IOC Report

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

data

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Microsoft Cabinet archive data, 61157 bytes, 1 file

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

data

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

data

modified

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\5F092BAC-4701-4818-8EB0-1B8D5E2340F4\1.1.18500.10_to_1.1.18600.4_mpengine.dll._p

data

dropped

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\5F092BAC-4701-4818-8EB0-1B8D5E2340F4\1.349.0.0_to_1.351.0.0_mpasbase.vdm._p

data

dropped

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\5F092BAC-4701-4818-8EB0-1B8D5E2340F4\1.349.0.0_to_1.351.0.0_mpavbase.vdm._p

data

dropped

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\5F092BAC-4701-4818-8EB0-1B8D5E2340F4\MpSigStub.exe

PE32+ executable (GUI) x86-64, for MS Windows

dropped

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\5F092BAC-4701-4818-8EB0-1B8D5E2340F4\mpasbase.vdm

PE32+ executable (DLL) (console) x86-64, for MS Windows

dropped

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\5F092BAC-4701-4818-8EB0-1B8D5E2340F4\mpasdlta.vdm

PE32+ executable (DLL) (console) x86-64, for MS Windows

dropped

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\oobe\UserOOBEBroker.exe

C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-51041e98.exe

'C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-51041e98.exe' /q WD

C:\Windows\System32\wevtutil.exe

C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\TEMP\03B8EEFF-063F-7FBE-74AE-B9DD32097DDC.man

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\wevtutil.exe

C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\TEMP\03B8EEFF-063F-7FBE-74AE-B9DD32097DDC.man '/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll'

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

http://kiranacorp.com/oja

unknown