3a04bc537fc44fd04657a316c838bf0f47575a69854350ee873446ef3d8fe058

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ieinstal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ieinstal.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KfAdmin54 = "C:\\Users\\Admin\\KfAdmin54\\KfAdmin54\\KfAdmin54.exe"	reg.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	208	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
143	ip-api.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDDD.tmp	msiexec.exe
File created	C:\Windows\Installer\e573364.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e573364.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
5448	KfAdmin54.exe

Loads dropped DLL 4 IoCs

pid	Process
5448	KfAdmin54.exe
5504	ieinstal.exe
208	MsiExec.exe
208	MsiExec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5616	5448	WerFault.exe	125

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ieinstal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ieinstal.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ieinstal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ieinstal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ieinstal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	ieinstal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	ieinstal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000023a7a5176c402a4ebd4fd1240f9da0e0000000000200000000001066000000010000200000004bc64daa9beb20481b74dda680524967b75abf9fc6eb6d6ef9db40f7d3a70423000000000e8000000002000020000000f03a8346df931c897b0bd374c7150e5b2e1187c9724f1dbd3c9152788cf11dd120000000ff4d2a62d1da9bf54a55a30b8255d6c2ce10498b2cdcde7a353b0d7196cd7409400000008e9a071e0510fb48672a5281c01dae8e32165fc449d1b16ae2a2b24ba83a1cdbf33f0136bee48af66d57ed882e96d14a561a0dcc3fd8fa41a447476964b28d24	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000023a7a5176c402a4ebd4fd1240f9da0e000000000020000000000106600000001000020000000137e0abe5eb2784919214f915b4908a73e106fcb3389fd4d1cb68303c1306ad0000000000e800000000200002000000098f05f7eb21e356e037f056bc25f50594e460eeadb89cb3832782bfc00c40ed320000000f328fadb3fc2f6c0d23da2a34c3347cb225473a09d1a86dedfaa4793cb0a4a474000000033374ab5a0e04b065e02abe36ab44e2e466f6863b7b67f796f22048d190159511b4f5b9061fb2cb69fa029529c0a42f244e859f7a5eab3992e0483f2004dec39	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{212169B9-0E3F-11EF-9A94-46C99DBF4093} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4120403433"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cd6ff64ba2da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31105611"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05c76f64ba2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4120923223"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31105611"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4120383279"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31105611"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4120923223"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31105611"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422049952"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597585558035503"	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
5620	reg.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	144	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
5504	ieinstal.exe
1980	chrome.exe
1980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3808	msiexec.exe
Token: SeSecurityPrivilege	4552	msiexec.exe
Token: SeCreateTokenPrivilege	3808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3808	msiexec.exe
Token: SeLockMemoryPrivilege	3808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3808	msiexec.exe
Token: SeMachineAccountPrivilege	3808	msiexec.exe
Token: SeTcbPrivilege	3808	msiexec.exe
Token: SeSecurityPrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeLoadDriverPrivilege	3808	msiexec.exe
Token: SeSystemProfilePrivilege	3808	msiexec.exe
Token: SeSystemtimePrivilege	3808	msiexec.exe
Token: SeProfSingleProcessPrivilege	3808	msiexec.exe
Token: SeIncBasePriorityPrivilege	3808	msiexec.exe
Token: SeCreatePagefilePrivilege	3808	msiexec.exe
Token: SeCreatePermanentPrivilege	3808	msiexec.exe
Token: SeBackupPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeShutdownPrivilege	3808	msiexec.exe
Token: SeDebugPrivilege	3808	msiexec.exe
Token: SeAuditPrivilege	3808	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3808	msiexec.exe
Token: SeChangeNotifyPrivilege	3808	msiexec.exe
Token: SeRemoteShutdownPrivilege	3808	msiexec.exe
Token: SeUndockPrivilege	3808	msiexec.exe
Token: SeSyncAgentPrivilege	3808	msiexec.exe
Token: SeEnableDelegationPrivilege	3808	msiexec.exe
Token: SeManageVolumePrivilege	3808	msiexec.exe
Token: SeImpersonatePrivilege	3808	msiexec.exe
Token: SeCreateGlobalPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
3808	msiexec.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
208	MsiExec.exe
4544	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5448	KfAdmin54.exe
5504	ieinstal.exe
4544	iexplore.exe
4544	iexplore.exe
6020	IEXPLORE.EXE
6020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 208	4552	msiexec.exe	84
PID 4552 wrote to memory of 208	4552	msiexec.exe	84
PID 4552 wrote to memory of 208	4552	msiexec.exe	84
PID 208 wrote to memory of 2112	208	MsiExec.exe	88
PID 208 wrote to memory of 2112	208	MsiExec.exe	88
PID 208 wrote to memory of 2112	208	MsiExec.exe	88
PID 208 wrote to memory of 1160	208	MsiExec.exe	90
PID 208 wrote to memory of 1160	208	MsiExec.exe	90
PID 208 wrote to memory of 1160	208	MsiExec.exe	90
PID 1756 wrote to memory of 2180	1756	chrome.exe	97
PID 1756 wrote to memory of 2180	1756	chrome.exe	97
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 980	1756	chrome.exe	98
PID 1756 wrote to memory of 1936	1756	chrome.exe	99
PID 1756 wrote to memory of 1936	1756	chrome.exe	99
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100
PID 1756 wrote to memory of 2036	1756	chrome.exe	100

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NFs_080_9.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7795EF41D3E041BC651B75BBC1FDF2FA
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C mkdir C:\Users\Admin\KfAdmin54\
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C mkdir C:\Users\Admin\KfAdmin54\KfAdmin54
    3⤵
    PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start C:\Users\Admin\KfAdmin54\KfAdmin54\KfAdmin54.exe
    3⤵
    PID:5380
  - - C:\Users\Admin\KfAdmin54\KfAdmin54\KfAdmin54.exe
      C:\Users\Admin\KfAdmin54\KfAdmin54\KfAdmin54.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:5448
    - - C:\Program Files (x86)\Internet Explorer\ieinstal.exe
        
        "C:\Program Files (x86)\Internet Explorer\ieinstal.exe"
        5⤵
        Checks BIOS information in registry
        Loads dropped DLL
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 700
        5⤵
        Program crash
        
        PID:5616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v KfAdmin54 /t reg_sz /d "C:\Users\Admin\KfAdmin54\KfAdmin54\KfAdmin54.exe"
    3⤵
    PID:116
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v KfAdmin54 /t reg_sz /d "C:\Users\Admin\KfAdmin54\KfAdmin54\KfAdmin54.exe"
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4fb3ab58,0x7ffa4fb3ab68,0x7ffa4fb3ab78
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:2
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4372 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4652 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3960 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4576 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4252 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4104 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3380 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5156 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4496 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5564 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2644 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5720 --field-trial-handle=1928,i,16228353206100265298,13767546825183728241,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5448 -ip 5448
1⤵
PID:5580

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:6012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4544 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:6020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery