fantom | a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Renames multiple (5044) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1068	powershell.exe
2860	powershell.exe
4920	powershell.exe
1500	powershell.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	wpihic.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	wpihic.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe

Executes dropped EXE 34 IoCs

pid	Process
4852	svhost.exe
4824	mdqjbc.exe
2632	wpihic.exe
4520	svhost.exe
1976	WindowsUpdate.exe
3916	svhost.exe
4452	svhost.exe
3480	svhost.exe
580	svhost.exe
3140	fatalerror.exe
5084	svhost.exe
1952	svhost.exe
572	svhost.exe
776	svhost.exe
4816	svhost.exe
2448	svhost.exe
2536	svhost.exe
5064	svhost.exe
916	svhost.exe
436	svhost.exe
4812	svhost.exe
3936	svhost.exe
2696	svhost.exe
2764	svhost.exe
1552	svhost.exe
724	svhost.exe
2660	svhost.exe
1552	svhost.exe
2852	svhost.exe
4760	svhost.exe
3980	svhost.exe
1556	svhost.exe
2872	svhost.exe
776	svhost.exe

Loads dropped DLL 16 IoCs

pid	Process
4824	mdqjbc.exe
4824	mdqjbc.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
1612	MsiExec.exe
2268	MsiExec.exe
1612	MsiExec.exe
4824	mdqjbc.exe
1612	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	sv.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
27	1612	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\P:	mdqjbc.exe
File opened (read-only)	\??\Q:	mdqjbc.exe
File opened (read-only)	\??\U:	mdqjbc.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	mdqjbc.exe
File opened (read-only)	\??\X:	mdqjbc.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	mdqjbc.exe
File opened (read-only)	\??\N:	mdqjbc.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	mdqjbc.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	mdqjbc.exe
File opened (read-only)	\??\M:	mdqjbc.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	mdqjbc.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	mdqjbc.exe
File opened (read-only)	\??\S:	mdqjbc.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	mdqjbc.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	mdqjbc.exe
File opened (read-only)	\??\W:	mdqjbc.exe
File opened (read-only)	\??\Y:	mdqjbc.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	mdqjbc.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	mdqjbc.exe
File opened (read-only)	\??\H:	mdqjbc.exe
File opened (read-only)	\??\L:	mdqjbc.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	mdqjbc.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tcpbidi.xml	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hvservice.inf_amd64_5e2bc63840ed1111\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_ec2e9f4a6c3b33ee\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\LogFiles\SAM\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_92d10a64db12367d\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmoptn.inf_amd64_8be7a491dacbd3c8\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_8baa0e78bc8cb374\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbus.inf_amd64_bc87415e766c04c5\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_apo.inf_amd64_c555077f85b83e3e\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\halextintcpsedma.inf_amd64_d3e62b6f129de692\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\et-EE\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsClient\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_23084e964d79333d\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\uk-UA\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\Keywords\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vca.inf_amd64_ae8fc5f4a51fab7b\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0013\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\migwiz\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0804\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\sppui\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\Dism\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtucx21x64.inf_amd64_d70642620058e2a4\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\spp\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_cashdrawer.inf_amd64_19371e7940235ef1\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_f1a7a2fbd6554d60\VSTProf.cty	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_f7e25163e26bc759\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\OEM\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\MUI\dispspec\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_monitor.inf_amd64_734d2a074635980b\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdm3com.inf_amd64_5d33b9b72b4cc35d\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\spp\tokens\skus\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_c190e9719268b4cc\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_3bf6c0d173eb26c6\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\v_mscdsc.inf_amd64_48ea78e7a5ab1720\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\GroupPolicy\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\ar-SA\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscontinuousbackup.inf_amd64_80b56f8636e8a7d3\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_processor.inf_amd64_f7062136d4517896\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_ee6cfaffa6699d38\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms013.inf_amd64_ae94ada6e6def772\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvpci.inf_amd64_298e2e2a73f2b92f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\PerceptionSimulation\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Windows\SysWOW64\slmgr\0409\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mvumis.inf_amd64_f0f4d0c799bb854a\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\DECRYPT_YOUR_FILES.HTML	wpihic.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\2d5s8g4ed.jpg"	wpihic.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\GroupedList\GroupedList.styles.js	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png	wpihic.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-100.png	wpihic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\de.pak	wpihic.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\ca-es\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-48_altform-lightunplated_contrast-white.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpSplashScreen.scale-200_contrast-white.png	wpihic.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Keytips.js	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-400.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.scale-125.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircleHover.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.scale-200_contrast-white.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\Locales\es-419.pak	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256.png	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-ui-theme.css	wpihic.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\PositioningContainer.js	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\plugin.js	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-24_altform-unplated.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-24_contrast-white.png	wpihic.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WideTile.scale-125_contrast-black.png	wpihic.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\GlobalSettings.js	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraStoreLogo.scale-100.png	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\CameraSmallTile.scale-125.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\Assets\GLTFTextTemplate.json	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\AppxMetadata\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ui-strings.js	wpihic.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\tslib\test\validateModuleExportsMatchCommonJS\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_delete_18.svg	wpihic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ExpenseReport.xltx	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxManifest.xml	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_2021.226.1915.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-unplated.png	wpihic.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\index.js	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js	wpihic.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\HeroAppTile.xml	wpihic.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\id.pak	wpihic.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\IEffects.js	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-72_altform-lightunplated.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-lightunplated_contrast-black.png	wpihic.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png	wpihic.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-20.png	wpihic.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-400.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleSmallTile.scale-100.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSquare150x150Logo.scale-200.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-40.png	wpihic.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-36.png	wpihic.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\DECRYPT_YOUR_FILES.HTML	wpihic.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W2ded559f#\389ac48f1fdf5492f8ea0fd3981ca23d\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-miracast-receiver-api_31bf3856ad364e35_10.0.22000.65_none_eab698ad34af5c1f\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.22000.348_nl-nl_b6e8269c14e9cf1c\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..oem-coren.resources_31bf3856ad364e35_10.0.22000.493_nb-no_e490ecbdff9b971d\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mfds_31bf3856ad364e35_10.0.22000.282_none_a0b4add7a2d967a3\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\msil_microsoft-windows-d..ivecenter.resources_31bf3856ad364e35_10.0.22000.120_zh-tw_9bf2fa1b3b07ea49\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_netfx-aspnet_appdata_b03f5f7f11d50a3a_10.0.22000.1_none_f02853143aecbaf3\GroupedProviders.xml	wpihic.exe
File created	C:\Windows\WinSxS\wow64_windows-system-user..diagnosticssettings_31bf3856ad364e35_10.0.22000.1_none_202a583cdeaea858\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_windows-id-connecte..r-wlidcli.resources_31bf3856ad364e35_10.0.22000.1_en-us_69e8084a7274ae5c\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.22000.348_zh-cn_bef0564e00fb8adc\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.22000.1_none_adb9456adaeee73e\MicrosoftOffice2010Win32.xml	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.22000.120_none_bb415867ae85d51c\i_inspect.png	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-modernexecserver_31bf3856ad364e35_10.0.22000.51_none_b67b0152a8a49162\r\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\PLA\System\System Performance.xml	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.22000.184_el-gr_68fa18c86b74bd5b\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..orenderer.resources_31bf3856ad364e35_10.0.22000.1_en-us_003d9a2238f47891\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.22000.1_en-us_1ecd7af7bc80c92d\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msac3enc_31bf3856ad364e35_10.0.22000.120_none_a043fed800d1f7a5\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..wmanager-compositor_31bf3856ad364e35_10.0.22000.493_none_009edaf1c4c17556\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-shacct-profile_31bf3856ad364e35_10.0.22000.434_none_aff7091c882dd74b\r\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-windows-base_31bf3856ad364e35_10.0.22000.1_none_bb5964dc2f6adf9f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.22000.258_en-us_53d73983fe32e4c1\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..skmanager.resources_31bf3856ad364e35_10.0.22000.120_en-gb_e315e1354626071f\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..edia-base.resources_31bf3856ad364e35_10.0.22000.318_lv-lv_5098437251612c08\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\f\Snooze_80.contrast-black.png	wpihic.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-core_tools_31bf3856ad364e35_10.0.22000.1_none_6ca2681bf0bb11c8\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.22000.348_tr-tr_ad78298b76bc9ebc\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.22000.376_none_7aed0a6ee4ea4300\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_dual_mchgr.inf_31bf3856ad364e35_10.0.22000.1_none_a5097f12967d5093\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-icm-adm.resources_31bf3856ad364e35_10.0.22000.1_en-us_f50082e12107049b\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..leducationn-license_31bf3856ad364e35_10.0.22000.348_none_2364cb85c5af7b52\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..lprovider.resources_31bf3856ad364e35_10.0.22000.1_en-us_3b66e307accdf969\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\NarratorMedTile.scale-400_contrast-white.png	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft.configci.commands_31bf3856ad364e35_10.0.22000.51_none_8f36ed7cfebd2222\DenyAllAudit.xml	wpihic.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..nosticsframeworkapi_31bf3856ad364e35_10.0.22000.1_none_8b89f882e4479ffd\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..riverclassextension_31bf3856ad364e35_10.0.22000.1_none_68cca9c1a2bc9ea1\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-videoport_31bf3856ad364e35_10.0.22000.1_none_125de9b9092d8d3c\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.493_none_a9fee4e32efd000a\1a6c3312fc2cd6ee1af29b7709c2cfb7f2df47ef.xml	wpihic.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorAppList.targetsize-256_contrast-black.png	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.469_none_fdfb724cd2e5c0ff\retailDemoAdmin.js	wpihic.exe
File created	C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15806.0_none_3304deb9ba36cf1e\folder.gif	wpihic.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..sion-netprovisionsp_31bf3856ad364e35_10.0.22000.1_none_0c3bb08b8eba7e51\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_dual_vhdmp.inf_31bf3856ad364e35_10.0.22000.493_none_89ecd43a7ef888aa\f\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ai-machinelearning_31bf3856ad364e35_10.0.22000.1_none_5aaff2515e943e92\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-direct3d12-linux_31bf3856ad364e35_10.0.22000.120_none_7b74d1eb0f4cd1c6\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorMedTile.scale-200_contrast-white.png	wpihic.exe
File created	C:\Windows\WinSxS\amd64_dual_modemcsa.inf_31bf3856ad364e35_10.0.22000.1_none_6e0f3ae5b9bd714d\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_windows-system-launcher.resources_31bf3856ad364e35_10.0.22000.1_en-us_6e38dbef07f00284\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..xtensions.resources_31bf3856ad364e35_10.0.22000.1_en-us_c36bddb262b8459a\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\images\wifiLottie.json	wpihic.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..chinese-tip_profile_31bf3856ad364e35_10.0.22000.41_none_b679e803947b5213\r\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..displays-kernelmode_31bf3856ad364e35_10.0.22000.1_none_983b358003648096\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.22000.1_none_b1116c83034868d0\manifest.json	wpihic.exe
File created	C:\Windows\Provisioning\Autopilot\DiagnosticAnalysisFramework\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..s-storage.resources_31bf3856ad364e35_10.0.22000.132_nl-nl_b143ac934c8eab14\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell32.resources_31bf3856ad364e35_10.0.22000.184_lv-lv_cba4d888ff9303c1\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_10.0.22000.318_none_ec3e48d33e40ed7c\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\DECRYPT_YOUR_FILES.HTML	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\windows.openwith.svg	wpihic.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.22000.1_none_6d5619d8ba52aa97\Windows Unlock.wav	wpihic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	fatalerror.exe
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	fatalerror.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	fatalerror.exe
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main	fatalerror.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings	wpihic.exe
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings	sv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1584	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4560	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1068	powershell.exe
1068	powershell.exe
2860	powershell.exe
2860	powershell.exe
4920	powershell.exe
4920	powershell.exe
1500	powershell.exe
1500	powershell.exe
4432	msedge.exe
4432	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
252	msedge.exe
252	msedge.exe
908	identity_helper.exe
908	identity_helper.exe
1308	msiexec.exe
1308	msiexec.exe
2632	wpihic.exe
2632	wpihic.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2436	sv.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	sv.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	2436	sv.exe
Token: SeDebugPrivilege	4852	svhost.exe
Token: SeSecurityPrivilege	1308	msiexec.exe
Token: SeCreateTokenPrivilege	4824	mdqjbc.exe
Token: SeAssignPrimaryTokenPrivilege	4824	mdqjbc.exe
Token: SeLockMemoryPrivilege	4824	mdqjbc.exe
Token: SeIncreaseQuotaPrivilege	4824	mdqjbc.exe
Token: SeMachineAccountPrivilege	4824	mdqjbc.exe
Token: SeTcbPrivilege	4824	mdqjbc.exe
Token: SeSecurityPrivilege	4824	mdqjbc.exe
Token: SeTakeOwnershipPrivilege	4824	mdqjbc.exe
Token: SeLoadDriverPrivilege	4824	mdqjbc.exe
Token: SeSystemProfilePrivilege	4824	mdqjbc.exe
Token: SeSystemtimePrivilege	4824	mdqjbc.exe
Token: SeProfSingleProcessPrivilege	4824	mdqjbc.exe
Token: SeIncBasePriorityPrivilege	4824	mdqjbc.exe
Token: SeCreatePagefilePrivilege	4824	mdqjbc.exe
Token: SeCreatePermanentPrivilege	4824	mdqjbc.exe
Token: SeBackupPrivilege	4824	mdqjbc.exe
Token: SeRestorePrivilege	4824	mdqjbc.exe
Token: SeShutdownPrivilege	4824	mdqjbc.exe
Token: SeDebugPrivilege	4824	mdqjbc.exe
Token: SeAuditPrivilege	4824	mdqjbc.exe
Token: SeSystemEnvironmentPrivilege	4824	mdqjbc.exe
Token: SeChangeNotifyPrivilege	4824	mdqjbc.exe
Token: SeRemoteShutdownPrivilege	4824	mdqjbc.exe
Token: SeUndockPrivilege	4824	mdqjbc.exe
Token: SeSyncAgentPrivilege	4824	mdqjbc.exe
Token: SeEnableDelegationPrivilege	4824	mdqjbc.exe
Token: SeManageVolumePrivilege	4824	mdqjbc.exe
Token: SeImpersonatePrivilege	4824	mdqjbc.exe
Token: SeCreateGlobalPrivilege	4824	mdqjbc.exe
Token: SeShutdownPrivilege	780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	780	msiexec.exe
Token: SeCreateTokenPrivilege	780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	780	msiexec.exe
Token: SeLockMemoryPrivilege	780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	780	msiexec.exe
Token: SeMachineAccountPrivilege	780	msiexec.exe
Token: SeTcbPrivilege	780	msiexec.exe
Token: SeSecurityPrivilege	780	msiexec.exe
Token: SeTakeOwnershipPrivilege	780	msiexec.exe
Token: SeLoadDriverPrivilege	780	msiexec.exe
Token: SeSystemProfilePrivilege	780	msiexec.exe
Token: SeSystemtimePrivilege	780	msiexec.exe
Token: SeProfSingleProcessPrivilege	780	msiexec.exe
Token: SeIncBasePriorityPrivilege	780	msiexec.exe
Token: SeCreatePagefilePrivilege	780	msiexec.exe
Token: SeCreatePermanentPrivilege	780	msiexec.exe
Token: SeBackupPrivilege	780	msiexec.exe
Token: SeRestorePrivilege	780	msiexec.exe
Token: SeShutdownPrivilege	780	msiexec.exe
Token: SeDebugPrivilege	780	msiexec.exe
Token: SeAuditPrivilege	780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	780	msiexec.exe
Token: SeChangeNotifyPrivilege	780	msiexec.exe
Token: SeRemoteShutdownPrivilege	780	msiexec.exe
Token: SeUndockPrivilege	780	msiexec.exe
Token: SeSyncAgentPrivilege	780	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
780	msiexec.exe
780	msiexec.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4560	EXCEL.EXE
4560	EXCEL.EXE
4560	EXCEL.EXE
4560	EXCEL.EXE
4560	EXCEL.EXE
4560	EXCEL.EXE
4560	EXCEL.EXE
4560	EXCEL.EXE
4560	EXCEL.EXE
3140	fatalerror.exe
3140	fatalerror.exe
3140	fatalerror.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1068	2436	sv.exe	80
PID 2436 wrote to memory of 1068	2436	sv.exe	80
PID 2436 wrote to memory of 2860	2436	sv.exe	82
PID 2436 wrote to memory of 2860	2436	sv.exe	82
PID 2436 wrote to memory of 4920	2436	sv.exe	84
PID 2436 wrote to memory of 4920	2436	sv.exe	84
PID 2436 wrote to memory of 1500	2436	sv.exe	86
PID 2436 wrote to memory of 1500	2436	sv.exe	86
PID 2436 wrote to memory of 1584	2436	sv.exe	88
PID 2436 wrote to memory of 1584	2436	sv.exe	88
PID 2436 wrote to memory of 3160	2436	sv.exe	91
PID 2436 wrote to memory of 3160	2436	sv.exe	91
PID 3160 wrote to memory of 1568	3160	msedge.exe	92
PID 3160 wrote to memory of 1568	3160	msedge.exe	92
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 1868	3160	msedge.exe	93
PID 3160 wrote to memory of 4432	3160	msedge.exe	94
PID 3160 wrote to memory of 4432	3160	msedge.exe	94
PID 3160 wrote to memory of 4040	3160	msedge.exe	95
PID 3160 wrote to memory of 4040	3160	msedge.exe	95
PID 3160 wrote to memory of 4040	3160	msedge.exe	95
PID 3160 wrote to memory of 4040	3160	msedge.exe	95
PID 3160 wrote to memory of 4040	3160	msedge.exe	95
PID 3160 wrote to memory of 4040	3160	msedge.exe	95
PID 3160 wrote to memory of 4040	3160	msedge.exe	95
PID 3160 wrote to memory of 4040	3160	msedge.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv.exe
"C:\Users\Admin\AppData\Local\Temp\sv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://exmple.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7fff5d1d3cb8,0x7fff5d1d3cc8,0x7fff5d1d3cd8
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14899050947127457336,3569977439899430467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:3876
- C:\Users\Admin\AppData\Local\Temp\mdqjbc.exe
  "C:\Users\Admin\AppData\Local\Temp\mdqjbc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\mdqjbc.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:780
- C:\Users\Admin\AppData\Local\Temp\wpihic.exe
  "C:\Users\Admin\AppData\Local\Temp\wpihic.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
    3⤵
    - Executes dropped EXE
    PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\delback.bat"
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update0.bat" "
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
    3⤵
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rwcpru.bat" "
  2⤵
  PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 51271CBCBB84615CDC051CC19959B794
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  PID:1612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E3635D471DA253A88D854570866E1D69 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4888

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\ConnectConfirm.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4560

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:3916

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4452

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:3480

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:580

C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe
"C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
1⤵
PID:1240

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:5084

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:1952

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:572

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:776

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4816

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2448

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2536

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:5064

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:916

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:436

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4812

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:3936

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2696

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2764

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:1552

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:724

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2660

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:1552

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2852

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4760

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:3980

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:1556

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2872

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery