dcrat | 0043be0527169c370619ab57df3eefb66f7742e90449cfc952489d70fdbca59a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\comdll\\taskhostw.exe\", \"C:\\comdll\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\comdll\\explorer.exe\", \"C:\\comdll\\reviewdll.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\comdll\\taskhostw.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\comdll\\taskhostw.exe\", \"C:\\comdll\\RuntimeBroker.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\comdll\\taskhostw.exe\", \"C:\\comdll\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\comdll\\taskhostw.exe\", \"C:\\comdll\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\comdll\\explorer.exe\""	reviewdll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	2900	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2900	schtasks.exe	89

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1912	powershell.exe
1616	powershell.exe
4992	powershell.exe
3576	powershell.exe
3632	powershell.exe
620	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	reviewdll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	PizDec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	PizDec.exe

Executes dropped EXE 18 IoCs

pid	Process
3048	reviewdll.exe
1040	explorer.exe
4660	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
3920	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
2780	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
4640	TextInputHost.exe
912	fontdrvhost.exe
2372	PizDec.exe
3408	PizDec.exe
2252	hitler.exe
3840	explorer.exe
1108	RuntimeBroker.exe
4376	TextInputHost.exe
2932	taskhostw.exe
604	reviewdll.exe
2216	RuntimeBroker.exe
3496	fontdrvhost.exe
4052	explorer.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\comdll\\taskhostw.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\comdll\\taskhostw.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\comdll\\explorer.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reviewdll = "\"C:\\comdll\\reviewdll.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\comdll\\RuntimeBroker.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\comdll\\RuntimeBroker.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\comdll\\explorer.exe\""	reviewdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reviewdll = "\"C:\\comdll\\reviewdll.exe\""	reviewdll.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\B:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\P:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\B:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\L:	WScript.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC6A04DB9DA085495782368D16836D15EF.TMP	csc.exe
File created	\??\c:\Windows\System32\lhkpi-.exe	csc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0004000000000715-377.dat	upx
behavioral1/memory/2372-380-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2372-397-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/3408-412-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	explorer.exe
File opened for modification	C:\Program Files (x86)\PizDec.exe	explorer.exe
File opened for modification	C:\Program Files (x86)\hitler.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PizDec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PizDec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4812	PING.EXE

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{CE5612B5-900C-4AD1-905A-69013034DF77}	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	reviewdll.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{1D6055CE-D4CC-446D-9BE4-42AB4E055F1F}	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{150BC821-E837-4CC9-8905-D52594174499}	WScript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{152DBF79-2FCF-45EF-9A56-41ED8A9E8047}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{3EE0C4CA-5B13-4582-BA07-B45DED613031}	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{CE10F599-C4D6-4DD6-BA2A-FF6920755AA6}	WScript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
2272	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1440	Notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4812	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
408	schtasks.exe
1732	schtasks.exe
4564	schtasks.exe
4820	schtasks.exe
2904	schtasks.exe
2340	schtasks.exe
4288	schtasks.exe
4468	schtasks.exe
2192	schtasks.exe
672	schtasks.exe
2692	schtasks.exe
3620	schtasks.exe
4740	schtasks.exe
2712	schtasks.exe
4136	schtasks.exe
1588	schtasks.exe
2504	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe
3048	reviewdll.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1040	explorer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	taskmgr.exe
Token: SeSystemProfilePrivilege	2032	taskmgr.exe
Token: SeCreateGlobalPrivilege	2032	taskmgr.exe
Token: SeDebugPrivilege	3048	reviewdll.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: 33	2032	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2032	taskmgr.exe
Token: SeDebugPrivilege	1040	explorer.exe
Token: SeShutdownPrivilege	3228	WScript.exe
Token: SeCreatePagefilePrivilege	3228	WScript.exe
Token: 33	5060	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5060	AUDIODG.EXE
Token: SeShutdownPrivilege	3228	WScript.exe
Token: SeCreatePagefilePrivilege	3228	WScript.exe
Token: SeShutdownPrivilege	4720	WScript.exe
Token: SeCreatePagefilePrivilege	4720	WScript.exe
Token: SeShutdownPrivilege	4720	WScript.exe
Token: SeCreatePagefilePrivilege	4720	WScript.exe
Token: SeShutdownPrivilege	4312	WScript.exe
Token: SeCreatePagefilePrivilege	4312	WScript.exe
Token: SeShutdownPrivilege	4312	WScript.exe
Token: SeCreatePagefilePrivilege	4312	WScript.exe
Token: SeDebugPrivilege	4640	TextInputHost.exe
Token: SeDebugPrivilege	912	fontdrvhost.exe
Token: SeShutdownPrivilege	1292	WScript.exe
Token: SeCreatePagefilePrivilege	1292	WScript.exe
Token: SeShutdownPrivilege	1292	WScript.exe
Token: SeCreatePagefilePrivilege	1292	WScript.exe
Token: SeShutdownPrivilege	2460	WScript.exe
Token: SeCreatePagefilePrivilege	2460	WScript.exe
Token: SeShutdownPrivilege	2460	WScript.exe
Token: SeCreatePagefilePrivilege	2460	WScript.exe
Token: SeDebugPrivilege	3840	explorer.exe
Token: SeDebugPrivilege	1108	RuntimeBroker.exe
Token: SeDebugPrivilege	4376	TextInputHost.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeDebugPrivilege	2216	RuntimeBroker.exe
Token: SeDebugPrivilege	4052	explorer.exe
Token: SeDebugPrivilege	2932	taskhostw.exe
Token: SeDebugPrivilege	3496	fontdrvhost.exe
Token: SeDebugPrivilege	604	reviewdll.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe
Token: SeCreatePagefilePrivilege	4560	explorer.exe
Token: SeShutdownPrivilege	4560	explorer.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
2032	taskmgr.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1040	explorer.exe
2960	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 5048	3176	DCRatBuild.exe	84
PID 3176 wrote to memory of 5048	3176	DCRatBuild.exe	84
PID 3176 wrote to memory of 5048	3176	DCRatBuild.exe	84
PID 5048 wrote to memory of 1544	5048	WScript.exe	85
PID 5048 wrote to memory of 1544	5048	WScript.exe	85
PID 5048 wrote to memory of 1544	5048	WScript.exe	85
PID 1544 wrote to memory of 2272	1544	cmd.exe	87
PID 1544 wrote to memory of 2272	1544	cmd.exe	87
PID 1544 wrote to memory of 2272	1544	cmd.exe	87
PID 1544 wrote to memory of 3048	1544	cmd.exe	88
PID 1544 wrote to memory of 3048	1544	cmd.exe	88
PID 3048 wrote to memory of 1420	3048	reviewdll.exe	93
PID 3048 wrote to memory of 1420	3048	reviewdll.exe	93
PID 1420 wrote to memory of 3348	1420	csc.exe	95
PID 1420 wrote to memory of 3348	1420	csc.exe	95
PID 3048 wrote to memory of 620	3048	reviewdll.exe	111
PID 3048 wrote to memory of 620	3048	reviewdll.exe	111
PID 3048 wrote to memory of 3632	3048	reviewdll.exe	112
PID 3048 wrote to memory of 3632	3048	reviewdll.exe	112
PID 3048 wrote to memory of 3576	3048	reviewdll.exe	113
PID 3048 wrote to memory of 3576	3048	reviewdll.exe	113
PID 3048 wrote to memory of 4992	3048	reviewdll.exe	114
PID 3048 wrote to memory of 4992	3048	reviewdll.exe	114
PID 3048 wrote to memory of 1616	3048	reviewdll.exe	115
PID 3048 wrote to memory of 1616	3048	reviewdll.exe	115
PID 3048 wrote to memory of 1912	3048	reviewdll.exe	116
PID 3048 wrote to memory of 1912	3048	reviewdll.exe	116
PID 3048 wrote to memory of 3556	3048	reviewdll.exe	123
PID 3048 wrote to memory of 3556	3048	reviewdll.exe	123
PID 3556 wrote to memory of 4468	3556	cmd.exe	125
PID 3556 wrote to memory of 4468	3556	cmd.exe	125
PID 3556 wrote to memory of 4812	3556	cmd.exe	126
PID 3556 wrote to memory of 4812	3556	cmd.exe	126
PID 3556 wrote to memory of 1040	3556	cmd.exe	131
PID 3556 wrote to memory of 1040	3556	cmd.exe	131
PID 1040 wrote to memory of 4660	1040	explorer.exe	145
PID 1040 wrote to memory of 4660	1040	explorer.exe	145
PID 1040 wrote to memory of 4660	1040	explorer.exe	145
PID 4660 wrote to memory of 3228	4660	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	146
PID 4660 wrote to memory of 3228	4660	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	146
PID 4660 wrote to memory of 3228	4660	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	146
PID 3920 wrote to memory of 4720	3920	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	152
PID 3920 wrote to memory of 4720	3920	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	152
PID 3920 wrote to memory of 4720	3920	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	152
PID 2780 wrote to memory of 4312	2780	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	154
PID 2780 wrote to memory of 4312	2780	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	154
PID 2780 wrote to memory of 4312	2780	MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe	154
PID 1040 wrote to memory of 2372	1040	explorer.exe	159
PID 1040 wrote to memory of 2372	1040	explorer.exe	159
PID 1040 wrote to memory of 2372	1040	explorer.exe	159
PID 2372 wrote to memory of 4944	2372	PizDec.exe	160
PID 2372 wrote to memory of 4944	2372	PizDec.exe	160
PID 4944 wrote to memory of 1292	4944	cmd.exe	162
PID 4944 wrote to memory of 1292	4944	cmd.exe	162
PID 3408 wrote to memory of 1628	3408	PizDec.exe	164
PID 3408 wrote to memory of 1628	3408	PizDec.exe	164
PID 1628 wrote to memory of 2460	1628	cmd.exe	166
PID 1628 wrote to memory of 2460	1628	cmd.exe	166
PID 1040 wrote to memory of 2252	1040	explorer.exe	167
PID 1040 wrote to memory of 2252	1040	explorer.exe	167
PID 1040 wrote to memory of 3840	1040	explorer.exe	168
PID 1040 wrote to memory of 3840	1040	explorer.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\comdll\4exWDwzwdGdIoLb6OOTKDeE5vKnmRp2hJNj7qr4y3yRCw2tu43CBSny6KK.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\comdll\4j9mXD4SFtpK7TbDoMbaMV7rHFTx27gv5loxd61ax9TZaUUhHC.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2272
  - - C:\comdll\reviewdll.exe
      "C:\comdll/reviewdll.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rld2evzg\rld2evzg.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C21.tmp" "c:\Windows\System32\CSC6A04DB9DA085495782368D16836D15EF.TMP"
        6⤵
        
        PID:3348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comdll\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comdll\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comdll\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comdll\reviewdll.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zRGIN2XwAY.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3556
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4468
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4812
      - C:\comdll\explorer.exe
        
        "C:\comdll\explorer.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Program Files (x86)\MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
        
        "C:\Program Files (x86)\MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\play.vbs"
        8⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
        
        C:\Program Files (x86)\PizDec.exe
        
        "C:\Program Files (x86)\PizDec.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3518.tmp\3519.tmp\351A.bat "C:\Program Files (x86)\PizDec.exe""
        8⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\6.VBS"
        9⤵
        Enumerates connected drives
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Program Files (x86)\hitler.exe
        
        "C:\Program Files (x86)\hitler.exe"
        7⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\comdll\explorer.exe
        
        "explorer.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3840

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\comdll\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\comdll\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\comdll\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\comdll\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\comdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\comdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\comdll\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\comdll\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\comdll\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewdllr" /sc MINUTE /mo 10 /tr "'C:\comdll\reviewdll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewdll" /sc ONLOGON /tr "'C:\comdll\reviewdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewdllr" /sc MINUTE /mo 11 /tr "'C:\comdll\reviewdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2164

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\WaitReceive.js
1⤵
- Opens file in notepad (likely ransom note)
PID:1440

C:\Program Files (x86)\MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
"C:\Program Files (x86)\MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\play.vbs"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4720

C:\Program Files (x86)\MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe
"C:\Program Files (x86)\MEGA_UKUPNIK_MINUS_USHI_by_LuckyKazya.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX2\play.vbs"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4312

C:\Recovery\WindowsRE\TextInputHost.exe
C:\Recovery\WindowsRE\TextInputHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Recovery\WindowsRE\fontdrvhost.exe
C:\Recovery\WindowsRE\fontdrvhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:912

C:\Program Files (x86)\PizDec.exe
"C:\Program Files (x86)\PizDec.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7A10.tmp\7A11.tmp\7A12.bat "C:\Program Files (x86)\PizDec.exe""
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\6.VBS"
    3⤵
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2460

C:\comdll\RuntimeBroker.exe
C:\comdll\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4560

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\comdll\taskhostw.exe
"C:\comdll\taskhostw.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\comdll\RuntimeBroker.exe
"C:\comdll\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\comdll\explorer.exe
"C:\comdll\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\comdll\reviewdll.exe
"C:\comdll\reviewdll.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:604

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2960

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1112

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:2012

C:\comdll\taskhostw.exe
"C:\comdll\taskhostw.exe"
1⤵
PID:2824

C:\comdll\RuntimeBroker.exe
"C:\comdll\RuntimeBroker.exe"
1⤵
PID:2164

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:4036

C:\comdll\explorer.exe
"C:\comdll\explorer.exe"
1⤵
PID:4720

C:\comdll\reviewdll.exe
"C:\comdll\reviewdll.exe"
1⤵
PID:3672

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2204

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3388

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2768

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:4424

C:\comdll\taskhostw.exe
"C:\comdll\taskhostw.exe"
1⤵
PID:3772

C:\comdll\RuntimeBroker.exe
"C:\comdll\RuntimeBroker.exe"
1⤵
PID:540

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:4188

C:\comdll\explorer.exe
"C:\comdll\explorer.exe"
1⤵
PID:2188

C:\comdll\reviewdll.exe
"C:\comdll\reviewdll.exe"
1⤵
PID:2348

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4192

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4704

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3196

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:992

C:\comdll\taskhostw.exe
"C:\comdll\taskhostw.exe"
1⤵
PID:2824

C:\comdll\RuntimeBroker.exe
"C:\comdll\RuntimeBroker.exe"
1⤵
PID:2612

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:1120

C:\comdll\explorer.exe
"C:\comdll\explorer.exe"
1⤵
PID:5056

C:\comdll\reviewdll.exe
"C:\comdll\reviewdll.exe"
1⤵
PID:3672

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4208

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4652

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:3244

C:\comdll\taskhostw.exe
"C:\comdll\taskhostw.exe"
1⤵
PID:2336

C:\comdll\RuntimeBroker.exe
"C:\comdll\RuntimeBroker.exe"
1⤵
PID:1496

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:728

C:\comdll\explorer.exe
"C:\comdll\explorer.exe"
1⤵
PID:852

C:\comdll\reviewdll.exe
"C:\comdll\reviewdll.exe"
1⤵
PID:2572

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5072

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3068

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4532

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:2948

C:\comdll\taskhostw.exe
"C:\comdll\taskhostw.exe"
1⤵
PID:788

C:\comdll\RuntimeBroker.exe
"C:\comdll\RuntimeBroker.exe"
1⤵
PID:4440

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:180

C:\comdll\explorer.exe
"C:\comdll\explorer.exe"
1⤵
PID:2288

C:\comdll\reviewdll.exe
"C:\comdll\reviewdll.exe"
1⤵
PID:4420

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2916

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1664

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:736

C:\Recovery\WindowsRE\TextInputHost.exe
"C:\Recovery\WindowsRE\TextInputHost.exe"
1⤵
PID:4112

C:\comdll\taskhostw.exe
"C:\comdll\taskhostw.exe"
1⤵
PID:4944

C:\comdll\RuntimeBroker.exe
"C:\comdll\RuntimeBroker.exe"
1⤵
PID:2276

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:1820

C:\comdll\explorer.exe
"C:\comdll\explorer.exe"
1⤵
PID:4108

C:\comdll\reviewdll.exe
"C:\comdll\reviewdll.exe"
1⤵
PID:2208

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2380

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery