saintbot | 8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Microsoft Edge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe

Loads dropped DLL 2 IoCs

pid	Process
4224	Microsoft Edge.exe
4820	dfrgui.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\zzAdmin\\Admin.vbs"	dfrgui.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Microsoft Edge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	dfrgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Microsoft Edge.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	dfrgui.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 2724 set thread context of 4224	2724	Microsoft Edge.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1092	3804	WerFault.exe	95
3108	4496	WerFault.exe	113

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dfrgui.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
524	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings	Microsoft Edge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1952	PING.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3636	AdvancedRun.exe
3636	AdvancedRun.exe
3636	AdvancedRun.exe
3636	AdvancedRun.exe
3724	AdvancedRun.exe
3724	AdvancedRun.exe
3724	AdvancedRun.exe
3724	AdvancedRun.exe
216	AdvancedRun.exe
216	AdvancedRun.exe
216	AdvancedRun.exe
216	AdvancedRun.exe
4324	AdvancedRun.exe
4324	AdvancedRun.exe
4324	AdvancedRun.exe
4324	AdvancedRun.exe
5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
2112	AdvancedRun.exe
2112	AdvancedRun.exe
2112	AdvancedRun.exe
2112	AdvancedRun.exe
1724	AdvancedRun.exe
1724	AdvancedRun.exe
1724	AdvancedRun.exe
1724	AdvancedRun.exe
8	AdvancedRun.exe
8	AdvancedRun.exe
8	AdvancedRun.exe
8	AdvancedRun.exe
800	AdvancedRun.exe
800	AdvancedRun.exe
800	AdvancedRun.exe
800	AdvancedRun.exe
2724	Microsoft Edge.exe
2724	Microsoft Edge.exe
4224	Microsoft Edge.exe
4224	Microsoft Edge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
Token: SeDebugPrivilege	3636	AdvancedRun.exe
Token: SeImpersonatePrivilege	3636	AdvancedRun.exe
Token: SeDebugPrivilege	3724	AdvancedRun.exe
Token: SeImpersonatePrivilege	3724	AdvancedRun.exe
Token: SeDebugPrivilege	216	AdvancedRun.exe
Token: SeImpersonatePrivilege	216	AdvancedRun.exe
Token: SeDebugPrivilege	4324	AdvancedRun.exe
Token: SeImpersonatePrivilege	4324	AdvancedRun.exe
Token: SeDebugPrivilege	2724	Microsoft Edge.exe
Token: SeDebugPrivilege	2112	AdvancedRun.exe
Token: SeImpersonatePrivilege	2112	AdvancedRun.exe
Token: SeDebugPrivilege	1724	AdvancedRun.exe
Token: SeImpersonatePrivilege	1724	AdvancedRun.exe
Token: SeDebugPrivilege	8	AdvancedRun.exe
Token: SeImpersonatePrivilege	8	AdvancedRun.exe
Token: SeDebugPrivilege	800	AdvancedRun.exe
Token: SeImpersonatePrivilege	800	AdvancedRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3636	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	89
PID 5072 wrote to memory of 3636	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	89
PID 5072 wrote to memory of 3636	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	89
PID 3636 wrote to memory of 3724	3636	AdvancedRun.exe	90
PID 3636 wrote to memory of 3724	3636	AdvancedRun.exe	90
PID 3636 wrote to memory of 3724	3636	AdvancedRun.exe	90
PID 5072 wrote to memory of 216	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	92
PID 5072 wrote to memory of 216	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	92
PID 5072 wrote to memory of 216	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	92
PID 216 wrote to memory of 4324	216	AdvancedRun.exe	93
PID 216 wrote to memory of 4324	216	AdvancedRun.exe	93
PID 216 wrote to memory of 4324	216	AdvancedRun.exe	93
PID 5072 wrote to memory of 1156	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	94
PID 5072 wrote to memory of 1156	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	94
PID 5072 wrote to memory of 1156	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	94
PID 1156 wrote to memory of 3804	1156	WScript.exe	95
PID 1156 wrote to memory of 3804	1156	WScript.exe	95
PID 1156 wrote to memory of 3804	1156	WScript.exe	95
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 5072 wrote to memory of 4644	5072	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	96
PID 4644 wrote to memory of 2724	4644	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	97
PID 4644 wrote to memory of 2724	4644	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	97
PID 4644 wrote to memory of 2724	4644	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	97
PID 4644 wrote to memory of 4920	4644	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	98
PID 4644 wrote to memory of 4920	4644	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	98
PID 4644 wrote to memory of 4920	4644	8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe	98
PID 4920 wrote to memory of 1952	4920	cmd.exe	100
PID 4920 wrote to memory of 1952	4920	cmd.exe	100
PID 4920 wrote to memory of 1952	4920	cmd.exe	100
PID 4920 wrote to memory of 1804	4920	cmd.exe	101
PID 4920 wrote to memory of 1804	4920	cmd.exe	101
PID 4920 wrote to memory of 1804	4920	cmd.exe	101
PID 2724 wrote to memory of 2112	2724	Microsoft Edge.exe	106
PID 2724 wrote to memory of 2112	2724	Microsoft Edge.exe	106
PID 2724 wrote to memory of 2112	2724	Microsoft Edge.exe	106
PID 2112 wrote to memory of 1724	2112	AdvancedRun.exe	107
PID 2112 wrote to memory of 1724	2112	AdvancedRun.exe	107
PID 2112 wrote to memory of 1724	2112	AdvancedRun.exe	107
PID 2724 wrote to memory of 8	2724	Microsoft Edge.exe	108
PID 2724 wrote to memory of 8	2724	Microsoft Edge.exe	108
PID 2724 wrote to memory of 8	2724	Microsoft Edge.exe	108
PID 8 wrote to memory of 800	8	AdvancedRun.exe	109
PID 8 wrote to memory of 800	8	AdvancedRun.exe	109
PID 8 wrote to memory of 800	8	AdvancedRun.exe	109
PID 2724 wrote to memory of 3988	2724	Microsoft Edge.exe	110
PID 2724 wrote to memory of 3988	2724	Microsoft Edge.exe	110
PID 2724 wrote to memory of 3988	2724	Microsoft Edge.exe	110
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111
PID 2724 wrote to memory of 4224	2724	Microsoft Edge.exe	111

C:\Users\Admin\AppData\Local\Temp\8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
"C:\Users\Admin\AppData\Local\Temp\8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3636
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 216
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sqsxfhynivxwpl.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Wrvqtyoyuopenbullet.exe
    "C:\Users\Admin\AppData\Local\Temp\Wrvqtyoyuopenbullet.exe"
    3⤵
    - Executes dropped EXE
    PID:3804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 1052
      4⤵
      Program crash
      PID:1092
- C:\Users\Admin\AppData\Local\Temp\8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
  C:\Users\Admin\AppData\Local\Temp\8f5315482513b1df3511cc3b8dc47cb635ef5d4ad66d4c1b615b928be21b1736.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 2112
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:8
    - - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 8
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sqsxfhynivxwpl.vbs"
      4⤵
      Checks computer location settings
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Wrvqtyoyuopenbullet.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wrvqtyoyuopenbullet.exe"
        5⤵
        Executes dropped EXE
        
        PID:4496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1020
        6⤵
        Program crash
        
        PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft Edge.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Edge.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:4224
    - - C:\Windows\SysWOW64\dfrgui.exe
        
        "C:\Windows\system32\dfrgui.exe"
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Maps connected drives based on registry
        Drops file in System32 directory
        Checks processor information in registry
        
        PID:4820
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 5 /tn "Update" /tr "%SYSTEMDRIVE%\Users\%USERNAME%\AppData\Local\zz%USERNAME%\%USERNAME%.vbs" /F
        6⤵
        Creates scheduled task(s)
        
        PID:524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\del.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:1952
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
      4⤵
      PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3804 -ip 3804
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4496 -ip 4496
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery