5a96cf05d1e13547ba2459f23d22231242c11eef2ed6872c31265c23805c9024

Processes:

orbhsrfcan.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	orbhsrfcan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

orbhsrfcan.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	orbhsrfcan.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

orbhsrfcan.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	orbhsrfcan.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

orbhsrfcan.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	orbhsrfcan.exe

Executes dropped EXE 9 IoCs

Processes:

loader.exeac3.exejaffa.exejkka.exeorbhsrfcan.execunsatvqpxqnikr.exejhnewqpt.exeizrnrpjolhqyz.exejhnewqpt.exe

pid	process
2288	loader.exe
1040	ac3.exe
2080	jaffa.exe
960	jkka.exe
712	orbhsrfcan.exe
764	cunsatvqpxqnikr.exe
664	jhnewqpt.exe
484	izrnrpjolhqyz.exe
2508	jhnewqpt.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2328 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2328	icacls.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

orbhsrfcan.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	orbhsrfcan.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

cunsatvqpxqnikr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rxhxzfbx = "orbhsrfcan.exe"	cunsatvqpxqnikr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\suxeothe = "cunsatvqpxqnikr.exe"	cunsatvqpxqnikr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "izrnrpjolhqyz.exe"	cunsatvqpxqnikr.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

jhnewqpt.exejhnewqpt.exeorbhsrfcan.exe

description	ioc	process
File opened (read-only)	\??\j:	jhnewqpt.exe
File opened (read-only)	\??\l:	jhnewqpt.exe
File opened (read-only)	\??\o:	jhnewqpt.exe
File opened (read-only)	\??\s:	jhnewqpt.exe
File opened (read-only)	\??\z:	jhnewqpt.exe
File opened (read-only)	\??\h:	orbhsrfcan.exe
File opened (read-only)	\??\t:	orbhsrfcan.exe
File opened (read-only)	\??\a:	jhnewqpt.exe
File opened (read-only)	\??\z:	jhnewqpt.exe
File opened (read-only)	\??\i:	jhnewqpt.exe
File opened (read-only)	\??\v:	jhnewqpt.exe
File opened (read-only)	\??\y:	jhnewqpt.exe
File opened (read-only)	\??\n:	orbhsrfcan.exe
File opened (read-only)	\??\s:	orbhsrfcan.exe
File opened (read-only)	\??\z:	orbhsrfcan.exe
File opened (read-only)	\??\w:	jhnewqpt.exe
File opened (read-only)	\??\n:	jhnewqpt.exe
File opened (read-only)	\??\w:	jhnewqpt.exe
File opened (read-only)	\??\r:	orbhsrfcan.exe
File opened (read-only)	\??\a:	jhnewqpt.exe
File opened (read-only)	\??\b:	orbhsrfcan.exe
File opened (read-only)	\??\u:	orbhsrfcan.exe
File opened (read-only)	\??\e:	jhnewqpt.exe
File opened (read-only)	\??\v:	jhnewqpt.exe
File opened (read-only)	\??\g:	jhnewqpt.exe
File opened (read-only)	\??\a:	orbhsrfcan.exe
File opened (read-only)	\??\g:	orbhsrfcan.exe
File opened (read-only)	\??\b:	jhnewqpt.exe
File opened (read-only)	\??\g:	jhnewqpt.exe
File opened (read-only)	\??\o:	jhnewqpt.exe
File opened (read-only)	\??\e:	jhnewqpt.exe
File opened (read-only)	\??\x:	jhnewqpt.exe
File opened (read-only)	\??\k:	orbhsrfcan.exe
File opened (read-only)	\??\l:	jhnewqpt.exe
File opened (read-only)	\??\n:	jhnewqpt.exe
File opened (read-only)	\??\j:	jhnewqpt.exe
File opened (read-only)	\??\q:	orbhsrfcan.exe
File opened (read-only)	\??\u:	jhnewqpt.exe
File opened (read-only)	\??\y:	jhnewqpt.exe
File opened (read-only)	\??\h:	jhnewqpt.exe
File opened (read-only)	\??\k:	jhnewqpt.exe
File opened (read-only)	\??\p:	jhnewqpt.exe
File opened (read-only)	\??\t:	jhnewqpt.exe
File opened (read-only)	\??\q:	jhnewqpt.exe
File opened (read-only)	\??\m:	orbhsrfcan.exe
File opened (read-only)	\??\v:	orbhsrfcan.exe
File opened (read-only)	\??\x:	orbhsrfcan.exe
File opened (read-only)	\??\k:	jhnewqpt.exe
File opened (read-only)	\??\t:	jhnewqpt.exe
File opened (read-only)	\??\e:	orbhsrfcan.exe
File opened (read-only)	\??\r:	jhnewqpt.exe
File opened (read-only)	\??\j:	orbhsrfcan.exe
File opened (read-only)	\??\w:	orbhsrfcan.exe
File opened (read-only)	\??\r:	jhnewqpt.exe
File opened (read-only)	\??\u:	jhnewqpt.exe
File opened (read-only)	\??\l:	orbhsrfcan.exe
File opened (read-only)	\??\y:	orbhsrfcan.exe
File opened (read-only)	\??\q:	jhnewqpt.exe
File opened (read-only)	\??\s:	jhnewqpt.exe
File opened (read-only)	\??\b:	jhnewqpt.exe
File opened (read-only)	\??\o:	orbhsrfcan.exe
File opened (read-only)	\??\p:	orbhsrfcan.exe
File opened (read-only)	\??\h:	jhnewqpt.exe
File opened (read-only)	\??\m:	jhnewqpt.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

Processes:

orbhsrfcan.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	orbhsrfcan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	orbhsrfcan.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\ac3.exe	autoit_exe
behavioral1/memory/2080-68-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\jaffa.exe	autoit_exe
C:\Windows\SysWOW64\cunsatvqpxqnikr.exe	autoit_exe
C:\Windows\SysWOW64\orbhsrfcan.exe	autoit_exe
C:\Windows\SysWOW64\jhnewqpt.exe	autoit_exe
C:\Windows\SysWOW64\izrnrpjolhqyz.exe	autoit_exe
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	autoit_exe
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	autoit_exe
C:\Users\Admin\Desktop\JoinNew.doc.exe	autoit_exe
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	autoit_exe
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	autoit_exe

Drops file in System32 directory 12 IoCs

Processes:

jaffa.exejhnewqpt.exeorbhsrfcan.exejhnewqpt.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\cunsatvqpxqnikr.exe	jaffa.exe
File created	C:\Windows\SysWOW64\jhnewqpt.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\jhnewqpt.exe	jaffa.exe
File created	C:\Windows\SysWOW64\izrnrpjolhqyz.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\izrnrpjolhqyz.exe	jaffa.exe
File created	C:\Windows\SysWOW64\orbhsrfcan.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\orbhsrfcan.exe	jaffa.exe
File created	C:\Windows\SysWOW64\cunsatvqpxqnikr.exe	jaffa.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	jhnewqpt.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	orbhsrfcan.exe
File created	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	jhnewqpt.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	jhnewqpt.exe

Drops file in Program Files directory 14 IoCs

Processes:

jhnewqpt.exejhnewqpt.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	jhnewqpt.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	jhnewqpt.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	jhnewqpt.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	jhnewqpt.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	jhnewqpt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	jhnewqpt.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	jhnewqpt.exe

Drops file in Windows directory 11 IoCs

Processes:

jhnewqpt.exejaffa.exeWINWORD.EXEjhnewqpt.exe

description	ioc	process
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	jhnewqpt.exe
File opened for modification	C:\Windows\mydoc.rtf	jaffa.exe
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	jhnewqpt.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	jhnewqpt.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	jhnewqpt.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	jhnewqpt.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	jhnewqpt.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	jhnewqpt.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	jhnewqpt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exeWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

884 taskkill.exe
1636 taskkill.exe
3056 taskkill.exe

pid	process
884	taskkill.exe
1636	taskkill.exe
3056	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31108444"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2708564339"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe

Modifies registry class 21 IoCs

Processes:

jaffa.exeorbhsrfcan.execmd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACDF9B1F963F2E3830E3A45819D3E90B38F03FC4269034EE1BE42EB09A8"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F368C4FE6C22D0D17AD0A88A7B9062"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193AC7741493DABEB8CB7FE0ED9634CC"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	orbhsrfcan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	orbhsrfcan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33372D7A9C5283576D3F77D270202CDD7D8F64D7"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC1B15B47E0399852C9B9D333EED4BB"	jaffa.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	orbhsrfcan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	orbhsrfcan.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	orbhsrfcan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	orbhsrfcan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	orbhsrfcan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF8FC8D4F5D851F9041D65C7DE6BDE2E147593066466237D69E"	jaffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	orbhsrfcan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	orbhsrfcan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	orbhsrfcan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	orbhsrfcan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	orbhsrfcan.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

872 WINWORD.EXE
872 WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exejaffa.execunsatvqpxqnikr.exeorbhsrfcan.exejhnewqpt.exeizrnrpjolhqyz.exe

pid	process
4932	msedge.exe
4932	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
664	jhnewqpt.exe
712	orbhsrfcan.exe
664	jhnewqpt.exe
712	orbhsrfcan.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
484	izrnrpjolhqyz.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ac3.exe

pid process

1040 ac3.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1456 msedge.exe
1456 msedge.exe
1456 msedge.exe
1456 msedge.exe
1456 msedge.exe
1456 msedge.exe

pid	process
1040	ac3.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.execmd.exe

description	pid	process
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeSystemtimePrivilege	3600	cmd.exe
Token: SeSystemtimePrivilege	3600	cmd.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

msedge.exejaffa.exejhnewqpt.exeorbhsrfcan.execunsatvqpxqnikr.exeizrnrpjolhqyz.exejhnewqpt.exe

pid	process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
2508	jhnewqpt.exe
2508	jhnewqpt.exe
2508	jhnewqpt.exe

Suspicious use of SendNotifyMessage 30 IoCs

Processes:

msedge.exejaffa.exejhnewqpt.exeorbhsrfcan.execunsatvqpxqnikr.exeizrnrpjolhqyz.exejhnewqpt.exe

pid	process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
2080	jaffa.exe
2080	jaffa.exe
2080	jaffa.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
664	jhnewqpt.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
712	orbhsrfcan.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
764	cunsatvqpxqnikr.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
484	izrnrpjolhqyz.exe
2508	jhnewqpt.exe
2508	jhnewqpt.exe
2508	jhnewqpt.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

WINWORD.EXE

pid	process
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE
872	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

lol.exeloader.execmd.execmd.exemsedge.exe

description	pid	process	target process
PID 2024 wrote to memory of 2288	2024	lol.exe	loader.exe
PID 2024 wrote to memory of 2288	2024	lol.exe	loader.exe
PID 2288 wrote to memory of 4016	2288	loader.exe	cmd.exe
PID 2288 wrote to memory of 4016	2288	loader.exe	cmd.exe
PID 4016 wrote to memory of 3600	4016	cmd.exe	cmd.exe
PID 4016 wrote to memory of 3600	4016	cmd.exe	cmd.exe
PID 3600 wrote to memory of 1456	3600	cmd.exe	msedge.exe
PID 3600 wrote to memory of 1456	3600	cmd.exe	msedge.exe
PID 1456 wrote to memory of 3424	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 3424	1456	msedge.exe	msedge.exe
PID 3600 wrote to memory of 1432	3600	cmd.exe	WScript.exe
PID 3600 wrote to memory of 1432	3600	cmd.exe	WScript.exe
PID 3600 wrote to memory of 4236	3600	cmd.exe	iexplore.exe
PID 3600 wrote to memory of 4236	3600	cmd.exe	iexplore.exe
PID 3600 wrote to memory of 884	3600	cmd.exe	taskkill.exe
PID 3600 wrote to memory of 884	3600	cmd.exe	taskkill.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2540	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 4932	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 4932	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2832	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2832	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2832	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2832	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2832	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2832	1456	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\lol.exe
"C:\Users\Admin\AppData\Local\Temp\lol.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\loader.exe
"C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\loader.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\temp.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K main.cmd
4⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\web.htm
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffebbe73cb8,0x7ffebbe73cc8,0x7ffebbe73cd8
6⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
6⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
6⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
6⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
6⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
6⤵
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
6⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
6⤵
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
6⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
6⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
6⤵
PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,10468056471744238459,11263864662038043484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:2
6⤵
PID:4652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\helper.vbs"
5⤵
PID:1432

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\spinner.gif
5⤵
- Modifies Internet Explorer settings
PID:4236

C:\Windows\system32\taskkill.exe
taskkill /f /im taskmgr
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\system32\taskkill.exe
taskkill /f /im explorer
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\ac3.exe
ac3.exe
5⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1040

C:\Windows\system32\taskkill.exe
taskkill /f /im fontdrvhost
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\system32\icacls.exe
icacls c:\Windows\explorer.exe /grant Admin:(F,M)
5⤵
- Modifies file permissions
PID:2328

C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\jaffa.exe
jaffa.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2080

C:\Windows\SysWOW64\orbhsrfcan.exe
orbhsrfcan.exe
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:712

C:\Windows\SysWOW64\jhnewqpt.exe
C:\Windows\system32\jhnewqpt.exe
7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2508

C:\Windows\SysWOW64\cunsatvqpxqnikr.exe
cunsatvqpxqnikr.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:764

C:\Windows\SysWOW64\jhnewqpt.exe
jhnewqpt.exe
6⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:664

C:\Windows\SysWOW64\izrnrpjolhqyz.exe
izrnrpjolhqyz.exe
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:484

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
6⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:872

C:\Windows\system32\iexpress.exe
IEXPRESS.exe
5⤵
PID:2432

C:\Users\Admin\Desktop\lol_20dbea90-7d16-4b71-9ad3-3cf1f1a0c9ce\jkka.exe
jkka.exe
5⤵
- Executes dropped EXE
PID:960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery