badrabbit | hxxps://malwarewatch[.]org/

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 5 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x00030000000276be-889.dat	mimikatz

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 63 IoCs

pid	Process
3184	D08E.tmp
4460	GCYAoQow.exe
1884	LIAEAUYU.exe
5984	LIAEAUYU.exe
2316	LIAEAUYU.exe
3680	GCYAoQow.exe
5024	GCYAoQow.exe
2680	LIAEAUYU.exe
2448	[email protected]
396	GCYAoQow.exe
2776	LIAEAUYU.exe
1320	GCYAoQow.exe
4896	LIAEAUYU.exe
1976	[email protected]
2096	GCYAoQow.exe
3752	LIAEAUYU.exe
2176	LIAEAUYU.exe
772	GCYAoQow.exe
3508	[email protected]
6312	GCYAoQow.exe
6576	LIAEAUYU.exe
6644	LIAEAUYU.exe
6656	GCYAoQow.exe
6816	GCYAoQow.exe
7056	GCYAoQow.exe
7148	LIAEAUYU.exe
6180	LIAEAUYU.exe
1952	GCYAoQow.exe
5732	GCYAoQow.exe
6520	LIAEAUYU.exe
6792	LIAEAUYU.exe
6612	GCYAoQow.exe
5588	GCYAoQow.exe
3776	LIAEAUYU.exe
7304	GCYAoQow.exe
7328	GCYAoQow.exe
7368	LIAEAUYU.exe
7560	LIAEAUYU.exe
8100	GCYAoQow.exe
8132	GCYAoQow.exe
8140	LIAEAUYU.exe
4524	LIAEAUYU.exe
7712	LIAEAUYU.exe
7816	LIAEAUYU.exe
7760	GCYAoQow.exe
8052	GCYAoQow.exe
8472	GCYAoQow.exe
8540	LIAEAUYU.exe
8548	LIAEAUYU.exe
8588	GCYAoQow.exe
8968	LIAEAUYU.exe
8980	LIAEAUYU.exe
9020	GCYAoQow.exe
9060	GCYAoQow.exe
8888	LIAEAUYU.exe
9076	GCYAoQow.exe
8820	GCYAoQow.exe
8940	LIAEAUYU.exe
9016	LIAEAUYU.exe
9524	LIAEAUYU.exe
9544	GCYAoQow.exe
9600	GCYAoQow.exe
9624	LIAEAUYU.exe

Loads dropped DLL 1 IoCs

pid	Process
5236	rundll32.exe

Adds Run key to start application 2 TTPs 61 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LIAEAUYU.exe = "C:\\ProgramData\\mokgAowo\\LIAEAUYU.exe"	LIAEAUYU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GCYAoQow.exe = "C:\\Users\\Admin\\FYkocYwo\\GCYAoQow.exe"	GCYAoQow.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
203	raw.githubusercontent.com
204	raw.githubusercontent.com
202	raw.githubusercontent.com

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cYsi.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\sUki.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\ucoG.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\iMow.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\UUQy.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\mwIo.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\kAss.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\kAkU.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\kAss.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\MMYc.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\uAos.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\gwoM.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\ckEY.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\AokC.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\CkEG.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\oowA.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\mYkY.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\Gkou.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\YQwk.ico	GCYAoQow.exe
File created	C:\Windows\SysWOW64\SgIs.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\mYYm.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\KUEi.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\mwIo.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\cYsi.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\MoUY.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\koMm.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\UUQy.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\UEAG.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\YMcI.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\YYwS.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\YYwS.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\mYYm.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\gwoM.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\Ycwg.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\EkoW.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\wQQA.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\owMy.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\igQQ.ico	GCYAoQow.exe
File created	C:\Windows\SysWOW64\Ycwg.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\wMUe.ico	GCYAoQow.exe
File created	C:\Windows\SysWOW64\ucoG.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\Occa.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\kMwy.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\cMAC.ico	GCYAoQow.exe
File created	C:\Windows\SysWOW64\CkEG.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\SgIs.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\KUEi.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\qUIm.ico	GCYAoQow.exe
File created	C:\Windows\SysWOW64\MMYc.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\mYkY.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\kAkU.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\Occa.exe	GCYAoQow.exe
File created	C:\Windows\SysWOW64\YMcI.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\iMow.exe	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\OEUM.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\MgIw.ico	GCYAoQow.exe
File opened for modification	C:\Windows\SysWOW64\UEAG.exe	GCYAoQow.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\debug.log	chrome.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_1086724838\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_2125617502\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_687808939\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\es\messages.json	msedge.exe
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_687808939\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\en_CA\messages.json	msedge.exe
File opened for modification	C:\Windows\D08E.tmp	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_2125617502\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_687808939\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1596_918667192\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_2125617502\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1596_355374412\_locales\en\messages.json	msedge.exe
File created	C:\Windows\cscc.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LIAEAUYU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCYAoQow.exe

Checks SCSI registry key(s) 3 TTPs 44 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4196	taskkill.exe
1336	taskkill.exe
4940	taskkill.exe
5152	taskkill.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133881737191590775"	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1709934376-1871646940-4254144759-1000\{89BAF468-73FD-4EED-8CF4-FEC13A8A5DF2}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1709934376-1871646940-4254144759-1000\{98ABF67D-A2EC-4798-841A-4977D7C99485}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1709934376-1871646940-4254144759-1000\{25ABCF29-CC7A-47EE-8E14-B5B1FD601FAB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe

Modifies registry key 1 TTPs 15 IoCs

Modify Registry

pid	Process
4952	reg.exe
2508	reg.exe
4952	reg.exe
2452	reg.exe
5384	reg.exe
6396	reg.exe
4888	reg.exe
3572	reg.exe
2872	reg.exe
3176	reg.exe
6388	reg.exe
3212	reg.exe
5172	reg.exe
5972	reg.exe
6404	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2680	schtasks.exe
5952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5236	rundll32.exe
5236	rundll32.exe
5236	rundll32.exe
5236	rundll32.exe
3184	D08E.tmp
3184	D08E.tmp
3184	D08E.tmp
3184	D08E.tmp
3184	D08E.tmp
3184	D08E.tmp
3184	D08E.tmp
5288	msedge.exe
5288	msedge.exe
1616	[email protected]
1616	[email protected]
1616	[email protected]
1616	[email protected]
560	[email protected]
560	[email protected]
560	[email protected]
560	[email protected]
2448	[email protected]
2448	[email protected]
2448	[email protected]
2448	[email protected]
1976	[email protected]
1976	[email protected]
1976	[email protected]
1976	[email protected]
3508	[email protected]
3508	[email protected]
3508	[email protected]
3508	[email protected]
5340	chrome.exe
5340	chrome.exe
5340	chrome.exe
5340	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5236	rundll32.exe
Token: SeDebugPrivilege	5236	rundll32.exe
Token: SeTcbPrivilege	5236	rundll32.exe
Token: SeDebugPrivilege	3184	D08E.tmp
Token: SeCreateGlobalPrivilege	11216	dwm.exe
Token: SeChangeNotifyPrivilege	11216	dwm.exe
Token: 33	11216	dwm.exe
Token: SeIncBasePriorityPrivilege	11216	dwm.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	6080	explorer.exe
Token: SeCreatePagefilePrivilege	6080	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe
Token: SeShutdownPrivilege	2848	explorer.exe
Token: SeCreatePagefilePrivilege	2848	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe
6080	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4560	StartMenuExperienceHost.exe
11228	TextInputHost.exe
11228	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1192	1596	msedge.exe	82
PID 1596 wrote to memory of 1192	1596	msedge.exe	82
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 1768	1596	msedge.exe	85
PID 1596 wrote to memory of 1768	1596	msedge.exe	85
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 3048	1596	msedge.exe	83
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86
PID 1596 wrote to memory of 2864	1596	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://malwarewatch.org/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7fff04d4f208,0x7fff04d4f214,0x7fff04d4f220
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2132,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1996,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2376,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5008,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5264,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5832,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5832,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6124,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6228,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6372,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6520,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3860,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5908,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=4284,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6760,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=604,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6932,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6940,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2756,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6960,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6976,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5736,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6764,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=788,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5396,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6876,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=4856,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5576,i,1312397754231401441,12572557003112652035,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:9696

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1540

C:\Users\Admin\AppData\Local\Temp\ec14de37-4343-45cf-99ea-a1ca351153fa_BadRabbit.zip.3fa\[email protected]
"C:\Users\Admin\AppData\Local\Temp\ec14de37-4343-45cf-99ea-a1ca351153fa_BadRabbit.zip.3fa\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5384
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5236
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1760
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 139092174 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 139092174 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:27:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:27:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2680
- - C:\Windows\D08E.tmp
    "C:\Windows\D08E.tmp" \\.\pipe\{9FDEC1A7-2728-4BF9-B556-688B82D821FA}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3184

C:\Users\Admin\AppData\Local\Temp\30f30d37-f866-459c-bd73-f5e0a3d2097f_CookieClickerHack.zip.97f\[email protected]
"C:\Users\Admin\AppData\Local\Temp\30f30d37-f866-459c-bd73-f5e0a3d2097f_CookieClickerHack.zip.97f\[email protected]"
1⤵
PID:5752

C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]
"C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1616
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  "C:\Users\Admin\FYkocYwo\GCYAoQow.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  "C:\ProgramData\mokgAowo\LIAEAUYU.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4668
- - C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]
    C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom"
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2448
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom"
        6⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom"
        8⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\Endermanch@PolyRansom"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:6388
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:6396
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:6404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkIoEwww.bat" "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]""
        10⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5972
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:5384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSMcgIws.bat" "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]""
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4952
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:3572
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2452
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZccUMwwk.bat" "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]""
        6⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:5596
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2508
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:5172
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:3212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwAsoMgo.bat" "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]""
      4⤵
      System Location Discovery: System Language Discovery
      PID:4336
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:4844
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:4888
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:3176
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iKMMIMcA.bat" "C:\Users\Admin\AppData\Local\Temp\e43c159e-29ac-47a8-8658-33429832ec27_PolyRansom.zip.c27\[email protected]""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1752
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:1992
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:5620
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:1120
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:3512
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:1872
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:2408
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:4708
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "USERNAME eq Admin" /F /IM LIAEAUYU.exe
    3⤵
    - Kills process with taskkill
    PID:4940
- - C:\ProgramData\mokgAowo\LIAEAUYU.exe
    "C:\ProgramData\mokgAowo\LIAEAUYU.exe"
    3⤵
    PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:4816
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:2760
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:1752
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:1924
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:4668
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:4852
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:1308
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:572
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:5224
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:6184
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "USERNAME eq Admin" /F /IM LIAEAUYU.exe
    3⤵
    - Kills process with taskkill
    PID:1336
- - C:\ProgramData\mokgAowo\LIAEAUYU.exe
    "C:\ProgramData\mokgAowo\LIAEAUYU.exe"
    3⤵
    PID:10552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:6712
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:6868
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:6928
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:7020
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:7100
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:6328
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:5972
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3508
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:6540
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:6392
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:400
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:7016
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:4608
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:4764
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:7248
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:7484
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:7872
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:7952
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8036
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:7444
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:7796
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:7712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:7948
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "USERNAME eq Admin" /F /IM LIAEAUYU.exe
    3⤵
    - Kills process with taskkill
    PID:4196
- - C:\ProgramData\mokgAowo\LIAEAUYU.exe
    "C:\ProgramData\mokgAowo\LIAEAUYU.exe"
    3⤵
    PID:10948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:7184
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:7572
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /FI "USERNAME eq Admin" /F /IM LIAEAUYU.exe
    3⤵
    - Kills process with taskkill
    PID:5152
- - C:\ProgramData\mokgAowo\LIAEAUYU.exe
    "C:\ProgramData\mokgAowo\LIAEAUYU.exe"
    3⤵
    PID:10300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:8196
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8304
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8312
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:8412
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:8668
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8716
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8800
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:8892
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:9060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:9124
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8220
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:8320
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:8620
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8676
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:8680
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:9272
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:9600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:9352
- C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  C:\Users\Admin\FYkocYwo\GCYAoQow.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:9544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:9432
- C:\ProgramData\mokgAowo\LIAEAUYU.exe
  C:\ProgramData\mokgAowo\LIAEAUYU.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\mokgAowo\LIAEAUYU.exe
1⤵
PID:9684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:9772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\FYkocYwo\GCYAoQow.exe
1⤵
PID:9896

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffefa7cdcf8,0x7ffefa7cdd04,0x7ffefa7cdd10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,14445487956068191744,8417383092486716540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1608,i,14445487956068191744,8417383092486716540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2396,i,14445487956068191744,8417383092486716540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:10336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,14445487956068191744,8417383092486716540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  - Drops file in Program Files directory
  PID:10436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,14445487956068191744,8417383092486716540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  - Drops file in Program Files directory
  PID:10452

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:10632

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
PID:10852
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  PID:6080

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11216

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\85d52380a484438088c3c5cab00eac44 /t 1044 /p 1596
1⤵
PID:1340

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
PID:10480

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:11228

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2848
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
  2⤵
  PID:4812
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:3504
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5BDA94E7DF8DF3FC5AD60954B1CB016D --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=874F0DBC38C5865CF8797E0900504E05 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=874F0DBC38C5865CF8797E0900504E05 --renderer-client-id=2 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:8076

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5924

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3516

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:7584

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:8968

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:9148

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:7524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery