY51iF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1188
      4⤵
      Program crash
      PID:3632
- C:\Users\Admin\Documents\GuardFox\OAC8K1C8MMpBEQ3Wg8ronRdg.exe
  "C:\Users\Admin\Documents\GuardFox\OAC8K1C8MMpBEQ3Wg8ronRdg.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5280
- C:\Users\Admin\Documents\GuardFox\X_FGT85pip3bL71in2VOK81a.exe
  "C:\Users\Admin\Documents\GuardFox\X_FGT85pip3bL71in2VOK81a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 1116
    3⤵
    - Program crash
    PID:6028
- C:\Users\Admin\Documents\GuardFox\is0aLNVKAk6npM3zJpN9xPpJ.exe
  "C:\Users\Admin\Documents\GuardFox\is0aLNVKAk6npM3zJpN9xPpJ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  PID:3772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Enumerates system info in registry
    PID:4432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:8
      4⤵
      PID:2584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:8
      4⤵
      PID:4792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:2
      4⤵
      PID:5604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:1
      4⤵
      PID:416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4848 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4704 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:1
      4⤵
      PID:5188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5424 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:8
      4⤵
      PID:4120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:8
      4⤵
      PID:6012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 --field-trial-handle=1880,i,6745122245749946942,4184550621757524600,131072 /prefetch:8
      4⤵
      PID:3524
- C:\Users\Admin\Documents\GuardFox\wdY_ggvF_dnyDUCWGBRxNUIv.exe
  "C:\Users\Admin\Documents\GuardFox\wdY_ggvF_dnyDUCWGBRxNUIv.exe"
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Users\Admin\Documents\GuardFox\rN8DtEvvh5N1Ws2Wx3_izxgW.exe
  "C:\Users\Admin\Documents\GuardFox\rN8DtEvvh5N1Ws2Wx3_izxgW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5496
- C:\Users\Admin\Documents\GuardFox\s72el_FHKuIJ13PnzHDXtxRY.exe
  "C:\Users\Admin\Documents\GuardFox\s72el_FHKuIJ13PnzHDXtxRY.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- - C:\Users\Admin\Documents\GuardFox\Xz7lc5RqEwKTTOdTHCYPuwqm.exe
    "C:\Users\Admin\Documents\GuardFox\Xz7lc5RqEwKTTOdTHCYPuwqm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4320
  - - C:\Users\Admin\Documents\GuardFox\Xz7lc5RqEwKTTOdTHCYPuwqm.exe
      "C:\Users\Admin\Documents\GuardFox\Xz7lc5RqEwKTTOdTHCYPuwqm.exe"
      4⤵
      Executes dropped EXE
      PID:1712
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2316
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4164
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:3684
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:2208
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5616
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4912
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3092
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:2368
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:5356
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:1768
- C:\Users\Admin\Documents\GuardFox\aP_z3dUuiKh9HlR5B7OMhrVx.exe
  "C:\Users\Admin\Documents\GuardFox\aP_z3dUuiKh9HlR5B7OMhrVx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 2356
    3⤵
    - Program crash
    PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5516 -ip 5516
1⤵
PID:6072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2364 -ip 2364
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3068 -ip 3068
1⤵
PID:1352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe63539758,0x7ffe63539768,0x7ffe63539778
1⤵
PID:5532

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5544 -ip 5544
1⤵
PID:3488

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:5216

C:\Users\Admin\AppData\Local\Temp\8E41.exe
C:\Users\Admin\AppData\Local\Temp\8E41.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9518.dll
1⤵
PID:1348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9518.dll
  2⤵
  PID:5588

C:\Users\Admin\AppData\Local\Temp\A380.exe
C:\Users\Admin\AppData\Local\Temp\A380.exe
1⤵
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1020
  2⤵
  - Program crash
  PID:4184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1028
  2⤵
  - Program crash
  PID:1104

C:\Users\Admin\AppData\Local\Temp\B44A.exe
C:\Users\Admin\AppData\Local\Temp\B44A.exe
1⤵
PID:224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 1084
    3⤵
    - Program crash
    PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2152 -ip 2152
1⤵
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2152 -ip 2152
1⤵
PID:756

C:\Users\Admin\AppData\Local\Temp\BC1B.exe
C:\Users\Admin\AppData\Local\Temp\BC1B.exe
1⤵
PID:6036
- C:\Users\Admin\AppData\Local\Temp\BC1B.exe
  C:\Users\Admin\AppData\Local\Temp\BC1B.exe
  2⤵
  PID:4968

C:\Users\Admin\AppData\Local\Temp\D4A6.exe
C:\Users\Admin\AppData\Local\Temp\D4A6.exe
1⤵
PID:2580
- C:\Users\Admin\AppData\Local\Temp\is-UE5A9.tmp\D4A6.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UE5A9.tmp\D4A6.tmp" /SL5="$90188,7516089,54272,C:\Users\Admin\AppData\Local\Temp\D4A6.exe"
  2⤵
  PID:5776

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4520

C:\Users\Admin\AppData\Local\Temp\E85D.exe
C:\Users\Admin\AppData\Local\Temp\E85D.exe
1⤵
PID:2548
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:5664
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 732
    3⤵
    - Program crash
    PID:5260
- C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
  2⤵
  PID:6032
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    PID:5760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      PID:5156
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:5584
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:2188
- - C:\Users\Admin\AppData\Local\Temp\nsxF0D5.tmp
    C:\Users\Admin\AppData\Local\Temp\nsxF0D5.tmp
    3⤵
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\nsxF0D5.tmp
      C:\Users\Admin\AppData\Local\Temp\nsxF0D5.tmp
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2704
- C:\Users\Admin\AppData\Local\Temp\FourthX.exe
  "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
  2⤵
  PID:532
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:2952

C:\Users\Admin\AppData\Local\Temp\F6F5.exe
C:\Users\Admin\AppData\Local\Temp\F6F5.exe
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5040 -ip 5040
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2536 -ip 2536
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion