amadey | 3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5FB5.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	5FB5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\5FB5.exe = "0"	5FB5.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5AF1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	filename.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/4460-657-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-658-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-665-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-664-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-667-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-666-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-668-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-671-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-672-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-682-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-681-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-683-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4460-684-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	filename.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5AF1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5AF1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	filename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	filename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe

Deletes itself 1 IoCs

pid	Process
3348	Process not Found

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	RegAsm.exe

Executes dropped EXE 11 IoCs

pid	Process
4908	D6B9.exe
2976	9DF.exe
4984	3A47.exe
3504	4B9E.exe
1240	5AF1.exe
4452	5FB5.exe
2996	filename.exe
4696	qemu-ga.exe
4256	explorgu.exe
2008	updater.exe
3140	fjcbhru

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000\Software\Wine	5AF1.exe
Key opened	\REGISTRY\USER\S-1-5-21-2694788800-2737334826-1937309534-1000\Software\Wine	explorgu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 14 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000600000001ac10-124.dat	themida
behavioral2/files/0x000600000001ac10-125.dat	themida
behavioral2/memory/2996-126-0x00007FF7C1010000-0x00007FF7C1D63000-memory.dmp	themida
behavioral2/memory/2996-129-0x00007FF7C1010000-0x00007FF7C1D63000-memory.dmp	themida
behavioral2/memory/2996-131-0x00007FF7C1010000-0x00007FF7C1D63000-memory.dmp	themida
behavioral2/memory/2996-132-0x00007FF7C1010000-0x00007FF7C1D63000-memory.dmp	themida
behavioral2/memory/2996-405-0x00007FF7C1010000-0x00007FF7C1D63000-memory.dmp	themida
behavioral2/memory/2996-460-0x00007FF7C1010000-0x00007FF7C1D63000-memory.dmp	themida
behavioral2/files/0x000600000001ac1e-466.dat	themida
behavioral2/files/0x000600000001ac1e-467.dat	themida
behavioral2/memory/2008-469-0x00007FF61A2B0000-0x00007FF61B003000-memory.dmp	themida
behavioral2/memory/2008-474-0x00007FF61A2B0000-0x00007FF61B003000-memory.dmp	themida
behavioral2/memory/2008-476-0x00007FF61A2B0000-0x00007FF61B003000-memory.dmp	themida
behavioral2/memory/2008-655-0x00007FF61A2B0000-0x00007FF61B003000-memory.dmp	themida

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4460-650-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-651-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-654-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-656-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-652-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-657-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-658-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-665-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-664-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-667-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-666-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-668-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-671-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-672-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-682-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-681-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-683-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4460-684-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\5FB5.exe = "0"	5FB5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	5FB5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	5FB5.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	filename.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5FB5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5FB5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000600000001ac31-697.dat	autoit_exe
behavioral2/files/0x000600000001ac31-704.dat	autoit_exe
behavioral2/files/0x000600000001ac31-713.dat	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	filename.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1240	5AF1.exe
2996	filename.exe
2008	updater.exe
4256	explorgu.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2976 set thread context of 4208	2976	9DF.exe	75
PID 3504 set thread context of 3752	3504	4B9E.exe	84
PID 4452 set thread context of 4024	4452	5FB5.exe	90
PID 2008 set thread context of 1824	2008	updater.exe	139
PID 2008 set thread context of 4460	2008	updater.exe	141

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	5AF1.exe

Launches sc.exe 22 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4976	sc.exe
4664	sc.exe
860	sc.exe
3784	sc.exe
2932	sc.exe
5236	sc.exe
5844	sc.exe
4968	sc.exe
5852	sc.exe
5556	sc.exe
1364	sc.exe
4960	sc.exe
2560	sc.exe
5068	sc.exe
4468	sc.exe
4120	sc.exe
1808	sc.exe
648	sc.exe
2840	sc.exe
1608	sc.exe
4068	sc.exe
5516	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4732	3140	WerFault.exe	140
1808	4276	WerFault.exe	167
5916	2220	WerFault.exe	196
2740	5444	WerFault.exe	199
5356	1664	WerFault.exe	202

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D6B9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D6B9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D6B9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fjcbhru
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fjcbhru
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fjcbhru

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5932	schtasks.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1484	3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe
1484	3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1484	3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe
4908	D6B9.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeDebugPrivilege	4208	jsc.exe
Token: SeDebugPrivilege	3752	RegAsm.exe
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeIncreaseQuotaPrivilege	4452	powershell.exe
Token: SeSecurityPrivilege	4452	powershell.exe
Token: SeTakeOwnershipPrivilege	4452	powershell.exe
Token: SeLoadDriverPrivilege	4452	powershell.exe
Token: SeSystemProfilePrivilege	4452	powershell.exe
Token: SeSystemtimePrivilege	4452	powershell.exe
Token: SeProfSingleProcessPrivilege	4452	powershell.exe
Token: SeIncBasePriorityPrivilege	4452	powershell.exe
Token: SeCreatePagefilePrivilege	4452	powershell.exe
Token: SeBackupPrivilege	4452	powershell.exe
Token: SeRestorePrivilege	4452	powershell.exe
Token: SeShutdownPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeSystemEnvironmentPrivilege	4452	powershell.exe
Token: SeRemoteShutdownPrivilege	4452	powershell.exe
Token: SeUndockPrivilege	4452	powershell.exe
Token: SeManageVolumePrivilege	4452	powershell.exe
Token: 33	4452	powershell.exe
Token: 34	4452	powershell.exe
Token: 35	4452	powershell.exe
Token: 36	4452	powershell.exe
Token: SeShutdownPrivilege	4924	powercfg.exe
Token: SeCreatePagefilePrivilege	4924	powercfg.exe
Token: SeShutdownPrivilege	1444	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 4908	3348	Process not Found	73
PID 3348 wrote to memory of 4908	3348	Process not Found	73
PID 3348 wrote to memory of 4908	3348	Process not Found	73
PID 3348 wrote to memory of 2976	3348	Process not Found	74
PID 3348 wrote to memory of 2976	3348	Process not Found	74
PID 2976 wrote to memory of 4208	2976	9DF.exe	75
PID 2976 wrote to memory of 4208	2976	9DF.exe	75
PID 2976 wrote to memory of 4208	2976	9DF.exe	75
PID 2976 wrote to memory of 4208	2976	9DF.exe	75
PID 2976 wrote to memory of 4208	2976	9DF.exe	75
PID 3348 wrote to memory of 4984	3348	Process not Found	76
PID 3348 wrote to memory of 4984	3348	Process not Found	76
PID 3348 wrote to memory of 4984	3348	Process not Found	76
PID 3348 wrote to memory of 1472	3348	Process not Found	77
PID 3348 wrote to memory of 1472	3348	Process not Found	77
PID 1472 wrote to memory of 2192	1472	cmd.exe	79
PID 1472 wrote to memory of 2192	1472	cmd.exe	79
PID 3348 wrote to memory of 3504	3348	Process not Found	80
PID 3348 wrote to memory of 3504	3348	Process not Found	80
PID 3348 wrote to memory of 3504	3348	Process not Found	80
PID 3504 wrote to memory of 4664	3504	4B9E.exe	83
PID 3504 wrote to memory of 4664	3504	4B9E.exe	83
PID 3504 wrote to memory of 4664	3504	4B9E.exe	83
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3504 wrote to memory of 3752	3504	4B9E.exe	84
PID 3348 wrote to memory of 1240	3348	Process not Found	85
PID 3348 wrote to memory of 1240	3348	Process not Found	85
PID 3348 wrote to memory of 1240	3348	Process not Found	85
PID 3348 wrote to memory of 4452	3348	Process not Found	86
PID 3348 wrote to memory of 4452	3348	Process not Found	86
PID 3348 wrote to memory of 4452	3348	Process not Found	86
PID 4208 wrote to memory of 2996	4208	jsc.exe	87
PID 4208 wrote to memory of 2996	4208	jsc.exe	87
PID 4452 wrote to memory of 2984	4452	5FB5.exe	89
PID 4452 wrote to memory of 2984	4452	5FB5.exe	89
PID 4452 wrote to memory of 2984	4452	5FB5.exe	89
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 4452 wrote to memory of 4024	4452	5FB5.exe	90
PID 3752 wrote to memory of 4696	3752	RegAsm.exe	91
PID 3752 wrote to memory of 4696	3752	RegAsm.exe	91
PID 3384 wrote to memory of 2740	3384	cmd.exe	99
PID 3384 wrote to memory of 2740	3384	cmd.exe	99
PID 3704 wrote to memory of 2964	3704	cmd.exe	135
PID 3704 wrote to memory of 2964	3704	cmd.exe	135
PID 2008 wrote to memory of 1824	2008	updater.exe	139
PID 2008 wrote to memory of 1824	2008	updater.exe	139
PID 2008 wrote to memory of 1824	2008	updater.exe	139
PID 2008 wrote to memory of 1824	2008	updater.exe	139
PID 2008 wrote to memory of 1824	2008	updater.exe	139

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5FB5.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe
"C:\Users\Admin\AppData\Local\Temp\3db942a351d54b698e9836bb4a6fd9ddd0ae96e90033549f9f12517a25bf3ede.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1484

C:\Users\Admin\AppData\Local\Temp\D6B9.exe
C:\Users\Admin\AppData\Local\Temp\D6B9.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4908

C:\Users\Admin\AppData\Local\Temp\9DF.exe
C:\Users\Admin\AppData\Local\Temp\9DF.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Local\Temp\filename.exe
    "C:\Users\Admin\AppData\Local\Temp\filename.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Drops file in Drivers directory
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2996
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2740
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:5068
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:1608
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:4664
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:4468
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:4968
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:2272
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4924
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1444
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
      4⤵
      Launches sc.exe
      PID:4120
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:1372
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4068
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:1808
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
      4⤵
      Launches sc.exe
      PID:860

C:\Users\Admin\AppData\Local\Temp\3A47.exe
C:\Users\Admin\AppData\Local\Temp\3A47.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\42F3.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:2192

C:\Users\Admin\AppData\Local\Temp\4B9E.exe
C:\Users\Admin\AppData\Local\Temp\4B9E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
    3⤵
    - Executes dropped EXE
    PID:4696

C:\Users\Admin\AppData\Local\Temp\5AF1.exe
C:\Users\Admin\AppData\Local\Temp\5AF1.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
PID:1240

C:\Users\Admin\AppData\Local\Temp\5FB5.exe
C:\Users\Admin\AppData\Local\Temp\5FB5.exe
1⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5FB5.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\SYSWOW64\calc.exe
  "C:\Windows\SYSWOW64\calc.exe"
  2⤵
  PID:4024

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000030041\do.ps1"
  2⤵
  PID:2992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
    3⤵
    PID:5972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc701c9758,0x7ffc701c9768,0x7ffc701c9778
      4⤵
      PID:5996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:8
      4⤵
      PID:5780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:8
      4⤵
      PID:5908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:2
      4⤵
      PID:5056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:1
      4⤵
      PID:212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4160 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:8
      4⤵
      PID:5616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4768 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:1
      4⤵
      PID:2724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:8
      4⤵
      PID:4736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4664 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:8
      4⤵
      PID:596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4908 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:1
      4⤵
      PID:6252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:8
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:8
      4⤵
      PID:6740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5312 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:1
      4⤵
      PID:2928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4436 --field-trial-handle=1748,i,17235752897094488992,8822294609459933229,131072 /prefetch:2
      4⤵
      PID:3644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
    3⤵
    PID:4088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
      4⤵
      PID:4808
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.0.310626716\1662782376" -parentBuildID 20221007134813 -prefsHandle 1636 -prefMapHandle 1624 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {029ba0c0-b2e8-4d22-9ad3-e0d741877c42} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 1732 2126dcd9558 gpu
        5⤵
        
        PID:7072
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.1.1737688303\1947774088" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84ef9336-5b15-4be4-9269-0f7d52630ddb} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 2132 2126d43af58 socket
        5⤵
        
        PID:4248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.2.1403513384\1459569783" -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 3064 -prefsLen 21911 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67b1aef4-cf7b-4fcd-a3c7-073d98110afb} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 3144 212716d8958 tab
        5⤵
        
        PID:6476
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.3.1189006401\270710798" -childID 2 -isForBrowser -prefsHandle 3332 -prefMapHandle 3420 -prefsLen 26374 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a57344fd-593e-4b6b-a48f-2395c813c098} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 1504 2126315e858 tab
        5⤵
        
        PID:6208
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.4.423423274\730443348" -childID 3 -isForBrowser -prefsHandle 4064 -prefMapHandle 4060 -prefsLen 26542 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a143e9f6-fcdc-4aad-a4ed-d9814578b4c8} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 3820 212739d5a58 tab
        5⤵
        
        PID:2140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.5.1225504772\1033406259" -childID 4 -isForBrowser -prefsHandle 4904 -prefMapHandle 4860 -prefsLen 27321 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b50c9ddd-330b-465c-ac27-642b8374f295} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 4856 2127410fe58 tab
        5⤵
        
        PID:7472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.6.392957726\351716002" -childID 5 -isForBrowser -prefsHandle 4940 -prefMapHandle 5044 -prefsLen 27321 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9005a986-d424-48fa-8cba-164422ef07a3} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 5180 212741ade58 tab
        5⤵
        
        PID:7648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4808.7.964749577\1766945339" -childID 6 -isForBrowser -prefsHandle 5240 -prefMapHandle 5228 -prefsLen 27321 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf628628-0a4e-416c-a930-f14503ec4c79} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" 5212 212706f8258 tab
        5⤵
        
        PID:7692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.linkedin.com/login
    3⤵
    PID:3924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc701c9758,0x7ffc701c9768,0x7ffc701c9778
      4⤵
      PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login
    3⤵
    PID:6780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login
      4⤵
      PID:7004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
    3⤵
    PID:6404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc701c9758,0x7ffc701c9768,0x7ffc701c9778
      4⤵
      PID:7140
- C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe
  "C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe"
  2⤵
  PID:1304
- C:\Users\Admin\AppData\Local\Temp\1000306001\dota.exe
  "C:\Users\Admin\AppData\Local\Temp\1000306001\dota.exe"
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\1000334001\ladas.exe
  "C:\Users\Admin\AppData\Local\Temp\1000334001\ladas.exe"
  2⤵
  PID:1472
- C:\Users\Admin\AppData\Local\Temp\1000342001\rdp1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000342001\rdp1234.exe"
  2⤵
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\1000345001\new.exe
  "C:\Users\Admin\AppData\Local\Temp\1000345001\new.exe"
  2⤵
  PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\1000348001\987123.exe
  "C:\Users\Admin\AppData\Local\Temp\1000348001\987123.exe"
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 328
    3⤵
    - Program crash
    PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\1000351001\redline1234min.exe
  "C:\Users\Admin\AppData\Local\Temp\1000351001\redline1234min.exe"
  2⤵
  PID:2624
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "FLWCUERA"
    3⤵
    - Launches sc.exe
    PID:5236
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000351001\redline1234min.exe"
    3⤵
    PID:5860
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3872
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "FLWCUERA"
    3⤵
    - Launches sc.exe
    PID:5852
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5844
- C:\Users\Admin\AppData\Local\Temp\1000352001\lolololoMRK123.exe
  "C:\Users\Admin\AppData\Local\Temp\1000352001\lolololoMRK123.exe"
  2⤵
  PID:5288
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5704
- C:\Users\Admin\AppData\Local\Temp\1000353001\dayroc.exe
  "C:\Users\Admin\AppData\Local\Temp\1000353001\dayroc.exe"
  2⤵
  PID:5648
- - C:\Users\Admin\AppData\Local\Temp\nine.exe
    "C:\Users\Admin\AppData\Local\Temp\nine.exe"
    3⤵
    PID:2220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 488
      4⤵
      Program crash
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    PID:5444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 384
      4⤵
      Program crash
      PID:2740
- - C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
    3⤵
    PID:1664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 480
      4⤵
      Program crash
      PID:5356
- C:\Users\Admin\AppData\Local\Temp\1000354001\for.exe
  "C:\Users\Admin\AppData\Local\Temp\1000354001\for.exe"
  2⤵
  PID:6096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:348
  - - C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"
      4⤵
      PID:5144
- C:\Users\Admin\AppData\Local\Temp\1000356001\Amadey.exe
  "C:\Users\Admin\AppData\Local\Temp\1000356001\Amadey.exe"
  2⤵
  PID:5760
- C:\Users\Admin\AppData\Local\Temp\1000358001\National.exe
  "C:\Users\Admin\AppData\Local\Temp\1000358001\National.exe"
  2⤵
  PID:3692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:5756
- C:\Users\Admin\AppData\Local\Temp\1000359001\lumma123142124.exe
  "C:\Users\Admin\AppData\Local\Temp\1000359001\lumma123142124.exe"
  2⤵
  PID:5380
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5464
- C:\Users\Admin\AppData\Local\Temp\1000360001\daisy123.exe
  "C:\Users\Admin\AppData\Local\Temp\1000360001\daisy123.exe"
  2⤵
  PID:5740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1012
- C:\Users\Admin\AppData\Local\Temp\1000362001\phonesteal.exe
  "C:\Users\Admin\AppData\Local\Temp\1000362001\phonesteal.exe"
  2⤵
  PID:212
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "THYAWYFT"
    3⤵
    - Launches sc.exe
    PID:5556
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "THYAWYFT" binpath= "C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1364
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "THYAWYFT"
    3⤵
    - Launches sc.exe
    PID:4976
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2560
- C:\Users\Admin\AppData\Local\Temp\1000363001\goldprime12342121.exe
  "C:\Users\Admin\AppData\Local\Temp\1000363001\goldprime12342121.exe"
  2⤵
  PID:5392
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5364
- C:\Users\Admin\AppData\Local\Temp\1000364001\InstallSetup3.exe
  "C:\Users\Admin\AppData\Local\Temp\1000364001\InstallSetup3.exe"
  2⤵
  PID:672
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    PID:1352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      PID:4956
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4948
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:5932
- - C:\Users\Admin\AppData\Local\Temp\nsi8754.tmp
    C:\Users\Admin\AppData\Local\Temp\nsi8754.tmp
    3⤵
    PID:6812

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2852
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2964
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2840
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4960
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1824
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:4460
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:2752
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2272
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:2872
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:4076
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3784
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2932

C:\Users\Admin\AppData\Roaming\fjcbhru
C:\Users\Admin\AppData\Roaming\fjcbhru
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 500
  2⤵
  - Program crash
  PID:4732

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3384

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:1992

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
1⤵
PID:4572
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\694788800273_Desktop.zip' -CompressionLevel Optimal
  2⤵
  PID:1484

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
PID:5208
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5400
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  PID:5640

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:6092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5880

C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe
C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe
1⤵
PID:5224
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:5268

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:5332

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
PID:6352
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  PID:5316
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    PID:7084
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:7088
- C:\Users\Admin\AppData\Local\Temp\1000019001\goldman1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000019001\goldman1234.exe"
  2⤵
  PID:5272
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5616
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  PID:2200

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:6856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion