asyncrat | 531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f

Windows Service

T1543.003

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe = "0"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4040	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	DD8989123MD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	K8MN9DA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	K8MN9DA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	ZxKKE4oK8.exe

Executes dropped EXE 9 IoCs

pid	Process
3748	DD8989123MD.exe
3188	K8MN9DA.exe
3024	LunaInjector.exe
4168	K8MN9DA.exe
4188	DD8989123MD.exe
1848	DD8989123MD.exe
1892	ZxKKE4oK8.exe
4276	ZxKKE4oK8.exe
4876	DD8989123MD.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe = "0"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
22	pastebin.com
23	pastebin.com
45	discord.com
46	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	wtfismyip.com
43	wtfismyip.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 49 IoCs

pid	Process
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 3188 set thread context of 4168	3188	K8MN9DA.exe	113
PID 3748 set thread context of 1848	3748	DD8989123MD.exe	116
PID 1892 set thread context of 4276	1892	ZxKKE4oK8.exe	133
PID 1848 set thread context of 4876	1848	DD8989123MD.exe	137

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
948	1100	WerFault.exe	83
3844	3188	WerFault.exe	100
2268	3748	WerFault.exe	99
2808	1892	WerFault.exe	128
1420	4876	WerFault.exe	137

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
4780	timeout.exe
1516	timeout.exe
3100	timeout.exe
4780	timeout.exe
2444	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4040	powershell.exe
4040	powershell.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
3748	DD8989123MD.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3188	K8MN9DA.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
3748	DD8989123MD.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
4168	K8MN9DA.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
1892	ZxKKE4oK8.exe
4876	DD8989123MD.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	3748	DD8989123MD.exe
Token: SeDebugPrivilege	3188	K8MN9DA.exe
Token: SeDebugPrivilege	4168	K8MN9DA.exe
Token: SeDebugPrivilege	1892	ZxKKE4oK8.exe
Token: SeDebugPrivilege	4276	ZxKKE4oK8.exe
Token: SeDebugPrivilege	4876	DD8989123MD.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4040	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	88
PID 1100 wrote to memory of 4040	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	88
PID 1100 wrote to memory of 4040	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	88
PID 1100 wrote to memory of 4268	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	92
PID 1100 wrote to memory of 4268	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	92
PID 1100 wrote to memory of 4268	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	92
PID 4268 wrote to memory of 4780	4268	cmd.exe	94
PID 4268 wrote to memory of 4780	4268	cmd.exe	94
PID 4268 wrote to memory of 4780	4268	cmd.exe	94
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 1100 wrote to memory of 3680	1100	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	96
PID 3680 wrote to memory of 3748	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	99
PID 3680 wrote to memory of 3748	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	99
PID 3680 wrote to memory of 3748	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	99
PID 3680 wrote to memory of 3188	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	100
PID 3680 wrote to memory of 3188	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	100
PID 3680 wrote to memory of 3188	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	100
PID 3680 wrote to memory of 3024	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	101
PID 3680 wrote to memory of 3024	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	101
PID 3680 wrote to memory of 3024	3680	656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe	101
PID 3748 wrote to memory of 864	3748	DD8989123MD.exe	104
PID 3748 wrote to memory of 864	3748	DD8989123MD.exe	104
PID 3748 wrote to memory of 864	3748	DD8989123MD.exe	104
PID 3024 wrote to memory of 4952	3024	LunaInjector.exe	105
PID 3024 wrote to memory of 4952	3024	LunaInjector.exe	105
PID 3188 wrote to memory of 2620	3188	K8MN9DA.exe	107
PID 3188 wrote to memory of 2620	3188	K8MN9DA.exe	107
PID 3188 wrote to memory of 2620	3188	K8MN9DA.exe	107
PID 864 wrote to memory of 1516	864	cmd.exe	109
PID 864 wrote to memory of 1516	864	cmd.exe	109
PID 864 wrote to memory of 1516	864	cmd.exe	109
PID 2620 wrote to memory of 3100	2620	cmd.exe	110
PID 2620 wrote to memory of 3100	2620	cmd.exe	110
PID 2620 wrote to memory of 3100	2620	cmd.exe	110
PID 4952 wrote to memory of 3224	4952	cmd.exe	111
PID 4952 wrote to memory of 3224	4952	cmd.exe	111
PID 4952 wrote to memory of 116	4952	cmd.exe	112
PID 4952 wrote to memory of 116	4952	cmd.exe	112
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3188 wrote to memory of 4168	3188	K8MN9DA.exe	113
PID 3748 wrote to memory of 4188	3748	DD8989123MD.exe	115
PID 3748 wrote to memory of 4188	3748	DD8989123MD.exe	115
PID 3748 wrote to memory of 4188	3748	DD8989123MD.exe	115
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 3748 wrote to memory of 1848	3748	DD8989123MD.exe	116
PID 4168 wrote to memory of 724	4168	K8MN9DA.exe	122

C:\Users\Admin\AppData\Local\Temp\656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4780
- C:\Users\Admin\AppData\Local\Temp\656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\656725f09aa6a07f41fef88b362ad8b9_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
    "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
      "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
      4⤵
      Executes dropped EXE
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
      "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1908
        6⤵
        Program crash
        
        PID:1420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1488
      4⤵
      Program crash
      PID:2268
- - C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
    "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
      "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"' & exit
        5⤵
        
        PID:724
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4604
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB277.tmp.bat""
        5⤵
        
        PID:3032
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout 1
        7⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        Delays execution with timeout.exe
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 1464
        7⤵
        Program crash
        
        PID:2808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 1424
      4⤵
      Program crash
      PID:3844
- - C:\Users\Admin\AppData\Roaming\LunaInjector.exe
    "C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9DC6.tmp\9DC7.tmp\9DC8.bat C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3224
    - - C:\Windows\system32\mode.com
        
        mode 82,24
        5⤵
        
        PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 2236
  2⤵
  - Program crash
  PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1100 -ip 1100
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3188 -ip 3188
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3748 -ip 3748
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1892 -ip 1892
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4876 -ip 4876
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion