agenttesla | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe RVHOST.exe"	Wattyl.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wefhrf.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4704	powershell.exe
7072	powershell.exe
7064	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Wattyl.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	wefhrf.exe

Executes dropped EXE 8 IoCs

pid	Process
5016	svcyr.exe
1408	iaacws.exe
1828	Wattyl.exe
2496	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
5108	svcyr.exe
2892	cp.exe
4100	wefhrf.exe
1924	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\RVHOST.exe"	Wattyl.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wefhrf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wefhrf.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\n:	Wattyl.exe
File opened (read-only)	\??\v:	Wattyl.exe
File opened (read-only)	\??\w:	Wattyl.exe
File opened (read-only)	\??\y:	Wattyl.exe
File opened (read-only)	\??\z:	Wattyl.exe
File opened (read-only)	\??\b:	Wattyl.exe
File opened (read-only)	\??\g:	Wattyl.exe
File opened (read-only)	\??\i:	Wattyl.exe
File opened (read-only)	\??\p:	Wattyl.exe
File opened (read-only)	\??\r:	Wattyl.exe
File opened (read-only)	\??\t:	Wattyl.exe
File opened (read-only)	\??\x:	Wattyl.exe
File opened (read-only)	\??\a:	Wattyl.exe
File opened (read-only)	\??\h:	Wattyl.exe
File opened (read-only)	\??\q:	Wattyl.exe
File opened (read-only)	\??\e:	Wattyl.exe
File opened (read-only)	\??\m:	Wattyl.exe
File opened (read-only)	\??\l:	Wattyl.exe
File opened (read-only)	\??\o:	Wattyl.exe
File opened (read-only)	\??\s:	Wattyl.exe
File opened (read-only)	\??\u:	Wattyl.exe
File opened (read-only)	\??\j:	Wattyl.exe
File opened (read-only)	\??\k:	Wattyl.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
150	bitbucket.org
151	bitbucket.org
119	raw.githubusercontent.com
120	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000023476-1286.dat	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RVHOST.exe	Wattyl.exe
File opened for modification	C:\Windows\SysWOW64\RVHOST.exe	Wattyl.exe
File created	C:\Windows\SysWOW64\setting.ini	Wattyl.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	Wattyl.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\iaacws.exe	svcyr.exe
File opened for modification	C:\Windows\iaacws.exe	svcyr.exe
File created	C:\Windows\RVHOST.exe	Wattyl.exe
File opened for modification	C:\Windows\RVHOST.exe	Wattyl.exe
File created	C:\Windows\Tasks\MSI.CentralServer.job	cp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000023486-4051.dat	nsis_installer_1
behavioral1/files/0x0007000000023486-4051.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iaacws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iaacws.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
6556	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 6 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\LanguageConfiguration	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key deleted	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\LanguageConfiguration	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1828	Wattyl.exe
1828	Wattyl.exe
5044	chrome.exe
5044	chrome.exe
4100	wefhrf.exe
4100	wefhrf.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
5044	chrome.exe
5044	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	4363463463464363463463463.exe
Token: SeDebugPrivilege	2496	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Token: SeBackupPrivilege	2496	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Token: SeRestorePrivilege	2496	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 5016	2372	4363463463464363463463463.exe	84
PID 2372 wrote to memory of 5016	2372	4363463463464363463463463.exe	84
PID 2372 wrote to memory of 5016	2372	4363463463464363463463463.exe	84
PID 2372 wrote to memory of 1828	2372	4363463463464363463463463.exe	87
PID 2372 wrote to memory of 1828	2372	4363463463464363463463463.exe	87
PID 2372 wrote to memory of 1828	2372	4363463463464363463463463.exe	87
PID 1828 wrote to memory of 3688	1828	Wattyl.exe	88
PID 1828 wrote to memory of 3688	1828	Wattyl.exe	88
PID 1828 wrote to memory of 3688	1828	Wattyl.exe	88
PID 3688 wrote to memory of 4684	3688	cmd.exe	90
PID 3688 wrote to memory of 4684	3688	cmd.exe	90
PID 3688 wrote to memory of 4684	3688	cmd.exe	90
PID 1828 wrote to memory of 2628	1828	Wattyl.exe	91
PID 1828 wrote to memory of 2628	1828	Wattyl.exe	91
PID 1828 wrote to memory of 2628	1828	Wattyl.exe	91
PID 2628 wrote to memory of 3720	2628	cmd.exe	93
PID 2628 wrote to memory of 3720	2628	cmd.exe	93
PID 2628 wrote to memory of 3720	2628	cmd.exe	93
PID 2372 wrote to memory of 2496	2372	4363463463464363463463463.exe	94
PID 2372 wrote to memory of 2496	2372	4363463463464363463463463.exe	94
PID 2372 wrote to memory of 2496	2372	4363463463464363463463463.exe	94
PID 5044 wrote to memory of 3876	5044	chrome.exe	97
PID 5044 wrote to memory of 3876	5044	chrome.exe	97
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 2020	5044	chrome.exe	98
PID 5044 wrote to memory of 3308	5044	chrome.exe	99
PID 5044 wrote to memory of 3308	5044	chrome.exe	99
PID 5044 wrote to memory of 2380	5044	chrome.exe	100
PID 5044 wrote to memory of 2380	5044	chrome.exe	100
PID 5044 wrote to memory of 2380	5044	chrome.exe	100
PID 5044 wrote to memory of 2380	5044	chrome.exe	100
PID 5044 wrote to memory of 2380	5044	chrome.exe	100
PID 5044 wrote to memory of 2380	5044	chrome.exe	100
PID 5044 wrote to memory of 2380	5044	chrome.exe	100
PID 5044 wrote to memory of 2380	5044	chrome.exe	100

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wefhrf.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      PID:4684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
      4⤵
      PID:3720
- C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe"
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:4100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe'; Add-MpPreference -ExclusionProcess 'wefhrf'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4704
- C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies Control Panel
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
  2⤵
  PID:3852
- C:\Users\Admin\AppData\Local\Temp\Files\sunset1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\sunset1.exe"
  2⤵
  PID:208
- C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe"
  2⤵
  PID:384
- - C:\Users\Admin\AppData\Local\Temp\648b5vt13485v134322685vt.exe
    "C:\Users\Admin\AppData\Local\Temp\648b5vt13485v134322685vt.exe"
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Files\fud_new.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\fud_new.exe"
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\Files\EPQ.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\EPQ.exe"
  2⤵
  PID:4784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\EPQ.exe"
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Files\EPQ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\EPQ.exe"
    3⤵
    PID:1940
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\EPQ.exe"
      4⤵
      PID:4092
- C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe"
  2⤵
  PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp24B5.tmp.bat""
    3⤵
    PID:5984
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:6556
- C:\Users\Admin\AppData\Local\Temp\Files\native.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
  2⤵
  PID:5404
- C:\Users\Admin\AppData\Local\Temp\Files\inst77player_1.0.0.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\inst77player_1.0.0.1.exe"
  2⤵
  PID:6568
- C:\Users\Admin\AppData\Local\Temp\Files\Uni400uni.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Uni400uni.exe"
  2⤵
  PID:5832
- C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"
  2⤵
  PID:2936

C:\Windows\iaacws.exe
C:\Windows\iaacws.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffe8f9fab58,0x7ffe8f9fab68,0x7ffe8f9fab78
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3612 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4400 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5108 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4972 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3168 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3472 --field-trial-handle=1952,i,12052126561379815075,10718527908940524092,131072 /prefetch:2
  2⤵
  PID:5868

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2216 -ip 2216
1⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2216 -ip 2216
1⤵
PID:6484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2216 -ip 2216
1⤵
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2216 -ip 2216
1⤵
PID:6428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery