stealc | hxxps://www[.]owertechnology[.]com/wp-content/uploads/2024/arch844_2[.]7z

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	Noticed.pif

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3908 created 612	3908	pErEU2ZJoS9i9o5A9kThFgHw.exe	5
PID 4100 created 3536	4100	InformationCheck.exe	56

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
127	852	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4300	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWInst.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	File.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Noticed.pif
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	File.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	1mtPsVqndcoLSWc0uXigBBZc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	File.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	File.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	File.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	LKMService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	File.exe

Drops startup file 29 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_56db0bcceca34f208625f94714dfb202.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6d6b8e196ec44ee3a3f59cef47766645.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5b0c5f7aead348f4bda2c21e2e99e382.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a5f48070a63c4b87b5c52df052dbbe0f.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9ebea2e53c714d7090a1eec70b4e648a.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_60756602ea3b42c0a47c3c470ce3ee79.lnk	1mtPsVqndcoLSWc0uXigBBZc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk	ywvmdkic_dFmXqWQ1hSQAKfH.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ea36c084b13445a49a61654e022c232e.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7f6695da1db843759353dcfa2eb4a6cc.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9eabb08ebc3847d181f44facd09bd3c5.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b5e89387c6874c1faf6b0f106122913c.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1be6941c69514d0ba9cdeb6296dbbb10.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f17553848296437995a3ea6e546e0fec.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8e5b487d8b614999bd49999e29584458.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7aa4329fb3c84d5eaa07c2294d1461bf.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bffb277684c2426d961cc447d5563936.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_eb1a01578ee64bb0a3f3aeeef429d3f8.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6d1ae919e9c14915ae896fa10c717461.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_99aceffb64e345fcb5cb33133f3a1677.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b25549b5970e4f228d7761a798eb85ae.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bfb22a841c4f4bdead63bdd1234127a3.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6409c2a6a5c646c282e6d11e29110dab.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8caa4ff9ffa34ac7a8b1e8d15d2aa367.lnk	LKMService.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_030280a8973d40c99d2fa446a37aa29c.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5cc1b582260a479b8e5001692b052bd5.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6fd03d2b14234e65af64e9b800cf3826.lnk	LKMService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9f0aa920e34e443b91665950530decad.lnk	LKMService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 41 IoCs

pid	Process
3512	7z2408-x64.exe
4496	7zG.exe
1840	7zFM.exe
908	7zG.exe
5032	File.exe
3208	Noticed.pif
1232	File.exe
2592	File.exe
2288	Noticed.pif
4228	Noticed.pif
4672	File.exe
1604	Noticed.pif
2028	Noticed.pif
4296	Noticed.pif
2664	Noticed.pif
1184	Noticed.pif
4736	Noticed.pif
2272	File.exe
3036	YqxoDYfiRPSlHt_NEavFaoFc.exe
3948	1mtPsVqndcoLSWc0uXigBBZc.exe
2036	V2DgwL47y5_XQikmsVcmB5FP.exe
4448	UTtY4zThhn_6H1MFsQ9XSMHq.exe
3600	36su93P_EoTU8z5vYw81KGTv.exe
1688	w1BAGfi6tQ001_qNXLqklR_G.exe
3728	nXYEXP3PzI5VUpVCLiF96Wes.exe
4456	woDPonJzmxgTyH5LfaQDivq0.exe
3908	pErEU2ZJoS9i9o5A9kThFgHw.exe
3244	ywvmdkic_dFmXqWQ1hSQAKfH.exe
3444	UTtY4zThhn_6H1MFsQ9XSMHq.tmp
212	pErEU2ZJoS9i9o5A9kThFgHw.exe
1680	jennyvideoconverter32_64.exe
5108	LKMService.exe
3484	File.exe
1124	GoogleUpdater.exe
1716	RDPWInst.exe
4100	InformationCheck.exe
1712	AdminIIEHJKJJJE.exe
1192	Noticed.pif
4536	hutopimmbtzg.exe
4500	JKEBFBFIEH.exe
1728	File.exe

Loads dropped DLL 10 IoCs

pid	Process
3536	Explorer.EXE
4496	7zG.exe
1840	7zFM.exe
908	7zG.exe
3444	UTtY4zThhn_6H1MFsQ9XSMHq.tmp
4572	svchost.exe
856	MSBuild.exe
856	MSBuild.exe
2548	MSBuild.exe
2548	MSBuild.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LKMService_caa98eac48c74681bcdad06998181537 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EdgeUpdater\\LKMService.exe"	1mtPsVqndcoLSWc0uXigBBZc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LKMService_abd5b851f802417398174a788479c8f6 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EdgeUpdater\\GoogleUpdater.exe"	LKMService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV6 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV6\\ExtreamFanV6.exe"	ywvmdkic_dFmXqWQ1hSQAKfH.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
110	iplogger.org
111	iplogger.org

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
86	api64.ipify.org
87	api64.ipify.org
88	ipinfo.io
89	ipinfo.io
126	api.ipify.org

Modifies WinLogon 2 TTPs 1 IoCs

Winlogon Helper DLL

T1547.004

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence privilege_escalation

Power Settings

T1653

pid	Process
2028	powercfg.exe
4228	powercfg.exe
3720	powercfg.exe
3596	powercfg.exe
4880	powercfg.exe
4964	powercfg.exe
2920	powercfg.exe
2392	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000023e61-1697.dat	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	Noticed.pif
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Noticed.pif
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Noticed.pif
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Noticed.pif
File created	C:\Windows\System32\rfxvmt.dll	RDPWInst.exe

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
4092	tasklist.exe
4376	tasklist.exe
2828	tasklist.exe
956	tasklist.exe
712	tasklist.exe
2272	tasklist.exe
3704	tasklist.exe
4516	tasklist.exe
1912	tasklist.exe
2000	tasklist.exe
5048	tasklist.exe
852	tasklist.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 3208 set thread context of 2028	3208	Noticed.pif	162
PID 2288 set thread context of 2664	2288	Noticed.pif	168
PID 4228 set thread context of 1184	4228	Noticed.pif	169
PID 1604 set thread context of 4736	1604	Noticed.pif	170
PID 3600 set thread context of 2548	3600	36su93P_EoTU8z5vYw81KGTv.exe	185
PID 4456 set thread context of 856	4456	woDPonJzmxgTyH5LfaQDivq0.exe	186
PID 1688 set thread context of 1096	1688	w1BAGfi6tQ001_qNXLqklR_G.exe	195
PID 1712 set thread context of 2176	1712	AdminIIEHJKJJJE.exe	236
PID 4536 set thread context of 2392	4536	hutopimmbtzg.exe	269
PID 4536 set thread context of 4000	4536	hutopimmbtzg.exe	272
PID 4500 set thread context of 4964	4500	JKEBFBFIEH.exe	276

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2408-x64.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\CertificateFeat	File.exe
File opened for modification	C:\Windows\PocketDraft	File.exe
File opened for modification	C:\Windows\WatchCpu	File.exe
File opened for modification	C:\Windows\CertificateFeat	File.exe
File opened for modification	C:\Windows\WatchCpu	File.exe
File opened for modification	C:\Windows\CertificateFeat	File.exe
File opened for modification	C:\Windows\WatchCpu	File.exe
File opened for modification	C:\Windows\PocketDraft	File.exe
File opened for modification	C:\Windows\CertificateFeat	File.exe
File opened for modification	C:\Windows\PocketDraft	File.exe
File opened for modification	C:\Windows\WatchCpu	File.exe
File opened for modification	C:\Windows\WatchCpu	File.exe
File opened for modification	C:\Windows\CertificateFeat	File.exe
File opened for modification	C:\Windows\PocketDraft	File.exe
File opened for modification	C:\Windows\WatchCpu	File.exe
File opened for modification	C:\Windows\PocketDraft	File.exe
File opened for modification	C:\Windows\PocketDraft	File.exe
File opened for modification	C:\Windows\PocketDraft	File.exe
File opened for modification	C:\Windows\CertificateFeat	File.exe
File opened for modification	C:\Windows\WatchCpu	File.exe
File opened for modification	C:\Windows\CertificateFeat	File.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2812	sc.exe
3604	sc.exe
4672	sc.exe
3764	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
852	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2692	1688	WerFault.exe	177
3212	3600	WerFault.exe	176
1552	4456	WerFault.exe	183
2604	1712	WerFault.exe	234
4052	4500	WerFault.exe	275

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTtY4zThhn_6H1MFsQ9XSMHq.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noticed.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noticed.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w1BAGfi6tQ001_qNXLqklR_G.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTtY4zThhn_6H1MFsQ9XSMHq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	woDPonJzmxgTyH5LfaQDivq0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noticed.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	File.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LKMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	File.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noticed.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JKEBFBFIEH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YqxoDYfiRPSlHt_NEavFaoFc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noticed.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywvmdkic_dFmXqWQ1hSQAKfH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	File.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jennyvideoconverter32_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noticed.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	File.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4628	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2356	schtasks.exe
1856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1940	chrome.exe
1940	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
3208	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
2548	MSBuild.exe
2548	MSBuild.exe
3908	pErEU2ZJoS9i9o5A9kThFgHw.exe
3908	pErEU2ZJoS9i9o5A9kThFgHw.exe
3444	UTtY4zThhn_6H1MFsQ9XSMHq.tmp
3444	UTtY4zThhn_6H1MFsQ9XSMHq.tmp
852	powershell.exe
852	powershell.exe
5108	LKMService.exe
5108	LKMService.exe
3728	nXYEXP3PzI5VUpVCLiF96Wes.exe
3728	nXYEXP3PzI5VUpVCLiF96Wes.exe
852	powershell.exe
856	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2692	OpenWith.exe
1840	7zFM.exe
2176	OpenWith.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe
Token: SeShutdownPrivilege	1940	chrome.exe
Token: SeCreatePagefilePrivilege	1940	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
1940	chrome.exe
3208	Noticed.pif
3208	Noticed.pif
3208	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
2288	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
4228	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
1604	Noticed.pif
2036	V2DgwL47y5_XQikmsVcmB5FP.exe
2036	V2DgwL47y5_XQikmsVcmB5FP.exe
2036	V2DgwL47y5_XQikmsVcmB5FP.exe
4100	InformationCheck.exe
4100	InformationCheck.exe
4100	InformationCheck.exe
1192	Noticed.pif
1192	Noticed.pif
1192	Noticed.pif

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2692	OpenWith.exe
3512	7z2408-x64.exe
1768	OpenWith.exe
2176	OpenWith.exe
536	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 464	1940	chrome.exe	83
PID 1940 wrote to memory of 464	1940	chrome.exe	83
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 2796	1940	chrome.exe	84
PID 1940 wrote to memory of 1580	1940	chrome.exe	85
PID 1940 wrote to memory of 1580	1940	chrome.exe	85
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86
PID 1940 wrote to memory of 4816	1940	chrome.exe	86

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Users\Admin\Documents\iofolko5\pErEU2ZJoS9i9o5A9kThFgHw.exe
  C:\Users\Admin\Documents\iofolko5\pErEU2ZJoS9i9o5A9kThFgHw.exe
  2⤵
  - Executes dropped EXE
  PID:212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.owertechnology.com/wp-content/uploads/2024/arch844_2.7z
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6e0bcc40,0x7ffb6e0bcc4c,0x7ffb6e0bcc58
    3⤵
    PID:464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2064,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    PID:1580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2364 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:1728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4792,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4820 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4544,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3700 /prefetch:8
    3⤵
    PID:2504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5264,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5388,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5344,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5536,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    PID:540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5796,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5788,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5964,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6004,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:2924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5248,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:4288
- - C:\Users\Admin\Downloads\7z2408-x64.exe
    "C:\Users\Admin\Downloads\7z2408-x64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3220,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3732,i,1037860547700160264,17561037698693721134,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:3
    3⤵
    PID:3040
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\arch844_2\" -spe -an -ai#7zMap1060:78:7zEvent9508
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4496
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\arch844_2\arch844.7z"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1840
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\arch844_2\" -an -ai#7zMap19276:94:7zEvent4748
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:908
- C:\Users\Admin\Downloads\arch844_2\File.exe
  "C:\Users\Admin\Downloads\arch844_2\File.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Mia Mia.bat & Mia.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5080
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:956
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1180
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:712
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 645803
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "RedheadLargeAttachedNasa" Smith
      4⤵
      System Location Discovery: System Language Discovery
      PID:508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Incident + ..\Their + ..\Integrity + ..\Respectively + ..\Hollow + ..\Arrest + ..\Opinions + ..\Refused + ..\Check + ..\Self + ..\Handbags + ..\Petite + ..\Unsubscribe + ..\Crops + ..\Writer + ..\Senators + ..\Cited + ..\Workers + ..\Modify + ..\Exhibition + ..\Deer + ..\Database + ..\Heating + ..\Uploaded + ..\Zimbabwe + ..\Very + ..\Split a
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
      Noticed.pif a
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        
        C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        5⤵
        Modifies firewall policy service
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2028
      - C:\Users\Admin\Documents\iofolko5\YqxoDYfiRPSlHt_NEavFaoFc.exe
        
        C:\Users\Admin\Documents\iofolko5\YqxoDYfiRPSlHt_NEavFaoFc.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
        
        C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe -i
        8⤵
        Server Software Component: Terminal Services DLL
        Executes dropped EXE
        Modifies WinLogon
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:1716
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        9⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4300
      - C:\Users\Admin\Documents\iofolko5\1mtPsVqndcoLSWc0uXigBBZc.exe
        
        C:\Users\Admin\Documents\iofolko5\1mtPsVqndcoLSWc0uXigBBZc.exe
        6⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\LKMService.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
        7⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" --checker
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1124
      - C:\Users\Admin\Documents\iofolko5\36su93P_EoTU8z5vYw81KGTv.exe
        
        C:\Users\Admin\Documents\iofolko5\36su93P_EoTU8z5vYw81KGTv.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3600
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2548
        
        C:\ProgramData\JKEBFBFIEH.exe
        
        "C:\ProgramData\JKEBFBFIEH.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 256
        9⤵
        Program crash
        
        PID:4052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBAEHCAEGDHJ" & exit
        8⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        9⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 268
        7⤵
        Program crash
        
        PID:3212
      - C:\Users\Admin\Documents\iofolko5\w1BAGfi6tQ001_qNXLqklR_G.exe
        
        C:\Users\Admin\Documents\iofolko5\w1BAGfi6tQ001_qNXLqklR_G.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:4444
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:3492
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:1776
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:3512
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 284
        7⤵
        Program crash
        
        PID:2692
      - C:\Users\Admin\Documents\iofolko5\pErEU2ZJoS9i9o5A9kThFgHw.exe
        
        C:\Users\Admin\Documents\iofolko5\pErEU2ZJoS9i9o5A9kThFgHw.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3908
      - C:\Users\Admin\Documents\iofolko5\nXYEXP3PzI5VUpVCLiF96Wes.exe
        
        C:\Users\Admin\Documents\iofolko5\nXYEXP3PzI5VUpVCLiF96Wes.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3728
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        
        PID:2920
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        
        PID:2392
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        
        PID:2028
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        
        PID:4228
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "QTXSWVVV"
        7⤵
        Launches sc.exe
        
        PID:3764
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "QTXSWVVV" binpath= "C:\ProgramData\aevrrerqmhcb\hutopimmbtzg.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:2812
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:4672
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "QTXSWVVV"
        7⤵
        Launches sc.exe
        
        PID:3604
      - C:\Users\Admin\Documents\iofolko5\UTtY4zThhn_6H1MFsQ9XSMHq.exe
        
        C:\Users\Admin\Documents\iofolko5\UTtY4zThhn_6H1MFsQ9XSMHq.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\is-MFSQ1.tmp\UTtY4zThhn_6H1MFsQ9XSMHq.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MFSQ1.tmp\UTtY4zThhn_6H1MFsQ9XSMHq.tmp" /SL5="$A02C2,4220745,54272,C:\Users\Admin\Documents\iofolko5\UTtY4zThhn_6H1MFsQ9XSMHq.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Jenny Video Converter\jennyvideoconverter32_64.exe
        
        "C:\Users\Admin\AppData\Local\Jenny Video Converter\jennyvideoconverter32_64.exe" -i
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1680
      - C:\Users\Admin\Documents\iofolko5\V2DgwL47y5_XQikmsVcmB5FP.exe
        
        C:\Users\Admin\Documents\iofolko5\V2DgwL47y5_XQikmsVcmB5FP.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SendNotifyMessage
        
        PID:2036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:852
        
        C:\Users\Public\InformationCheck.exe
        
        "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3
        8⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SendNotifyMessage
        
        PID:4100
      - C:\Users\Admin\Documents\iofolko5\ywvmdkic_dFmXqWQ1hSQAKfH.exe
        
        C:\Users\Admin\Documents\iofolko5\ywvmdkic_dFmXqWQ1hSQAKfH.exe
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2356
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1856
      - C:\Users\Admin\Documents\iofolko5\woDPonJzmxgTyH5LfaQDivq0.exe
        
        C:\Users\Admin\Documents\iofolko5\woDPonJzmxgTyH5LfaQDivq0.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIIEHJKJJJE.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
        
        C:\Users\AdminIIEHJKJJJE.exe
        
        "C:\Users\AdminIIEHJKJJJE.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1712
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        10⤵
        
        PID:4052
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 288
        10⤵
        Program crash
        
        PID:2604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 268
        7⤵
        Program crash
        
        PID:1552
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:3216
- C:\Users\Admin\Downloads\arch844_2\File.exe
  "C:\Users\Admin\Downloads\arch844_2\File.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Mia Mia.bat & Mia.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:2272
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4092
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 645803
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Incident + ..\Their + ..\Integrity + ..\Respectively + ..\Hollow + ..\Arrest + ..\Opinions + ..\Refused + ..\Check + ..\Self + ..\Handbags + ..\Petite + ..\Unsubscribe + ..\Crops + ..\Writer + ..\Senators + ..\Cited + ..\Workers + ..\Modify + ..\Exhibition + ..\Deer + ..\Database + ..\Heating + ..\Uploaded + ..\Zimbabwe + ..\Very + ..\Split a
      4⤵
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
      Noticed.pif a
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        
        C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        5⤵
        Executes dropped EXE
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        
        C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2664
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:4448
- C:\Users\Admin\Downloads\arch844_2\File.exe
  "C:\Users\Admin\Downloads\arch844_2\File.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Mia Mia.bat & Mia.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5036
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3704
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:4516
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 645803
      4⤵
      PID:4692
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Incident + ..\Their + ..\Integrity + ..\Respectively + ..\Hollow + ..\Arrest + ..\Opinions + ..\Refused + ..\Check + ..\Self + ..\Handbags + ..\Petite + ..\Unsubscribe + ..\Crops + ..\Writer + ..\Senators + ..\Cited + ..\Workers + ..\Modify + ..\Exhibition + ..\Deer + ..\Database + ..\Heating + ..\Uploaded + ..\Zimbabwe + ..\Very + ..\Split a
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
      Noticed.pif a
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        
        C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        5⤵
        Executes dropped EXE
        
        PID:1184
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:3244
- C:\Users\Admin\Downloads\arch844_2\File.exe
  "C:\Users\Admin\Downloads\arch844_2\File.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Mia Mia.bat & Mia.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4060
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:4376
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      PID:4872
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 645803
      4⤵
      System Location Discovery: System Language Discovery
      PID:4676
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Incident + ..\Their + ..\Integrity + ..\Respectively + ..\Hollow + ..\Arrest + ..\Opinions + ..\Refused + ..\Check + ..\Self + ..\Handbags + ..\Petite + ..\Unsubscribe + ..\Crops + ..\Writer + ..\Senators + ..\Cited + ..\Workers + ..\Modify + ..\Exhibition + ..\Deer + ..\Database + ..\Heating + ..\Uploaded + ..\Zimbabwe + ..\Very + ..\Split a
      4⤵
      System Location Discovery: System Language Discovery
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
      Noticed.pif a
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        
        C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
        5⤵
        Executes dropped EXE
        
        PID:4736
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:4656
- C:\Users\Admin\Downloads\arch844_2\File.exe
  "C:\Users\Admin\Downloads\arch844_2\File.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Mia Mia.bat & Mia.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:5048
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:852
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      PID:4204
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 645803
      4⤵
      System Location Discovery: System Language Discovery
      PID:1844
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Incident + ..\Their + ..\Integrity + ..\Respectively + ..\Hollow + ..\Arrest + ..\Opinions + ..\Refused + ..\Check + ..\Self + ..\Handbags + ..\Petite + ..\Unsubscribe + ..\Crops + ..\Writer + ..\Senators + ..\Cited + ..\Workers + ..\Modify + ..\Exhibition + ..\Deer + ..\Database + ..\Heating + ..\Uploaded + ..\Zimbabwe + ..\Very + ..\Split a
      4⤵
      PID:2176
- C:\Users\Admin\Downloads\arch844_2\File.exe
  "C:\Users\Admin\Downloads\arch844_2\File.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Mia Mia.bat & Mia.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4400
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:2000
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2828
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3720
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 645803
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "RedheadLargeAttachedNasa" Smith
      4⤵
      System Location Discovery: System Language Discovery
      PID:1116
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Incident + ..\Their + ..\Integrity + ..\Respectively + ..\Hollow + ..\Arrest + ..\Opinions + ..\Refused + ..\Check + ..\Self + ..\Handbags + ..\Petite + ..\Unsubscribe + ..\Crops + ..\Writer + ..\Senators + ..\Cited + ..\Workers + ..\Modify + ..\Exhibition + ..\Deer + ..\Database + ..\Heating + ..\Uploaded + ..\Zimbabwe + ..\Very + ..\Split a
      4⤵
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\645803\Noticed.pif
      Noticed.pif a
      4⤵
      Executes dropped EXE
      Suspicious use of SendNotifyMessage
      PID:1192
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Users\Admin\Downloads\arch844_2\File.exe
  "C:\Users\Admin\Downloads\arch844_2\File.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Mia Mia.bat & Mia.bat
    3⤵
    PID:800

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1688 -ip 1688
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4456 -ip 4456
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3600 -ip 3600
1⤵
PID:3920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:4516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1712 -ip 1712
1⤵
PID:1128

C:\ProgramData\aevrrerqmhcb\hutopimmbtzg.exe
C:\ProgramData\aevrrerqmhcb\hutopimmbtzg.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4536
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:4964
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4880
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3596
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:3720
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2392
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4500 -ip 4500
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery