amadey | 575e8d98c07947f598032245d513cde6e7e8059c7998e7ee5f0b92a75d10213d

System Information Discovery

Processes:

F3B8.exenbveek.exeFA8F.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	F3B8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	FA8F.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

1392 rundll32.exe
660 rundll32.exe
4740 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

84 api.ipify.org
85 api.ipify.org

pid	process
1392	rundll32.exe
660	rundll32.exe
4740	rundll32.exe

flow	ioc
84	api.ipify.org
85	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F39C323F-B660-4F74-A39F-C200E9AE3F96}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9D8F8CAE-FE78-4487-8EC0-6D31266C71FB}.catalogItem	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

Processes:

powershell.exe

pid	process
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exeF31B.exe

description	pid	process	target process
PID 4220 set thread context of 3236	4220	powershell.exe	aspnet_compiler.exe
PID 5076 set thread context of 3076	5076	F31B.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4684 660 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4684	660	WerFault.exe	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Creates scheduled task(s) 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3156	schtasks.exe
3200	schtasks.exe
4560	schtasks.exe
3000	schtasks.exe
376	schtasks.exe
3224	schtasks.exe
4992	schtasks.exe
4968	schtasks.exe
872	schtasks.exe
1476	schtasks.exe
1032	schtasks.exe
100	schtasks.exe
3116	schtasks.exe
900	schtasks.exe
4624	schtasks.exe
4684	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

1300 taskkill.exe
4564 taskkill.exe
3752 taskkill.exe
3364 taskkill.exe
3700 taskkill.exe
2356 taskkill.exe

pid	process
1300	taskkill.exe
4564	taskkill.exe
3752	taskkill.exe
3364	taskkill.exe
3700	taskkill.exe
2356	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeaspnet_compiler.exe

pid	process
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
3236	aspnet_compiler.exe
3236	aspnet_compiler.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3004
Suspicious behavior: MapViewOfSection 13 IoCs

Processes:

aspnet_compiler.exe

pid process

3236 aspnet_compiler.exe
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004

pid	process
3004

pid	process
3236	aspnet_compiler.exe
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004

Suspicious use of AdjustPrivilegeToken 57 IoCs

Processes:

powershell.exepowershell.exeProgramStarter.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeAppLaunch.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeDebugPrivilege	1580	ProgramStarter.exe
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	3700	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeDebugPrivilege	3076	AppLaunch.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	4156	powercfg.exe
Token: SeCreatePagefilePrivilege	4156	powercfg.exe
Token: SeShutdownPrivilege	212	powercfg.exe
Token: SeCreatePagefilePrivilege	212	powercfg.exe
Token: SeShutdownPrivilege	1908	powercfg.exe
Token: SeCreatePagefilePrivilege	1908	powercfg.exe
Token: SeShutdownPrivilege	3728	powercfg.exe
Token: SeCreatePagefilePrivilege	3728	powercfg.exe
Token: SeShutdownPrivilege	3028	powercfg.exe
Token: SeCreatePagefilePrivilege	3028	powercfg.exe
Token: SeShutdownPrivilege	3028	powercfg.exe
Token: SeCreatePagefilePrivilege	3028	powercfg.exe
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004
Token: SeShutdownPrivilege	3004
Token: SeCreatePagefilePrivilege	3004

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup_soft.exepowershell.execmd.exeF3B8.exeF31B.exenbveek.execmd.exeFA8F.exeFE3A.exe

description	pid	process	target process
PID 1544 wrote to memory of 4220	1544	Setup_soft.exe	powershell.exe
PID 1544 wrote to memory of 4220	1544	Setup_soft.exe	powershell.exe
PID 1544 wrote to memory of 4220	1544	Setup_soft.exe	powershell.exe
PID 4220 wrote to memory of 3236	4220	powershell.exe	aspnet_compiler.exe
PID 4220 wrote to memory of 3236	4220	powershell.exe	aspnet_compiler.exe
PID 4220 wrote to memory of 3236	4220	powershell.exe	aspnet_compiler.exe
PID 4220 wrote to memory of 3236	4220	powershell.exe	aspnet_compiler.exe
PID 4220 wrote to memory of 3236	4220	powershell.exe	aspnet_compiler.exe
PID 4220 wrote to memory of 3236	4220	powershell.exe	aspnet_compiler.exe
PID 3004 wrote to memory of 1480	3004		cmd.exe
PID 3004 wrote to memory of 1480	3004		cmd.exe
PID 1480 wrote to memory of 3852	1480	cmd.exe	cacls.exe
PID 1480 wrote to memory of 3852	1480	cmd.exe	cacls.exe
PID 1480 wrote to memory of 1344	1480	cmd.exe	powershell.exe
PID 1480 wrote to memory of 1344	1480	cmd.exe	powershell.exe
PID 3004 wrote to memory of 5076	3004		F31B.exe
PID 3004 wrote to memory of 5076	3004		F31B.exe
PID 3004 wrote to memory of 5076	3004		F31B.exe
PID 3004 wrote to memory of 4988	3004		F3B8.exe
PID 3004 wrote to memory of 4988	3004		F3B8.exe
PID 3004 wrote to memory of 4988	3004		F3B8.exe
PID 4988 wrote to memory of 2396	4988	F3B8.exe	nbveek.exe
PID 4988 wrote to memory of 2396	4988	F3B8.exe	nbveek.exe
PID 4988 wrote to memory of 2396	4988	F3B8.exe	nbveek.exe
PID 3004 wrote to memory of 2184	3004		FA8F.exe
PID 3004 wrote to memory of 2184	3004		FA8F.exe
PID 3004 wrote to memory of 2184	3004		FA8F.exe
PID 5076 wrote to memory of 3076	5076	F31B.exe	AppLaunch.exe
PID 5076 wrote to memory of 3076	5076	F31B.exe	AppLaunch.exe
PID 5076 wrote to memory of 3076	5076	F31B.exe	AppLaunch.exe
PID 5076 wrote to memory of 3076	5076	F31B.exe	AppLaunch.exe
PID 5076 wrote to memory of 3076	5076	F31B.exe	AppLaunch.exe
PID 3004 wrote to memory of 2444	3004		FE3A.exe
PID 3004 wrote to memory of 2444	3004		FE3A.exe
PID 2396 wrote to memory of 3000	2396	nbveek.exe	schtasks.exe
PID 2396 wrote to memory of 3000	2396	nbveek.exe	schtasks.exe
PID 2396 wrote to memory of 3000	2396	nbveek.exe	schtasks.exe
PID 3004 wrote to memory of 1852	3004		explorer.exe
PID 3004 wrote to memory of 1852	3004		explorer.exe
PID 3004 wrote to memory of 1852	3004		explorer.exe
PID 3004 wrote to memory of 1852	3004		explorer.exe
PID 2396 wrote to memory of 3640	2396	nbveek.exe	cmd.exe
PID 2396 wrote to memory of 3640	2396	nbveek.exe	cmd.exe
PID 2396 wrote to memory of 3640	2396	nbveek.exe	cmd.exe
PID 3004 wrote to memory of 932	3004		explorer.exe
PID 3004 wrote to memory of 932	3004		explorer.exe
PID 3004 wrote to memory of 932	3004		explorer.exe
PID 3640 wrote to memory of 672	3640	cmd.exe	cmd.exe
PID 3640 wrote to memory of 672	3640	cmd.exe	cmd.exe
PID 3640 wrote to memory of 672	3640	cmd.exe	cmd.exe
PID 3640 wrote to memory of 1672	3640	cmd.exe	cacls.exe
PID 3640 wrote to memory of 1672	3640	cmd.exe	cacls.exe
PID 3640 wrote to memory of 1672	3640	cmd.exe	cacls.exe
PID 3004 wrote to memory of 4704	3004		explorer.exe
PID 3004 wrote to memory of 4704	3004		explorer.exe
PID 3004 wrote to memory of 4704	3004		explorer.exe
PID 3004 wrote to memory of 4704	3004		explorer.exe
PID 2184 wrote to memory of 1580	2184	FA8F.exe	ProgramStarter.exe
PID 2184 wrote to memory of 1580	2184	FA8F.exe	ProgramStarter.exe
PID 2184 wrote to memory of 1580	2184	FA8F.exe	ProgramStarter.exe
PID 2444 wrote to memory of 1824	2444	FE3A.exe	cmd.exe
PID 2444 wrote to memory of 1824	2444	FE3A.exe	cmd.exe
PID 3004 wrote to memory of 1412	3004		explorer.exe
PID 3004 wrote to memory of 1412	3004		explorer.exe

C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
2⤵
- DcRat
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ED8C.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\system32\cacls.exe
"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
2⤵
PID:3852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionPath C:\
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\system32\taskkill.exe
taskkill /F /IM msedge.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\system32\taskkill.exe
taskkill /F /IM chrome.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Edge" /v DownloadRestrictions /t REG_DWORD /d 3
2⤵
PID:4216

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\Policies\Google\chrome" /v DownloadRestrictions /t REG_DWORD /d 3
2⤵
PID:4232

C:\Windows\system32\taskkill.exe
taskkill /F /IM opera.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\system32\taskkill.exe
taskkill /F /IM brave.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\system32\taskkill.exe
taskkill /F /IM firefox.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\system32\taskkill.exe
taskkill /F /IM Telegram.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Users\Admin\AppData\Local\Temp\F31B.exe
C:\Users\Admin\AppData\Local\Temp\F31B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Users\Admin\AppData\Local\Temp\F3B8.exe
C:\Users\Admin\AppData\Local\Temp\F3B8.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:3000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\8682d6c68d" /P "Admin:N"&&CACLS "..\8682d6c68d" /P "Admin:R" /E&&Exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:672

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
4⤵
PID:1672

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
4⤵
PID:4740

C:\Windows\SysWOW64\cacls.exe
CACLS "..\8682d6c68d" /P "Admin:R" /E
4⤵
PID:3136

C:\Windows\SysWOW64\cacls.exe
CACLS "..\8682d6c68d" /P "Admin:N"
4⤵
PID:3600

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\1000043001\DefendUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\1000043001\DefendUpdate.exe"
3⤵
- Executes dropped EXE
PID:1628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\1000043001\DefendUpdate.exe
4⤵
PID:4916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
5⤵
PID:2088

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
3⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
3⤵
PID:4336

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
3⤵
PID:4988

C:\Users\Admin\AppData\Local\Temp\1000045001\MicrosoftFIX_error.exe
"C:\Users\Admin\AppData\Local\Temp\1000045001\MicrosoftFIX_error.exe"
3⤵
- Executes dropped EXE
PID:4940

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8be7d7b3521979\cred64.dll, Main
3⤵
- Loads dropped DLL
PID:1392

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8be7d7b3521979\cred64.dll, Main
4⤵
- Loads dropped DLL
PID:660

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 660 -s 680
5⤵
- Program crash
PID:4684

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8be7d7b3521979\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:4740

C:\Users\Admin\AppData\Local\Temp\FA8F.exe
C:\Users\Admin\AppData\Local\Temp\FA8F.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2184

C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe
"C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powershell -EncodedCommand "PAAjAFQAQQBHAE8AYwB6AFkAUgBVAFIAVwBGAFkAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBJAEIAYgBnAGkARgBSAFoAbgB4AGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAFQAdQBSAHUATwBEAFIAUgBmAE0AYgBIAGwAeABXACMAPgAgAEAAKAAgADwAIwBGAFUAWQBtAFEAaQBEAGcAYwBlAGYAcgBxAG4AIwA+ACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACAAPAAjAFMASwBDAHAAUwBZAEYAUwBUAG4AaABtAE0AdwBIAFMAeQBkACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKQAgADwAIwBiAGIAcgBWAFAAZwBkAGYATgB0AFYAYwB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEUAawBQAFUAdQBrAEIAaQBxAGYAaABKACMAPgA="
3⤵
PID:3636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAFQAQQBHAE8AYwB6AFkAUgBVAFIAVwBGAFkAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBJAEIAYgBnAGkARgBSAFoAbgB4AGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAFQAdQBSAHUATwBEAFIAUgBmAE0AYgBIAGwAeABXACMAPgAgAEAAKAAgADwAIwBGAFUAWQBtAFEAaQBEAGcAYwBlAGYAcgBxAG4AIwA+ACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACAAPAAjAFMASwBDAHAAUwBZAEYAUwBUAG4AaABtAE0AdwBIAFMAeQBkACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKQAgADwAIwBiAGIAcgBWAFAAZwBkAGYATgB0AFYAYwB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEUAawBQAFUAdQBrAEIAaQBxAGYAaABKACMAPgA="
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4520

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:376

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:2464

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:1032

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4760

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:1476

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4236

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3116

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4512

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:872

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:1720

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4624

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:3384

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:900

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:2736

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4968

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk267" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4420

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk267" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3156

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk172" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:260

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk172" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:100

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk117" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:2556

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk117" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3224

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk150" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:3536

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk150" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4684

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk405" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:432

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk405" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3200

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off & SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:2256

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\SysWOW64\powercfg.exe
powercfg /hibernate off
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4560

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
3⤵
PID:1404

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4992

C:\Users\Admin\AppData\Local\Temp\FE3A.exe
C:\Users\Admin\AppData\Local\Temp\FE3A.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\FE3A.exe
2⤵
PID:1824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
3⤵
PID:3384

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1852

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:932

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1412

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 660 -ip 660
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
1⤵
- Executes dropped EXE
PID:3156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery