amadey | ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce

Processes:

Uni400uni.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe = "0"	Uni400uni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	Uni400uni.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exechrosha.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

131 4008 rundll32.exe
180 5104 rundll32.exe
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
131	4008	rundll32.exe
180	5104	rundll32.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exechrosha.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

chrosha.exeRegAsm.exeNewB.exeUni400uni.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	chrosha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	NewB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	Uni400uni.exe

Executes dropped EXE 12 IoCs

Processes:

chrosha.exeswiiiii.exealexxxxxxxx.exekeks.exetrf.exegold.exeNewB.exeUni400uni.execap.exejok.exeswiiii.exe7wuGEJczI8PROwjcX9IOiM8F.exe

pid	process
3520	chrosha.exe
5020	swiiiii.exe
100	alexxxxxxxx.exe
3600	keks.exe
4420	trf.exe
724	gold.exe
4404	NewB.exe
2712	Uni400uni.exe
2008	cap.exe
3968	jok.exe
5596	swiiii.exe
6084	7wuGEJczI8PROwjcX9IOiM8F.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exechrosha.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine	ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
Key opened	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine	chrosha.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

2056 rundll32.exe
4008 rundll32.exe
5104 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2056	rundll32.exe
4008	rundll32.exe
5104	rundll32.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\wqty4p0TLsiIT9djxk8DmWKM.exe	themida
C:\Users\Admin\Pictures\Xsx2enmMx6SkVYfNR0W59wNb.exe	themida

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

Uni400uni.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe = "0"	Uni400uni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	Uni400uni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	Uni400uni.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

Uni400uni.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Uni400uni.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Uni400uni.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

186 pastebin.com
188 pastebin.com
247 pastebin.com
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

350 ipinfo.io
298 api.myip.com
299 api.myip.com
301 ipinfo.io
302 ipinfo.io
346 api.myip.com
348 api.myip.com
349 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exechrosha.exe

pid process

1600 ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
3520 chrosha.exe

flow	ioc
186	pastebin.com
188	pastebin.com
247	pastebin.com

flow	ioc
350	ipinfo.io
298	api.myip.com
299	api.myip.com
301	ipinfo.io
302	ipinfo.io
346	api.myip.com
348	api.myip.com
349	ipinfo.io

Suspicious use of SetThreadContext 4 IoCs

Processes:

swiiiii.exealexxxxxxxx.exegold.exeUni400uni.exe

description	pid	process	target process
PID 5020 set thread context of 3624	5020	swiiiii.exe	RegAsm.exe
PID 100 set thread context of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 724 set thread context of 1136	724	gold.exe	RegAsm.exe
PID 2712 set thread context of 2296	2712	Uni400uni.exe	regsvcs.exe

Drops file in Windows directory 1 IoCs

Processes:

ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe

description ioc process

File created C:\Windows\Tasks\chrosha.job ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

3052 sc.exe
5800 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\chrosha.job	ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe

pid	process
3052	sc.exe
5800	sc.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1016	5020	WerFault.exe	swiiiii.exe
3320	100	WerFault.exe	alexxxxxxxx.exe
1448	724	WerFault.exe	gold.exe
836	6492	WerFault.exe	u4p0.0.exe
4452	2444	WerFault.exe	u5go.0.exe
5608	7080	WerFault.exe	jCdOHVmxOeSFD9RxGzWQ08sD.exe
1640	6084	WerFault.exe	7wuGEJczI8PROwjcX9IOiM8F.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2356 schtasks.exe
6932 schtasks.exe

pid	process
2356	schtasks.exe
6932	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

keks.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	keks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	keks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exechrosha.exerundll32.exepowershell.exetrf.execap.exepowershell.exechrome.exemsedge.exemsedge.exe

pid	process
1600	ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
1600	ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
3520	chrosha.exe
3520	chrosha.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
4008	rundll32.exe
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe
4420	trf.exe
4420	trf.exe
2008	cap.exe
2008	cap.exe
2008	cap.exe
2008	cap.exe
4724	powershell.exe
4724	powershell.exe
2008	cap.exe
2008	cap.exe
2008	cap.exe
3620	chrome.exe
3620	chrome.exe
4724	powershell.exe
4724	powershell.exe
6044	msedge.exe
6044	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exemsedge.exe

pid process

3620 chrome.exe
3620 chrome.exe
3620 chrome.exe
1324 msedge.exe
1324 msedge.exe
1324 msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exetrf.exeregsvcs.execap.exepowershell.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	4420	trf.exe
Token: SeBackupPrivilege	4420	trf.exe
Token: SeSecurityPrivilege	4420	trf.exe
Token: SeSecurityPrivilege	4420	trf.exe
Token: SeSecurityPrivilege	4420	trf.exe
Token: SeSecurityPrivilege	4420	trf.exe
Token: SeDebugPrivilege	2296	regsvcs.exe
Token: SeDebugPrivilege	2008	cap.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

chrome.exemsedge.exe

pid	process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exemsedge.exe

pid	process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrosha.exeswiiiii.exerundll32.exerundll32.exealexxxxxxxx.exeRegAsm.exegold.exeNewB.exe

description	pid	process	target process
PID 3520 wrote to memory of 5020	3520	chrosha.exe	swiiiii.exe
PID 3520 wrote to memory of 5020	3520	chrosha.exe	swiiiii.exe
PID 3520 wrote to memory of 5020	3520	chrosha.exe	swiiiii.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 5020 wrote to memory of 3624	5020	swiiiii.exe	RegAsm.exe
PID 3520 wrote to memory of 2056	3520	chrosha.exe	rundll32.exe
PID 3520 wrote to memory of 2056	3520	chrosha.exe	rundll32.exe
PID 3520 wrote to memory of 2056	3520	chrosha.exe	rundll32.exe
PID 2056 wrote to memory of 4008	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 4008	2056	rundll32.exe	rundll32.exe
PID 4008 wrote to memory of 908	4008	rundll32.exe	netsh.exe
PID 4008 wrote to memory of 908	4008	rundll32.exe	netsh.exe
PID 4008 wrote to memory of 5104	4008	rundll32.exe	powershell.exe
PID 4008 wrote to memory of 5104	4008	rundll32.exe	powershell.exe
PID 3520 wrote to memory of 100	3520	chrosha.exe	alexxxxxxxx.exe
PID 3520 wrote to memory of 100	3520	chrosha.exe	alexxxxxxxx.exe
PID 3520 wrote to memory of 100	3520	chrosha.exe	alexxxxxxxx.exe
PID 100 wrote to memory of 408	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 408	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 408	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 100 wrote to memory of 960	100	alexxxxxxxx.exe	RegAsm.exe
PID 960 wrote to memory of 3600	960	RegAsm.exe	keks.exe
PID 960 wrote to memory of 3600	960	RegAsm.exe	keks.exe
PID 960 wrote to memory of 3600	960	RegAsm.exe	keks.exe
PID 960 wrote to memory of 4420	960	RegAsm.exe	trf.exe
PID 960 wrote to memory of 4420	960	RegAsm.exe	trf.exe
PID 3520 wrote to memory of 724	3520	chrosha.exe	gold.exe
PID 3520 wrote to memory of 724	3520	chrosha.exe	gold.exe
PID 3520 wrote to memory of 724	3520	chrosha.exe	gold.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 724 wrote to memory of 1136	724	gold.exe	RegAsm.exe
PID 3520 wrote to memory of 4404	3520	chrosha.exe	NewB.exe
PID 3520 wrote to memory of 4404	3520	chrosha.exe	NewB.exe
PID 3520 wrote to memory of 4404	3520	chrosha.exe	NewB.exe
PID 4404 wrote to memory of 2356	4404	NewB.exe	schtasks.exe
PID 4404 wrote to memory of 2356	4404	NewB.exe	schtasks.exe
PID 4404 wrote to memory of 2356	4404	NewB.exe	schtasks.exe
PID 4404 wrote to memory of 2712	4404	NewB.exe	Uni400uni.exe
PID 4404 wrote to memory of 2712	4404	NewB.exe	Uni400uni.exe
PID 3520 wrote to memory of 5104	3520	chrosha.exe	rundll32.exe
PID 3520 wrote to memory of 5104	3520	chrosha.exe	rundll32.exe
PID 3520 wrote to memory of 5104	3520	chrosha.exe	rundll32.exe
PID 4404 wrote to memory of 2008	4404	NewB.exe	cap.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

Uni400uni.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Uni400uni.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Uni400uni.exe

C:\Users\Admin\AppData\Local\Temp\ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe
"C:\Users\Admin\AppData\Local\Temp\ab4523abcb1ed941a8f9b3a0e8665c8d6c3c3e1df66a5bb2bfaa0c43bc5d15ce.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1600

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 800
    3⤵
    - Program crash
    PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084619521222_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5104
- C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:3600
  - - C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4420
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:5836
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 352
    3⤵
    - Program crash
    PID:3320
- C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 356
    3⤵
    - Program crash
    PID:1448
- C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe
    "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - System policy modification
    PID:2712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4724
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:928
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2296
    - - C:\Users\Admin\Pictures\7wuGEJczI8PROwjcX9IOiM8F.exe
        
        "C:\Users\Admin\Pictures\7wuGEJczI8PROwjcX9IOiM8F.exe"
        5⤵
        Executes dropped EXE
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\u4p0.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4p0.0.exe"
        6⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 1020
        7⤵
        Program crash
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\u4p0.2\run.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4p0.2\run.exe"
        6⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        7⤵
        
        PID:5520
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5820
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\u4p0.3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4p0.3.exe"
        6⤵
        
        PID:6420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 1544
        6⤵
        Program crash
        
        PID:1640
    - - C:\Users\Admin\Pictures\ymrr2awxIWyKaF4yuqvF6kJB.exe
        
        "C:\Users\Admin\Pictures\ymrr2awxIWyKaF4yuqvF6kJB.exe"
        5⤵
        
        PID:6388
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:6884
      - C:\Users\Admin\Pictures\ymrr2awxIWyKaF4yuqvF6kJB.exe
        
        "C:\Users\Admin\Pictures\ymrr2awxIWyKaF4yuqvF6kJB.exe"
        6⤵
        
        PID:6852
    - - C:\Users\Admin\Pictures\DuHaGWCWszdp8qWBK4xXnZap.exe
        
        "C:\Users\Admin\Pictures\DuHaGWCWszdp8qWBK4xXnZap.exe"
        5⤵
        
        PID:6604
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:4652
      - C:\Users\Admin\Pictures\DuHaGWCWszdp8qWBK4xXnZap.exe
        
        "C:\Users\Admin\Pictures\DuHaGWCWszdp8qWBK4xXnZap.exe"
        6⤵
        
        PID:6628
    - - C:\Users\Admin\Pictures\wqty4p0TLsiIT9djxk8DmWKM.exe
        
        "C:\Users\Admin\Pictures\wqty4p0TLsiIT9djxk8DmWKM.exe"
        5⤵
        
        PID:3344
    - - C:\Users\Admin\Pictures\0Ubkx6TgbJE3KY3i5zpFvo6d.exe
        
        "C:\Users\Admin\Pictures\0Ubkx6TgbJE3KY3i5zpFvo6d.exe"
        5⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\7zSF894.tmp\Install.exe
        
        .\Install.exe /RvdidblCuX "385118" /S
        6⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 19:54:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\kKNTNCB.exe\" em /nhsite_idbwH 385118 /S" /V1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:6932
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      4⤵
      PID:4844
- - C:\Users\Admin\AppData\Local\Temp\1000227001\cap.exe
    "C:\Users\Admin\AppData\Local\Temp\1000227001\cap.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Admin\AppData\Local\Temp\Extension"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3620
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa827fab58,0x7ffa827fab68,0x7ffa827fab78
        5⤵
        
        PID:908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=2044,i,2706588155704615504,3124682816198816532,131072 /prefetch:2
        5⤵
        
        PID:5252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2044,i,2706588155704615504,3124682816198816532,131072 /prefetch:8
        5⤵
        
        PID:5260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1948 --field-trial-handle=2044,i,2706588155704615504,3124682816198816532,131072 /prefetch:8
        5⤵
        
        PID:5268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=2044,i,2706588155704615504,3124682816198816532,131072 /prefetch:1
        5⤵
        
        PID:5484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=2044,i,2706588155704615504,3124682816198816532,131072 /prefetch:1
        5⤵
        
        PID:5492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4164 --field-trial-handle=2044,i,2706588155704615504,3124682816198816532,131072 /prefetch:1
        5⤵
        
        PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\Admin\AppData\Local\Temp\Extension"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa7f8246f8,0x7ffa7f824708,0x7ffa7f824718
        5⤵
        
        PID:404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        5⤵
        
        PID:6036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
        5⤵
        
        PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:6140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
        5⤵
        
        PID:6184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
        5⤵
        
        PID:6680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
        5⤵
        
        PID:6688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
        5⤵
        
        PID:100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
        5⤵
        
        PID:220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
        5⤵
        
        PID:6900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,194048807118566709,16466286370500173723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
        5⤵
        
        PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
  "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
  2⤵
  - Executes dropped EXE
  PID:5596
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6652
- C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
  2⤵
  PID:6864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
    3⤵
    PID:6172
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    PID:6244
  - - C:\Users\Admin\Pictures\jCdOHVmxOeSFD9RxGzWQ08sD.exe
      "C:\Users\Admin\Pictures\jCdOHVmxOeSFD9RxGzWQ08sD.exe"
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\u5go.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u5go.0.exe"
        5⤵
        
        PID:2444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1016
        6⤵
        Program crash
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\u5go.2\run.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u5go.2\run.exe"
        5⤵
        
        PID:8
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        
        PID:6320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        7⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\u5go.3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u5go.3.exe"
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        6⤵
        
        PID:5888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 1444
        5⤵
        Program crash
        
        PID:5608
  - - C:\Users\Admin\Pictures\erMtpOSc107aaTZJAsgxRQcT.exe
      "C:\Users\Admin\Pictures\erMtpOSc107aaTZJAsgxRQcT.exe"
      4⤵
      PID:1392
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:6372
    - - C:\Users\Admin\Pictures\erMtpOSc107aaTZJAsgxRQcT.exe
        
        "C:\Users\Admin\Pictures\erMtpOSc107aaTZJAsgxRQcT.exe"
        5⤵
        
        PID:1856
  - - C:\Users\Admin\Pictures\h5LEqMbe44jzFQ93hZyKig23.exe
      "C:\Users\Admin\Pictures\h5LEqMbe44jzFQ93hZyKig23.exe"
      4⤵
      PID:3128
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5544
    - - C:\Users\Admin\Pictures\h5LEqMbe44jzFQ93hZyKig23.exe
        
        "C:\Users\Admin\Pictures\h5LEqMbe44jzFQ93hZyKig23.exe"
        5⤵
        
        PID:6644
  - - C:\Users\Admin\Pictures\Xsx2enmMx6SkVYfNR0W59wNb.exe
      "C:\Users\Admin\Pictures\Xsx2enmMx6SkVYfNR0W59wNb.exe"
      4⤵
      PID:5644
- C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
  "C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
    3⤵
    PID:5240
  - - C:\Windows\SysWOW64\sc.exe
      Sc delete GameServerClient
      4⤵
      Launches sc.exe
      PID:3052
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService remove GameServerClient confirm
      4⤵
      PID:8
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
      4⤵
      PID:5632
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService start GameServerClient
      4⤵
      PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
    3⤵
    PID:404
  - - C:\Windows\SysWOW64\sc.exe
      Sc delete GameServerClientC
      4⤵
      Launches sc.exe
      PID:5800
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService remove GameServerClientC confirm
      4⤵
      PID:5308
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
      4⤵
      PID:4392
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService start GameServerClientC
      4⤵
      PID:6900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
    3⤵
    PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 5020
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 100 -ip 100
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 724 -ip 724
1⤵
PID:1992

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6596

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:6544

C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
1⤵
PID:6848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6492 -ip 6492
1⤵
PID:3760

C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
1⤵
PID:6896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2444 -ip 2444
1⤵
PID:6368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7080 -ip 7080
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6084 -ip 6084
1⤵
PID:1848

C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\kKNTNCB.exe
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\kKNTNCB.exe em /nhsite_idbwH 385118 /S
1⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion