asyncrat | 04869aaff400d7e78a3f5af6e7d4cf6ea110b3aa1a670d266e3c770602a42183

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
4508	LosslessScaling.exe
2612	RAR.exe
2500	dismhost.exe

Loads dropped DLL 20 IoCs

pid	Process
4508	LosslessScaling.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe
2500	dismhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
137	drive.google.com
138	drive.google.com

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 4560 set thread context of 3708	4560	powershell.exe	159
PID 4844 set thread context of 3652	4844	powershell.exe	160
PID 5524 set thread context of 5176	5524	powershell.exe	177
PID 4252 set thread context of 3556	4252	powershell.exe	181
PID 3296 set thread context of 6044	3296	powershell.exe	190
PID 5768 set thread context of 5576	5768	powershell.exe	193
PID 2776 set thread context of 4652	2776	powershell.exe	204
PID 2752 set thread context of 2396	2752	powershell.exe	207
PID 1628 set thread context of 2284	1628	powershell.exe	215
PID 5816 set thread context of 2856	5816	powershell.exe	219
PID 3604 set thread context of 2800	3604	powershell.exe	227
PID 5460 set thread context of 1180	5460	powershell.exe	230
PID 5844 set thread context of 2764	5844	powershell.exe	238
PID 2612 set thread context of 4744	2612	powershell.exe	241

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Lossless Scaling\zh-TW\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\ar\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\de\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\ko\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\bg\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\id\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\lt\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\zh-CN\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\Lan.vbs	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\Licenses.txt	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\Lossless.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe.config	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\ja\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\ro\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\tr\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\uk\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\config.ini	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\sr-Latn\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\cs\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\he\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\hr\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\pl\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\pt-PT\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\fa\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\fr\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\it\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\vi\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\pt-BR\LosslessScaling.resources.dll	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\Lossless Scaling.lnk	powershell.exe
File created	C:\Program Files (x86)\Lossless Scaling\es-ES\LosslessScaling.resources.dll	powershell.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\Servicing\Sessions\31167358_1448777167.xml	TiWorker.exe
File opened for modification	C:\Windows\CbsTemp\31167358_1719107393\	TiWorker.exe
File opened for modification	C:\Windows\Servicing\Sessions\Sessions.xml	TiWorker.exe
File opened for modification	C:\Windows\CbsTemp	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File created	C:\Windows\Servicing\Sessions\31167358_1448777167.xml	TiWorker.exe
File opened for modification	C:\Windows\Servicing\Sessions\Sessions.back.xml	TiWorker.exe
File opened for modification	C:\Windows\CbsTemp\31167358_1448777167\	TiWorker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004c18288cb6ffc1a30000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838014c18288c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050e1000000ffffffff000000000700010000e841014c18288c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea714c18288c00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004c18288c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000\Control Panel\Colors	LosslessScaling.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133862783245898927"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1886653772-2813795769-2221171443-1000_Classes\Local Settings	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5700	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4760	schtasks.exe
4880	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3708	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1288	chrome.exe
1288	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
2532	chrome.exe
1324	mspaint.exe
1324	mspaint.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
1800	powershell.exe
1800	powershell.exe
1800	powershell.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
1800	powershell.exe
4560	powershell.exe
4844	powershell.exe
4844	powershell.exe
4560	powershell.exe
4560	powershell.exe
4844	powershell.exe
3708	aspnet_compiler.exe
3708	aspnet_compiler.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
4508	LosslessScaling.exe
5524	powershell.exe
5524	powershell.exe
5524	powershell.exe
4252	powershell.exe
4252	powershell.exe
4252	powershell.exe
4252	powershell.exe
4252	powershell.exe
3296	powershell.exe
3296	powershell.exe
3296	powershell.exe
5768	powershell.exe
5768	powershell.exe
5768	powershell.exe
3296	powershell.exe
3296	powershell.exe
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
2752	powershell.exe
2752	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe
Token: SeShutdownPrivilege	1288	chrome.exe
Token: SeCreatePagefilePrivilege	1288	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe
1288	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1324	mspaint.exe
1324	mspaint.exe
1324	mspaint.exe
1324	mspaint.exe
4508	LosslessScaling.exe
3708	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3500	1288	chrome.exe	94
PID 1288 wrote to memory of 3500	1288	chrome.exe	94
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 4488	1288	chrome.exe	95
PID 1288 wrote to memory of 5796	1288	chrome.exe	96
PID 1288 wrote to memory of 5796	1288	chrome.exe	96
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97
PID 1288 wrote to memory of 5400	1288	chrome.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\lossless scaling.zip"
1⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffa76a0cc40,0x7ffa76a0cc4c,0x7ffa76a0cc58
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4528,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5184,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5172,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5216,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5048,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5220,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5304 /prefetch:2
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4468,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3216,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5304,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5920,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4432,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6020,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5944,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5528,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4464,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6128,i,16242124910735420935,1316723442205762121,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:460
- C:\Windows\system32\dashost.exe
  dashost.exe {a837a462-c462-4451-a6235261fd37ff7e}
  2⤵
  PID:5628

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\New folder\How to run the program.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New folder\install + Crack.bat" "
1⤵
PID:4896
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:4844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$b='"cG93ZXJzaGVsbCAtRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyAtRmlsZSBsYW5ndWFnZS93aW5feC5wczE="';Invoke-Expression([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b)))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File language/win_x.ps1
    3⤵
    - UAC bypass
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1800
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" ADD HKCU\SOFTWARE\Valve\Steam\Apps\993090 /v Installed /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5700
  - - C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe
      "C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4508
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /query /tn administrator
      4⤵
      PID:4748
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /query /tn Backup1
      4⤵
      PID:5676
  - - C:\Users\Public\IObitUnlocker\RAR.exe
      "C:\Users\Public\IObitUnlocker\RAR.exe" x -pahmad..123 -o+ C:\Users\Public\IObitUnlocker\EN.dll C:\Users\Public\IObitUnlocker\
      4⤵
      Executes dropped EXE
      PID:2612
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\IObitUnlocker\Loader.vbs"
      4⤵
      Checks computer location settings
      PID:2408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4844
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /query /tn administrator
        6⤵
        
        PID:4504
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn administrator /sc minute /mo 2 /tr C:\Users\Public\IObitUnlocker\Loader.vbs /rl HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4880
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\IObitUnlocker\Backup.vbs"
      4⤵
      Checks computer location settings
      PID:5136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4560
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3708
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /query /tn administrator
        6⤵
        
        PID:4760
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /query /tn Backup1
      4⤵
      PID:1140
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn administartor /SC minute /MO 2 /tr C:\Users\Public\IObitUnlocker\Loader.vbs /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4760
  - - C:\Windows\system32\Dism.exe
      "C:\Windows\system32\Dism.exe" /Online /Enable-Feature /FeatureName:NetFx3
      4⤵
      Drops file in Windows directory
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\180FFA35-ED37-4923-920A-612C24E18252\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\180FFA35-ED37-4923-920A-612C24E18252\dismhost.exe {93077BEC-192B-498C-88F7-21DA7DB2B8FC}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:2500

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\install + Crack.bat
1⤵
PID:5252

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4000
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1952

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\New folder\Registration (Crack)\Double-click, confirm to merge, done.reg"
1⤵
PID:1456

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:5524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5176
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:3812

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3556
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:5392

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:5676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6044
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:2648

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:3380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5576
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:2916

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:4576

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2396
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:3600

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  PID:1628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:1252

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:6140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  PID:5816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:5680

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  PID:3604
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:3380

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:3652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  PID:5460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1180
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:5492

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  PID:5844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:652

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\IObitUnlocker\Loader.vbs"
1⤵
- Checks computer location settings
PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  PID:2612
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery