asyncrat | 82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mQxBvlTA.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mQxBvlTA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mQxBvlTA.exe

Executes dropped EXE 59 IoCs

pid	Process
3656	mQxBvlTA.exe
952	xIPJVPDq.exe
4132	zMsQmlSM.exe
352	crypted6077866846MVYQY.exe
4156	i1gcbW1E.exe
784	disable-defender.exe
3860	pclient.exe
2228	responsibilitylead.exe
5092	MStore.exe
2992	Props.exe
2808	wininit.exe
5020	1234.exe
2304	ISetup8.exe
4232	test2.exe
4736	1111.exe
1136	ISetup2.exe
4704	svchost.exe
2240	Tester.exe
784	u1s0.0.exe
3372	555.exe
4212	uvk.0.exe
2904	Document.exe
2008	uvk.1.exe
3720	medcallaboratory5.exe
816	securitycheck.exe
4440	PrintSpoofer.exe
3344	Adobe_update.exe
4556	Retailer_prog.exe
1120	BroomSetup.exe
4284	alexxxxxxxx.exe
3492	syncUpd.exe
4504	Ledger-Live.exe
864	new1.exe
4092	swiiii.exe
5316	razdva.exe
5428	ISetup5.exe
5744	propro.exe
5768	Traffic.exe
1216	mstsc.exe
1572	DAAECAFHDB.exe
5684	crypted_097f1784.exe
5816	Document.exe
5644	Document.exe
5896	Document.exe
5928	Document.exe
6004	Jufrxnb.exe
6132	june.exe
5468	june.tmp
5632	u46s.0.exe
5960	crypted_33cb9091.exe
5764	Jufrxnb.exe
5256	sunvox.exe
4088	u46s.1.exe
5668	sunvox.exe
6084	Jufrxnb.exe
4704	msdtc.exe
1328	msdtc.exe
5572	msdtc.exe
3060	svchost.exe

Loads dropped DLL 7 IoCs

pid	Process
4212	uvk.0.exe
4212	uvk.0.exe
5316	razdva.exe
5316	razdva.exe
5468	june.tmp
5584	RegAsm.exe
5584	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000800000001abe7-6.dat	themida
behavioral2/memory/3656-49-0x0000000000BC0000-0x0000000001CDC000-memory.dmp	themida
behavioral2/memory/3656-51-0x0000000000BC0000-0x0000000001CDC000-memory.dmp	themida

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	pclient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mQxBvlTA.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	Jufrxnb.exe
File opened (read-only)	\??\K:	Jufrxnb.exe
File opened (read-only)	\??\L:	Jufrxnb.exe
File opened (read-only)	\??\M:	Jufrxnb.exe
File opened (read-only)	\??\N:	Jufrxnb.exe
File opened (read-only)	\??\Q:	Jufrxnb.exe
File opened (read-only)	\??\W:	Jufrxnb.exe
File opened (read-only)	\??\Y:	Jufrxnb.exe
File opened (read-only)	\??\Z:	Jufrxnb.exe
File opened (read-only)	\??\B:	Jufrxnb.exe
File opened (read-only)	\??\E:	Jufrxnb.exe
File opened (read-only)	\??\H:	Jufrxnb.exe
File opened (read-only)	\??\P:	Jufrxnb.exe
File opened (read-only)	\??\R:	Jufrxnb.exe
File opened (read-only)	\??\S:	Jufrxnb.exe
File opened (read-only)	\??\F:	Jufrxnb.exe
File opened (read-only)	\??\I:	Jufrxnb.exe
File opened (read-only)	\??\J:	Jufrxnb.exe
File opened (read-only)	\??\V:	Jufrxnb.exe
File opened (read-only)	\??\D:	Jufrxnb.exe
File opened (read-only)	\??\O:	Jufrxnb.exe
File opened (read-only)	\??\T:	Jufrxnb.exe
File opened (read-only)	\??\U:	Jufrxnb.exe
File opened (read-only)	\??\X:	Jufrxnb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
22	pastebin.com
23	pastebin.com
9	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
93	ip-api.com
1205	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000001abf5-104.dat	autoit_exe
behavioral2/files/0x000700000001ac0a-383.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3656	mQxBvlTA.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 400	3720	medcallaboratory5.exe	108
PID 3344 set thread context of 3572	3344	Adobe_update.exe	115
PID 4284 set thread context of 5180	4284	alexxxxxxxx.exe	129
PID 4092 set thread context of 5584	4092	swiiii.exe	138
PID 2904 set thread context of 5928	2904	Document.exe	159
PID 5684 set thread context of 5368	5684	crypted_097f1784.exe	170
PID 5960 set thread context of 1876	5960	crypted_33cb9091.exe	176
PID 4704 set thread context of 5572	4704	msdtc.exe	195

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe	mstsc.exe
File created	C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe	mstsc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	Tester.exe
File opened for modification	C:\Windows\svchost.exe	Tester.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
704	3344	WerFault.exe	112
6068	5316	WerFault.exe	132
1216	5684	WerFault.exe	154
2416	5960	WerFault.exe	165

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uvk.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uvk.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u46s.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u46s.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u46s.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uvk.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	uvk.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	uvk.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5104	schtasks.exe
5936	schtasks.exe
5420	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5596	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Jufrxnb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Jufrxnb.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4044	PING.EXE
5196	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
952	xIPJVPDq.exe
952	xIPJVPDq.exe
952	xIPJVPDq.exe
952	xIPJVPDq.exe
4132	zMsQmlSM.exe
4132	zMsQmlSM.exe
4132	zMsQmlSM.exe
4132	zMsQmlSM.exe
352	crypted6077866846MVYQY.exe
784	disable-defender.exe
784	disable-defender.exe
4404	powershell.exe
352	crypted6077866846MVYQY.exe
352	crypted6077866846MVYQY.exe
4404	powershell.exe
4404	powershell.exe
352	crypted6077866846MVYQY.exe
4404	powershell.exe
2240	Tester.exe
2240	Tester.exe
352	crypted6077866846MVYQY.exe
352	crypted6077866846MVYQY.exe
2240	Tester.exe
2240	Tester.exe
2240	Tester.exe
2240	Tester.exe
4212	uvk.0.exe
4212	uvk.0.exe
2240	Tester.exe
2240	Tester.exe
2240	Tester.exe
2240	Tester.exe
2240	Tester.exe
2240	Tester.exe
816	securitycheck.exe
400	RegSvcs.exe
400	RegSvcs.exe
400	RegSvcs.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
4212	uvk.0.exe
4212	uvk.0.exe
2904	Document.exe
4556	Retailer_prog.exe
4556	Retailer_prog.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
5584	RegAsm.exe
5584	RegAsm.exe
2904	Document.exe
5920	powershell.exe
5920	powershell.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe
2904	Document.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3720	medcallaboratory5.exe
3720	medcallaboratory5.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	New Text Document mod.exe
Token: SeDebugPrivilege	952	xIPJVPDq.exe
Token: SeDebugPrivilege	4132	zMsQmlSM.exe
Token: SeDebugPrivilege	352	crypted6077866846MVYQY.exe
Token: SeDebugPrivilege	2228	responsibilitylead.exe
Token: SeDebugPrivilege	784	disable-defender.exe
Token: SeImpersonatePrivilege	784	disable-defender.exe
Token: SeDebugPrivilege	3656	mQxBvlTA.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	4704	svchost.exe
Token: SeDebugPrivilege	2240	Tester.exe
Token: SeIncreaseQuotaPrivilege	4404	powershell.exe
Token: SeSecurityPrivilege	4404	powershell.exe
Token: SeTakeOwnershipPrivilege	4404	powershell.exe
Token: SeLoadDriverPrivilege	4404	powershell.exe
Token: SeSystemProfilePrivilege	4404	powershell.exe
Token: SeSystemtimePrivilege	4404	powershell.exe
Token: SeProfSingleProcessPrivilege	4404	powershell.exe
Token: SeIncBasePriorityPrivilege	4404	powershell.exe
Token: SeCreatePagefilePrivilege	4404	powershell.exe
Token: SeBackupPrivilege	4404	powershell.exe
Token: SeRestorePrivilege	4404	powershell.exe
Token: SeShutdownPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeSystemEnvironmentPrivilege	4404	powershell.exe
Token: SeRemoteShutdownPrivilege	4404	powershell.exe
Token: SeUndockPrivilege	4404	powershell.exe
Token: SeManageVolumePrivilege	4404	powershell.exe
Token: 33	4404	powershell.exe
Token: 34	4404	powershell.exe
Token: 35	4404	powershell.exe
Token: 36	4404	powershell.exe
Token: SeDebugPrivilege	400	RegSvcs.exe
Token: SeDebugPrivilege	2904	Document.exe
Token: SeDebugPrivilege	5768	Traffic.exe
Token: SeDebugPrivilege	1216	mstsc.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	6004	Jufrxnb.exe
Token: SeDebugPrivilege	5764	Jufrxnb.exe
Token: SeDebugPrivilege	5764	Jufrxnb.exe
Token: SeDebugPrivilege	5928	Document.exe
Token: SeBackupPrivilege	5768	Traffic.exe
Token: SeSecurityPrivilege	5768	Traffic.exe
Token: SeSecurityPrivilege	5768	Traffic.exe
Token: SeSecurityPrivilege	5768	Traffic.exe
Token: SeSecurityPrivilege	5768	Traffic.exe
Token: SeDebugPrivilege	6084	Jufrxnb.exe
Token: SeDebugPrivilege	6084	Jufrxnb.exe
Token: SeDebugPrivilege	5700	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	4704	msdtc.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	5572	msdtc.exe
Token: SeBackupPrivilege	5620	vssvc.exe
Token: SeRestorePrivilege	5620	vssvc.exe
Token: SeAuditPrivilege	5620	vssvc.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	5744	propro.exe
Token: SeIncreaseQuotaPrivilege	1364	powershell.exe
Token: SeSecurityPrivilege	1364	powershell.exe
Token: SeTakeOwnershipPrivilege	1364	powershell.exe
Token: SeLoadDriverPrivilege	1364	powershell.exe
Token: SeSystemProfilePrivilege	1364	powershell.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2808	wininit.exe
2808	wininit.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
3720	medcallaboratory5.exe
3720	medcallaboratory5.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
2808	wininit.exe
2808	wininit.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
2008	uvk.1.exe
3720	medcallaboratory5.exe
3720	medcallaboratory5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3656	2660	New Text Document mod.exe	74
PID 2660 wrote to memory of 3656	2660	New Text Document mod.exe	74
PID 2660 wrote to memory of 3656	2660	New Text Document mod.exe	74
PID 2660 wrote to memory of 952	2660	New Text Document mod.exe	75
PID 2660 wrote to memory of 952	2660	New Text Document mod.exe	75
PID 2660 wrote to memory of 952	2660	New Text Document mod.exe	75
PID 952 wrote to memory of 4132	952	xIPJVPDq.exe	76
PID 952 wrote to memory of 4132	952	xIPJVPDq.exe	76
PID 2660 wrote to memory of 352	2660	New Text Document mod.exe	77
PID 2660 wrote to memory of 352	2660	New Text Document mod.exe	77
PID 2660 wrote to memory of 352	2660	New Text Document mod.exe	77
PID 2660 wrote to memory of 4156	2660	New Text Document mod.exe	79
PID 2660 wrote to memory of 4156	2660	New Text Document mod.exe	79
PID 2660 wrote to memory of 784	2660	New Text Document mod.exe	99
PID 2660 wrote to memory of 784	2660	New Text Document mod.exe	99
PID 2660 wrote to memory of 3860	2660	New Text Document mod.exe	82
PID 2660 wrote to memory of 3860	2660	New Text Document mod.exe	82
PID 3860 wrote to memory of 2228	3860	pclient.exe	84
PID 3860 wrote to memory of 2228	3860	pclient.exe	84
PID 2660 wrote to memory of 5092	2660	New Text Document mod.exe	85
PID 2660 wrote to memory of 5092	2660	New Text Document mod.exe	85
PID 2660 wrote to memory of 2992	2660	New Text Document mod.exe	86
PID 2660 wrote to memory of 2992	2660	New Text Document mod.exe	86
PID 5092 wrote to memory of 3008	5092	MStore.exe	88
PID 5092 wrote to memory of 3008	5092	MStore.exe	88
PID 3008 wrote to memory of 4404	3008	cmd.exe	90
PID 3008 wrote to memory of 4404	3008	cmd.exe	90
PID 2660 wrote to memory of 2808	2660	New Text Document mod.exe	91
PID 2660 wrote to memory of 2808	2660	New Text Document mod.exe	91
PID 2660 wrote to memory of 2808	2660	New Text Document mod.exe	91
PID 2660 wrote to memory of 5020	2660	New Text Document mod.exe	92
PID 2660 wrote to memory of 5020	2660	New Text Document mod.exe	92
PID 2660 wrote to memory of 5020	2660	New Text Document mod.exe	92
PID 2660 wrote to memory of 2304	2660	New Text Document mod.exe	107
PID 2660 wrote to memory of 2304	2660	New Text Document mod.exe	107
PID 2660 wrote to memory of 2304	2660	New Text Document mod.exe	107
PID 2660 wrote to memory of 4232	2660	New Text Document mod.exe	94
PID 2660 wrote to memory of 4232	2660	New Text Document mod.exe	94
PID 2660 wrote to memory of 4736	2660	New Text Document mod.exe	95
PID 2660 wrote to memory of 4736	2660	New Text Document mod.exe	95
PID 2660 wrote to memory of 1136	2660	New Text Document mod.exe	96
PID 2660 wrote to memory of 1136	2660	New Text Document mod.exe	96
PID 2660 wrote to memory of 1136	2660	New Text Document mod.exe	96
PID 2660 wrote to memory of 2240	2660	New Text Document mod.exe	97
PID 2660 wrote to memory of 2240	2660	New Text Document mod.exe	97
PID 2660 wrote to memory of 4704	2660	New Text Document mod.exe	186
PID 2660 wrote to memory of 4704	2660	New Text Document mod.exe	186
PID 2304 wrote to memory of 784	2304	ISetup8.exe	99
PID 2304 wrote to memory of 784	2304	ISetup8.exe	99
PID 2304 wrote to memory of 784	2304	ISetup8.exe	99
PID 2660 wrote to memory of 3372	2660	New Text Document mod.exe	101
PID 2660 wrote to memory of 3372	2660	New Text Document mod.exe	101
PID 1136 wrote to memory of 4212	1136	ISetup2.exe	153
PID 1136 wrote to memory of 4212	1136	ISetup2.exe	153
PID 1136 wrote to memory of 4212	1136	ISetup2.exe	153
PID 2660 wrote to memory of 2904	2660	New Text Document mod.exe	103
PID 2660 wrote to memory of 2904	2660	New Text Document mod.exe	103
PID 2660 wrote to memory of 2904	2660	New Text Document mod.exe	103
PID 1136 wrote to memory of 2008	1136	ISetup2.exe	104
PID 1136 wrote to memory of 2008	1136	ISetup2.exe	104
PID 1136 wrote to memory of 2008	1136	ISetup2.exe	104
PID 2660 wrote to memory of 3720	2660	New Text Document mod.exe	105
PID 2660 wrote to memory of 3720	2660	New Text Document mod.exe	105
PID 2660 wrote to memory of 3720	2660	New Text Document mod.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
  "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exe
    "C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:352
- C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
  "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
  "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:784
- C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
  "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionExtension .exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- C:\Users\Admin\AppData\Local\Temp\a\Props.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\a\1234.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe"
    3⤵
    - Executes dropped EXE
    PID:784
- C:\Users\Admin\AppData\Local\Temp\a\test2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Users\Admin\AppData\Local\Temp\uvk.0.exe
    "C:\Users\Admin\AppData\Local\Temp\uvk.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe"
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe"
        5⤵
        Executes dropped EXE
        
        PID:1572
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe
        6⤵
        
        PID:5612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:4044
- - C:\Users\Admin\AppData\Local\Temp\uvk.1.exe
    "C:\Users\Admin\AppData\Local\Temp\uvk.1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5700
- C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    PID:4940
- C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Users\Admin\AppData\Local\Temp\a\555.exe
  "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Users\Admin\AppData\Local\Temp\a\Document.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp297C.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Executes dropped EXE
    PID:5816
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Executes dropped EXE
    PID:5644
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Executes dropped EXE
    PID:5896
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
      4⤵
      PID:4204
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:5420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp65CA.tmp.bat""
      4⤵
      PID:5532
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:5596
    - - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4208
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF22B.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:5104
      - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        Executes dropped EXE
        
        PID:1328
      - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5572
- C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
  "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3344
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Modifies system certificate store
    PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 764
    3⤵
    - Program crash
    PID:704
- C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4284
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5180
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5744
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"
  2⤵
  - Executes dropped EXE
  PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
    3⤵
    PID:5072
  - - C:\Windows\SysWOW64\PING.EXE
      ping 2.2.2.2 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:5196
- C:\Users\Admin\AppData\Local\Temp\a\new1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\new1.exe"
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5540
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5584
- C:\Users\Admin\AppData\Local\Temp\a\razdva.exe
  "C:\Users\Admin\AppData\Local\Temp\a\razdva.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 764
    3⤵
    - Program crash
    PID:6068
- C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"
  2⤵
  - Executes dropped EXE
  PID:5428
- - C:\Users\Admin\AppData\Local\Temp\u46s.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u46s.0.exe"
    3⤵
    - Executes dropped EXE
    PID:5632
- - C:\Users\Admin\AppData\Local\Temp\u46s.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u46s.1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4088
- C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- - C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
    "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 764
    3⤵
    - Program crash
    PID:1216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5368
- C:\Users\Admin\AppData\Local\Temp\a\june.exe
  "C:\Users\Admin\AppData\Local\Temp\a\june.exe"
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Users\Admin\AppData\Local\Temp\is-PVKLK.tmp\june.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-PVKLK.tmp\june.tmp" /SL5="$302D6,3525916,54272,C:\Users\Admin\AppData\Local\Temp\a\june.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5468
  - - C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe
      "C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe" -i
      4⤵
      Executes dropped EXE
      PID:5256
  - - C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe
      "C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe" -s
      4⤵
      Executes dropped EXE
      PID:5668
- C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 764
    3⤵
    - Program crash
    PID:2416

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:2304

C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5764
- C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
  "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:6084

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5620

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery