lumma | hxxps://drive[.]google[.]com/file/d/1y--C8OwAfFUwlMPRG93yznAF5_5Oh6y-/view?pli=1

Virtualization/Sandbox Evasion

T1497

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ivBLLbjMs5AVX9oNG1XjDrwN.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
1000	powershell.exe
1692	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exeInstall.exeInstall.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ivBLLbjMs5AVX9oNG1XjDrwN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ivBLLbjMs5AVX9oNG1XjDrwN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Install.exesetup.exeWrJ3hKxsDqhwmb5nEKp_fGDf.exeInstall.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	WrJ3hKxsDqhwmb5nEKp_fGDf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Install.exe

Drops startup file 3 IoCs

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.execmd.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	ivBLLbjMs5AVX9oNG1XjDrwN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url	cmd.exe

Executes dropped EXE 21 IoCs

Processes:

setup.exesetup.exe0xG5cI5IDKWNKChyvaRAQLyA.exeW76tm0BP79JabYBOvPiXHSj3.exe__nigowHJ7J5_PyWdoRvVNHP.exeBF6irFAZeCH0eOcJairdn7Jd.exeWrJ3hKxsDqhwmb5nEKp_fGDf.exeTOYlYOJQKqb4muXWog6jC3wu.exeJOd9VE9M9LZBxt5_BczgzvOo.exemOZigL0_G48uSFBJ6Dzcu05Z.exeivBLLbjMs5AVX9oNG1XjDrwN.exe__nigowHJ7J5_PyWdoRvVNHP.tmpInstall.exeInstall.exepionaudioplayer.exeInstall.exeInstall.exepionaudioplayer.exeClvZjkBPXcWA0rQRZzU2K8ym.exeSpec.pifeqtpkqwqodik.exe

pid	Process
5608	setup.exe
5248	setup.exe
4332	0xG5cI5IDKWNKChyvaRAQLyA.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
1208	__nigowHJ7J5_PyWdoRvVNHP.exe
4108	BF6irFAZeCH0eOcJairdn7Jd.exe
5312	WrJ3hKxsDqhwmb5nEKp_fGDf.exe
2028	TOYlYOJQKqb4muXWog6jC3wu.exe
3672	JOd9VE9M9LZBxt5_BczgzvOo.exe
1368	mOZigL0_G48uSFBJ6Dzcu05Z.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp
404	Install.exe
760	Install.exe
2528	pionaudioplayer.exe
5892	Install.exe
5708	Install.exe
5872	pionaudioplayer.exe
4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
4236	Spec.pif
4028	eqtpkqwqodik.exe

Loads dropped DLL 1 IoCs

Processes:

__nigowHJ7J5_PyWdoRvVNHP.tmp

pid	Process
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/files/0x0007000000023624-495.dat	themida
behavioral1/memory/4852-498-0x0000000000100000-0x0000000000A8F000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	ivBLLbjMs5AVX9oNG1XjDrwN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ivBLLbjMs5AVX9oNG1XjDrwN.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
9	drive.google.com
126	bitbucket.org
131	bitbucket.org
142	bitbucket.org
154	bitbucket.org
232	iplogger.org
233	iplogger.org
6	drive.google.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
113	api.myip.com
114	api.myip.com
115	ipinfo.io
116	ipinfo.io

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	Process
1792	powercfg.exe
3472	powercfg.exe
544	powercfg.exe
5840	powercfg.exe
3932	powercfg.exe
3400	powercfg.exe
5720	powercfg.exe
1408	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

setup.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

pid	Process
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

TOYlYOJQKqb4muXWog6jC3wu.exeW76tm0BP79JabYBOvPiXHSj3.exeClvZjkBPXcWA0rQRZzU2K8ym.exemOZigL0_G48uSFBJ6Dzcu05Z.exeeqtpkqwqodik.exe

description	pid	Process	procid_target
PID 2028 set thread context of 1520	2028	TOYlYOJQKqb4muXWog6jC3wu.exe	141
PID 4608 set thread context of 732	4608	W76tm0BP79JabYBOvPiXHSj3.exe	149
PID 4356 set thread context of 5260	4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe	171
PID 1368 set thread context of 880	1368	mOZigL0_G48uSFBJ6Dzcu05Z.exe	190
PID 4028 set thread context of 5176	4028	eqtpkqwqodik.exe	212
PID 4028 set thread context of 4564	4028	eqtpkqwqodik.exe	213

Drops file in Windows directory 2 IoCs

Processes:

schtasks.exeschtasks.exe

description	ioc	Process
File created	C:\Windows\Tasks\bsqNJSiTyoMLfdbIdy.job	schtasks.exe
File created	C:\Windows\Tasks\bmQWCxleEgxbTUrSZz.job	schtasks.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
5704	sc.exe
3424	sc.exe
5516	sc.exe
3884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1072	2028	WerFault.exe	132

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

MSBuild.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
464	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exe

pid	Process
524	tasklist.exe
3736	tasklist.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

Processes:

Install.exeInstall.exemsedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
5912	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
5716	schtasks.exe
4272	schtasks.exe
5560	schtasks.exe
5900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exesetup.exesetup.exeivBLLbjMs5AVX9oNG1XjDrwN.exeW76tm0BP79JabYBOvPiXHSj3.exeBF6irFAZeCH0eOcJairdn7Jd.exepowershell.exepowershell.exeRegAsm.exeClvZjkBPXcWA0rQRZzU2K8ym.exe

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
2896	msedge.exe
2896	msedge.exe
2932	identity_helper.exe
2932	identity_helper.exe
5192	msedge.exe
5192	msedge.exe
5608	setup.exe
5608	setup.exe
5248	setup.exe
5248	setup.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4108	BF6irFAZeCH0eOcJairdn7Jd.exe
4108	BF6irFAZeCH0eOcJairdn7Jd.exe
1692	powershell.exe
1692	powershell.exe
1000	powershell.exe
1000	powershell.exe
1000	powershell.exe
1692	powershell.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exe7zG.exeW76tm0BP79JabYBOvPiXHSj3.exeMSBuild.exepowershell.exepowershell.exeRegAsm.exeClvZjkBPXcWA0rQRZzU2K8ym.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeRestorePrivilege	5416	7zG.exe
Token: 35	5416	7zG.exe
Token: SeSecurityPrivilege	5416	7zG.exe
Token: SeSecurityPrivilege	5416	7zG.exe
Token: SeRestorePrivilege	5192	7zG.exe
Token: 35	5192	7zG.exe
Token: SeSecurityPrivilege	5192	7zG.exe
Token: SeSecurityPrivilege	5192	7zG.exe
Token: SeDebugPrivilege	4608	W76tm0BP79JabYBOvPiXHSj3.exe
Token: SeDebugPrivilege	732	MSBuild.exe
Token: SeBackupPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	1520	RegAsm.exe
Token: SeDebugPrivilege	4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5900	WMIC.exe
Token: SeSecurityPrivilege	5900	WMIC.exe
Token: SeTakeOwnershipPrivilege	5900	WMIC.exe

Suspicious use of FindShellTrayWindow 53 IoCs

Processes:

msedge.exe7zG.exe7zG.exe__nigowHJ7J5_PyWdoRvVNHP.tmpSpec.pif

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
5416	7zG.exe
5192	7zG.exe
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp
4236	Spec.pif
4236	Spec.pif
4236	Spec.pif

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exeSpec.pif

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4236	Spec.pif
4236	Spec.pif
4236	Spec.pif

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

setup.exesetup.exe0xG5cI5IDKWNKChyvaRAQLyA.exe__nigowHJ7J5_PyWdoRvVNHP.exeTOYlYOJQKqb4muXWog6jC3wu.exeWrJ3hKxsDqhwmb5nEKp_fGDf.exeJOd9VE9M9LZBxt5_BczgzvOo.exeivBLLbjMs5AVX9oNG1XjDrwN.exe__nigowHJ7J5_PyWdoRvVNHP.tmpRegAsm.exeInstall.exeInstall.exepionaudioplayer.exeInstall.exeInstall.exepionaudioplayer.exeMSBuild.exeSpec.pifBitLockerToGo.exe

pid	Process
5608	setup.exe
5248	setup.exe
4332	0xG5cI5IDKWNKChyvaRAQLyA.exe
1208	__nigowHJ7J5_PyWdoRvVNHP.exe
2028	TOYlYOJQKqb4muXWog6jC3wu.exe
5312	WrJ3hKxsDqhwmb5nEKp_fGDf.exe
3672	JOd9VE9M9LZBxt5_BczgzvOo.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp
1520	RegAsm.exe
404	Install.exe
760	Install.exe
2528	pionaudioplayer.exe
5892	Install.exe
5708	Install.exe
5872	pionaudioplayer.exe
5260	MSBuild.exe
4236	Spec.pif
880	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4152 wrote to memory of 456	4152	msedge.exe	83
PID 4152 wrote to memory of 456	4152	msedge.exe	83
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 4232	4152	msedge.exe	84
PID 4152 wrote to memory of 2896	4152	msedge.exe	85
PID 4152 wrote to memory of 2896	4152	msedge.exe	85
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86
PID 4152 wrote to memory of 4732	4152	msedge.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1y--C8OwAfFUwlMPRG93yznAF5_5Oh6y-/view?pli=1
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe103746f8,0x7ffe10374708,0x7ffe10374718
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
    3⤵
    PID:5728
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dvt9td218archive6\" -ad -an -ai#7zMap10450:96:7zEvent9562
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5416
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\dvt9td218archive6\License_setup.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5912
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dvt9td218archive6\" -an -ai#7zMap13234:112:7zEvent22956
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5192
- C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe
  "C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5608
- - C:\Users\Admin\Documents\SimpleAdobe\0xG5cI5IDKWNKChyvaRAQLyA.exe
    C:\Users\Admin\Documents\SimpleAdobe\0xG5cI5IDKWNKChyvaRAQLyA.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\7zS5E67.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\7zS6695.tmp\Install.exe
        
        .\Install.exe /DIIdidGI "385137" /S
        5⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        Suspicious use of SetWindowsHookEx
        
        PID:5892
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5900
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bsqNJSiTyoMLfdbIdy" /SC once /ST 07:34:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6695.tmp\Install.exe\" 2Z /TpwdidwaJ 385137 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:5900
- - C:\Users\Admin\Documents\SimpleAdobe\W76tm0BP79JabYBOvPiXHSj3.exe
    C:\Users\Admin\Documents\SimpleAdobe\W76tm0BP79JabYBOvPiXHSj3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:5896
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3848
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:6132
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:732
- - C:\Users\Admin\Documents\SimpleAdobe\TOYlYOJQKqb4muXWog6jC3wu.exe
    C:\Users\Admin\Documents\SimpleAdobe\TOYlYOJQKqb4muXWog6jC3wu.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 280
      4⤵
      Program crash
      PID:1072
- - C:\Users\Admin\Documents\SimpleAdobe\__nigowHJ7J5_PyWdoRvVNHP.exe
    C:\Users\Admin\Documents\SimpleAdobe\__nigowHJ7J5_PyWdoRvVNHP.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\is-9FBJO.tmp\__nigowHJ7J5_PyWdoRvVNHP.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-9FBJO.tmp\__nigowHJ7J5_PyWdoRvVNHP.tmp" /SL5="$E0028,5287326,54272,C:\Users\Admin\Documents\SimpleAdobe\__nigowHJ7J5_PyWdoRvVNHP.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5520
    - - C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
        
        "C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe" -i
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
        
        "C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe" -s
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5872
- - C:\Users\Admin\Documents\SimpleAdobe\mOZigL0_G48uSFBJ6Dzcu05Z.exe
    C:\Users\Admin\Documents\SimpleAdobe\mOZigL0_G48uSFBJ6Dzcu05Z.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1368
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:880
- - C:\Users\Admin\Documents\SimpleAdobe\JOd9VE9M9LZBxt5_BczgzvOo.exe
    C:\Users\Admin\Documents\SimpleAdobe\JOd9VE9M9LZBxt5_BczgzvOo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\7zS5F42.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\7zS67DD.tmp\Install.exe
        
        .\Install.exe /DdidDNrk "525403" /S
        5⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        Suspicious use of SetWindowsHookEx
        
        PID:5708
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:5372
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5928
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bmQWCxleEgxbTUrSZz" /SC once /ST 07:34:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS67DD.tmp\Install.exe\" xv /aJTdidw 525403 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:5716
- - C:\Users\Admin\Documents\SimpleAdobe\BF6irFAZeCH0eOcJairdn7Jd.exe
    C:\Users\Admin\Documents\SimpleAdobe\BF6irFAZeCH0eOcJairdn7Jd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4108
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:5840
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:3932
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:3400
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:5720
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "CIFUBVHI"
      4⤵
      Launches sc.exe
      PID:5704
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:3424
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:5516
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "CIFUBVHI"
      4⤵
      Launches sc.exe
      PID:3884
- - C:\Users\Admin\Documents\SimpleAdobe\WrJ3hKxsDqhwmb5nEKp_fGDf.exe
    C:\Users\Admin\Documents\SimpleAdobe\WrJ3hKxsDqhwmb5nEKp_fGDf.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5312
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k copy Urban Urban.cmd & Urban.cmd & exit
      4⤵
      PID:4648
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:524
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        
        PID:3136
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3736
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:3020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 780229
        5⤵
        
        PID:3364
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "STEADYSIMSCOLLABORATIVEHUMANITIES" Stylus
        5⤵
        
        PID:4348
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Conservative + Transmission + Employee + Conservation + Coastal + Atlanta 780229\p
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\780229\Spec.pif
        
        780229\Spec.pif 780229\p
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4236
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:464
- - C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe
    C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4852
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4272
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5560
- - C:\Users\Admin\Documents\SimpleAdobe\ClvZjkBPXcWA0rQRZzU2K8ym.exe
    C:\Users\Admin\Documents\SimpleAdobe\ClvZjkBPXcWA0rQRZzU2K8ym.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:2008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      PID:5260
- C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe
  "C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5248
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url" & echo URL="C:\Users\Admin\AppData\Local\VitaConnect Innovations\VitaLink.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url" & exit
  2⤵
  - Drops startup file
  PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2028 -ip 2028
1⤵
PID:544

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4028
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:544
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:3472
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1792
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1408
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5176
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery