amadey | 63cc018bd69c2c9f028ecebbc2752a368f6f8f12b246e2c2526b3b7f95709b61

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	legion.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	14141.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	63cc018bd69c2c9f028ecebbc2752a368f6f8f12b246e2c2526b3b7f95709b61.exe

Loads dropped DLL 11 IoCs

pid	Process
5836	rundll32.exe
5844	rundll32.exe
5872	rundll32.exe
6060	rundll32.exe
5196	rundll32.exe
6016	rundll32.exe
3908	rundll32.exe
5796	rundll32.exe
3648	rundll32.exe
4664	rundll32.exe
2492	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vertu.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000001051\\vertu.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neste.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004051\\neste.exe"	nbveek.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
112	ip-api.com

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4732	141241r.exe
4732	141241r.exe
4732	141241r.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 5108	1856	nbveek.exe	95
PID 5220 set thread context of 5276	5220	qiv1ow16wzuw.exe	145

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\73288cf2-a8c8-4ce1-8367-9e59f1c89c58.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230118010006.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 48 IoCs

pid	pid_target	Process	procid_target
3728	1856	WerFault.exe	81
5348	5220	WerFault.exe	143
5752	4484	WerFault.exe	96
6028	5600	WerFault.exe	151
4912	5600	WerFault.exe	151
5244	5600	WerFault.exe	151
5328	2272	WerFault.exe	122
5272	5600	WerFault.exe	151
2644	5600	WerFault.exe	151
5580	5600	WerFault.exe	151
5468	5600	WerFault.exe	151
5108	5600	WerFault.exe	151
6076	5784	WerFault.exe	178
5932	5784	WerFault.exe	178
4488	5784	WerFault.exe	178
1244	5784	WerFault.exe	178
6140	5784	WerFault.exe	178
6020	5784	WerFault.exe	178
6032	5784	WerFault.exe	178
5288	5784	WerFault.exe	178
3948	5784	WerFault.exe	178
4444	5784	WerFault.exe	178
5684	5784	WerFault.exe	178
5988	5784	WerFault.exe	178
3480	5784	WerFault.exe	178
5620	5784	WerFault.exe	178
816	5784	WerFault.exe	178
6016	5784	WerFault.exe	178
6092	5784	WerFault.exe	178
6064	5784	WerFault.exe	178
3848	5784	WerFault.exe	178
780	5784	WerFault.exe	178
5716	5784	WerFault.exe	178
6128	5844	WerFault.exe	241
3536	5784	WerFault.exe	178
5152	5784	WerFault.exe	178
4868	5784	WerFault.exe	178
4824	5784	WerFault.exe	178
5348	5784	WerFault.exe	178
5460	5336	WerFault.exe	256
5584	4732	WerFault.exe	254
5744	5784	WerFault.exe	178
5984	4412	WerFault.exe	266
2132	5784	WerFault.exe	178
5752	5196	WerFault.exe
6064	6016	WerFault.exe	273
2376	5796	WerFault.exe	275
3660	5784	WerFault.exe	178

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	141241r.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	141241r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	141241r.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	141241r.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	141241r.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	vbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	vbc.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2844	schtasks.exe
1392	schtasks.exe
1568	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1836	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
4636	msedge.exe
4636	msedge.exe
5276	vbc.exe
5276	vbc.exe
4484	neste.exe
4484	neste.exe
4484	neste.exe
4960	live1.exe
4960	live1.exe
4960	live1.exe
5140	700K.exe
5140	700K.exe
5140	700K.exe
3952	vertu.exe
3952	vertu.exe
3952	vertu.exe
2272	live.exe
2272	live.exe
2272	live.exe
5840	identity_helper.exe
5840	identity_helper.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	neste.exe
Token: SeDebugPrivilege	5276	vbc.exe
Token: SeDebugPrivilege	2272	live.exe
Token: SeDebugPrivilege	4960	live1.exe
Token: SeDebugPrivilege	5140	700K.exe
Token: SeDebugPrivilege	3952	vertu.exe
Token: SeShutdownPrivilege	4732	141241r.exe
Token: SeCreatePagefilePrivilege	4732	141241r.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1856	4700	63cc018bd69c2c9f028ecebbc2752a368f6f8f12b246e2c2526b3b7f95709b61.exe	81
PID 4700 wrote to memory of 1856	4700	63cc018bd69c2c9f028ecebbc2752a368f6f8f12b246e2c2526b3b7f95709b61.exe	81
PID 4700 wrote to memory of 1856	4700	63cc018bd69c2c9f028ecebbc2752a368f6f8f12b246e2c2526b3b7f95709b61.exe	81
PID 1856 wrote to memory of 2844	1856	nbveek.exe	82
PID 1856 wrote to memory of 2844	1856	nbveek.exe	82
PID 1856 wrote to memory of 2844	1856	nbveek.exe	82
PID 1856 wrote to memory of 2020	1856	nbveek.exe	84
PID 1856 wrote to memory of 2020	1856	nbveek.exe	84
PID 1856 wrote to memory of 2020	1856	nbveek.exe	84
PID 2020 wrote to memory of 4940	2020	cmd.exe	86
PID 2020 wrote to memory of 4940	2020	cmd.exe	86
PID 2020 wrote to memory of 4940	2020	cmd.exe	86
PID 2020 wrote to memory of 3240	2020	cmd.exe	87
PID 2020 wrote to memory of 3240	2020	cmd.exe	87
PID 2020 wrote to memory of 3240	2020	cmd.exe	87
PID 2020 wrote to memory of 1240	2020	cmd.exe	88
PID 2020 wrote to memory of 1240	2020	cmd.exe	88
PID 2020 wrote to memory of 1240	2020	cmd.exe	88
PID 2020 wrote to memory of 3584	2020	cmd.exe	89
PID 2020 wrote to memory of 3584	2020	cmd.exe	89
PID 2020 wrote to memory of 3584	2020	cmd.exe	89
PID 2020 wrote to memory of 4052	2020	cmd.exe	90
PID 2020 wrote to memory of 4052	2020	cmd.exe	90
PID 2020 wrote to memory of 4052	2020	cmd.exe	90
PID 2020 wrote to memory of 2292	2020	cmd.exe	91
PID 2020 wrote to memory of 2292	2020	cmd.exe	91
PID 2020 wrote to memory of 2292	2020	cmd.exe	91
PID 1856 wrote to memory of 3952	1856	nbveek.exe	92
PID 1856 wrote to memory of 3952	1856	nbveek.exe	92
PID 1856 wrote to memory of 3952	1856	nbveek.exe	92
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 5108	1856	nbveek.exe	95
PID 1856 wrote to memory of 4484	1856	nbveek.exe	96
PID 1856 wrote to memory of 4484	1856	nbveek.exe	96
PID 1856 wrote to memory of 4484	1856	nbveek.exe	96
PID 1856 wrote to memory of 1288	1856	nbveek.exe	98
PID 1856 wrote to memory of 1288	1856	nbveek.exe	98
PID 1856 wrote to memory of 1288	1856	nbveek.exe	98
PID 5108 wrote to memory of 4636	5108	nbveek.exe	100
PID 5108 wrote to memory of 4636	5108	nbveek.exe	100
PID 4636 wrote to memory of 3416	4636	msedge.exe	101
PID 4636 wrote to memory of 3416	4636	msedge.exe	101
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104
PID 4636 wrote to memory of 2016	4636	msedge.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Users\Admin\AppData\Local\Temp\63cc018bd69c2c9f028ecebbc2752a368f6f8f12b246e2c2526b3b7f95709b61.exe
"C:\Users\Admin\AppData\Local\Temp\63cc018bd69c2c9f028ecebbc2752a368f6f8f12b246e2c2526b3b7f95709b61.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
  "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "nbveek.exe" /P "Admin:N"
      4⤵
      PID:3240
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "nbveek.exe" /P "Admin:R" /E
      4⤵
      PID:1240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:3584
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\4b9a106e76" /P "Admin:N"
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\4b9a106e76" /P "Admin:R" /E
      4⤵
      PID:2292
- - C:\Users\Admin\AppData\Local\Temp\1000001051\vertu.exe
    "C:\Users\Admin\AppData\Local\Temp\1000001051\vertu.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=nbveek.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec93a46f8,0x7ffec93a4708,0x7ffec93a4718
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
        5⤵
        
        PID:3788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
        5⤵
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5416 /prefetch:8
        5⤵
        
        PID:2348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
        5⤵
        
        PID:2844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
        5⤵
        
        PID:4816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6000 /prefetch:8
        5⤵
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
        5⤵
        
        PID:4740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
        5⤵
        
        PID:3048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
        5⤵
        
        PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:6016
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff638095460,0x7ff638095470,0x7ff638095480
        6⤵
        
        PID:5528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12370517016719778609,1816095316904280994,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2832 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=nbveek.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:1316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec93a46f8,0x7ffec93a4708,0x7ffec93a4718
        5⤵
        
        PID:1344
- - C:\Users\Admin\AppData\Local\Temp\1000004051\neste.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004051\neste.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 1260
      4⤵
      Program crash
      PID:5752
- - C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\1000009001\live.exe
    "C:\Users\Admin\AppData\Local\Temp\1000009001\live.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1220
      4⤵
      Program crash
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
    3⤵
    PID:212
- - C:\Users\Admin\AppData\Local\Temp\1000012001\legion.exe
    "C:\Users\Admin\AppData\Local\Temp\1000012001\legion.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:4304
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1392
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:4516
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1844
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        6⤵
        
        PID:1936
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        6⤵
        
        PID:3120
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4284
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\9e0894bcc4" /P "Admin:N"
        6⤵
        
        PID:3728
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\9e0894bcc4" /P "Admin:R" /E
        6⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\1000001001\700K.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000001001\700K.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\1000002001\qiv1ow16wzuw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000002001\qiv1ow16wzuw.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5220
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        7⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        8⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        8⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
        7⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile name="65001" key=clear
        8⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr Key
        8⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        7⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        8⤵
        Runs ping.exe
        
        PID:1836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 240
        6⤵
        Program crash
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\1000004001\14141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\14141.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1000
        6⤵
        Program crash
        
        PID:6028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1008
        6⤵
        Program crash
        
        PID:4912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1004
        6⤵
        Program crash
        
        PID:5244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1012
        6⤵
        Program crash
        
        PID:5272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1064
        6⤵
        Program crash
        
        PID:2644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1000
        6⤵
        Program crash
        
        PID:5580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1128
        6⤵
        Program crash
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 592
        7⤵
        Program crash
        
        PID:6076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 748
        7⤵
        Program crash
        
        PID:5932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 748
        7⤵
        Program crash
        
        PID:4488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 800
        7⤵
        Program crash
        
        PID:1244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 772
        7⤵
        Program crash
        
        PID:6140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1016
        7⤵
        Program crash
        
        PID:6020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 784
        7⤵
        Program crash
        
        PID:6032
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:1568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 928
        7⤵
        Program crash
        
        PID:5288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 676
        7⤵
        Program crash
        
        PID:3948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\727358c059" /P "Admin:N"&&CACLS "..\727358c059" /P "Admin:R" /E&&Exit
        7⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        8⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        8⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\727358c059" /P "Admin:N"
        8⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\727358c059" /P "Admin:R" /E
        8⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 820
        7⤵
        Program crash
        
        PID:4444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 820
        7⤵
        Program crash
        
        PID:5684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1188
        7⤵
        Program crash
        
        PID:5988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 664
        7⤵
        Program crash
        
        PID:3480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 596
        7⤵
        Program crash
        
        PID:5620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1172
        7⤵
        Program crash
        
        PID:816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 668
        7⤵
        Program crash
        
        PID:6016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 664
        7⤵
        Program crash
        
        PID:6092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1360
        7⤵
        Program crash
        
        PID:6064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1372
        7⤵
        Program crash
        
        PID:3848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1524
        7⤵
        Program crash
        
        PID:780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1532
        7⤵
        Program crash
        
        PID:5716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1532
        7⤵
        Program crash
        
        PID:3536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1376
        7⤵
        Program crash
        
        PID:5152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1336
        7⤵
        Program crash
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\1000004001\141241r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\141241r.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks SCSI registry key(s)
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 988
        8⤵
        Program crash
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\1000004001\141241r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\141241r.exe"
        7⤵
        Executes dropped EXE
        
        PID:5336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 564
        8⤵
        Program crash
        
        PID:5460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1876
        7⤵
        Program crash
        
        PID:4824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1888
        7⤵
        Program crash
        
        PID:5348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 992
        7⤵
        Program crash
        
        PID:5744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1900
        7⤵
        Program crash
        
        PID:2132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:5872
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
        8⤵
        Loads dropped DLL
        
        PID:6016
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6016 -s 680
        9⤵
        Program crash
        
        PID:6064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:6060
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
        8⤵
        Loads dropped DLL
        
        PID:5196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:3908
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
        8⤵
        Loads dropped DLL
        
        PID:5796
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5796 -s 680
        9⤵
        Program crash
        
        PID:2376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\clip64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:3648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\clip64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:2492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\clip64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:4664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 1708
        7⤵
        Program crash
        
        PID:3660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 1132
        6⤵
        Program crash
        
        PID:5108
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:5836
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:5844
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5844 -s 688
        7⤵
        Program crash
        
        PID:6128
- - C:\Users\Admin\AppData\Local\Temp\1000013001\live1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000013001\live1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1672
    3⤵
    - Program crash
    PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1856 -ip 1856
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5220 -ip 5220
1⤵
PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4484 -ip 4484
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5600 -ip 5600
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5600 -ip 5600
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5600 -ip 5600
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2272 -ip 2272
1⤵
PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5600 -ip 5600
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5600 -ip 5600
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5600 -ip 5600
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5600 -ip 5600
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5600 -ip 5600
1⤵
PID:812

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
1⤵
- Executes dropped EXE
PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5784 -ip 5784
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5784 -ip 5784
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5784 -ip 5784
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5784 -ip 5784
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5784 -ip 5784
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5784 -ip 5784
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5784 -ip 5784
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5784 -ip 5784
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5784 -ip 5784
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5784 -ip 5784
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5784 -ip 5784
1⤵
PID:5644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5784 -ip 5784
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5784 -ip 5784
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5784 -ip 5784
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5784 -ip 5784
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5784 -ip 5784
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5784 -ip 5784
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5784 -ip 5784
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5784 -ip 5784
1⤵
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5784 -ip 5784
1⤵
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5784 -ip 5784
1⤵
PID:5848

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 5844 -ip 5844
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5784 -ip 5784
1⤵
PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5784 -ip 5784
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5784 -ip 5784
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5784 -ip 5784
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5784 -ip 5784
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5336 -ip 5336
1⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4732 -ip 4732
1⤵
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5784 -ip 5784
1⤵
PID:5684

C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
1⤵
- Executes dropped EXE
PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 424
  2⤵
  - Program crash
  PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4412 -ip 4412
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5784 -ip 5784
1⤵
PID:5364

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 5196 -ip 5196
1⤵
PID:5112

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 6016 -ip 6016
1⤵
PID:5528

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 5796 -ip 5796
1⤵
PID:5484

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5196 -s 680
1⤵
- Program crash
PID:5752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5784 -ip 5784
1⤵
PID:5952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery