amadey | 4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	D433.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	liuc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	liuc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	B9EE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	BB18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	BB18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	BCDE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	CE08.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Player3.exe

Loads dropped DLL 8 IoCs

pid	Process
3236	rundll32.exe
2812	rundll32.exe
3108	rundll32.exe
3480	build2.exe
3480	build2.exe
2292	rundll32.exe
2844	rundll32.exe
3552	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4632	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	BCDE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemCheck = "cmd.exe /c start rundll32 \"C:\\ProgramData\\schk.dll\" SystemCheck"	BCDE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c8ff3453-d6da-438b-af7a-fed0a1671f82\\BB18.exe\" --AutoStart"	BB18.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	1531.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.2ip.ua
58	api.2ip.ua
27	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3960 set thread context of 4724	3960	BB18.exe	96
PID 908 set thread context of 1628	908	BB18.exe	145
PID 3936 set thread context of 3480	3936	build2.exe	150

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3224	3376	WerFault.exe	92
320	2580	WerFault.exe	99
1492	3456	WerFault.exe	86
3844	1620	WerFault.exe	98
1564	3108	WerFault.exe	137
4456	2812	WerFault.exe	136
4812	2844	WerFault.exe	161
4008	2376	WerFault.exe	163

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C154.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C154.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1392	schtasks.exe
3172	schtasks.exe
3480	schtasks.exe
4820	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4248	timeout.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	46	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4624	4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe
4624	4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found
2720	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4624	4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe
3500	C154.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found
Token: SeShutdownPrivilege	2720	Process not Found
Token: SeCreatePagefilePrivilege	2720	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3456	2720	Process not Found	86
PID 2720 wrote to memory of 3456	2720	Process not Found	86
PID 2720 wrote to memory of 3456	2720	Process not Found	86
PID 2720 wrote to memory of 3960	2720	Process not Found	87
PID 2720 wrote to memory of 3960	2720	Process not Found	87
PID 2720 wrote to memory of 3960	2720	Process not Found	87
PID 2720 wrote to memory of 2972	2720	Process not Found	88
PID 2720 wrote to memory of 2972	2720	Process not Found	88
PID 2972 wrote to memory of 320	2972	BCDE.exe	89
PID 2972 wrote to memory of 320	2972	BCDE.exe	89
PID 2720 wrote to memory of 3500	2720	Process not Found	91
PID 2720 wrote to memory of 3500	2720	Process not Found	91
PID 2720 wrote to memory of 3500	2720	Process not Found	91
PID 2720 wrote to memory of 3376	2720	Process not Found	92
PID 2720 wrote to memory of 3376	2720	Process not Found	92
PID 2720 wrote to memory of 3376	2720	Process not Found	92
PID 320 wrote to memory of 3236	320	cmd.exe	93
PID 320 wrote to memory of 3236	320	cmd.exe	93
PID 2720 wrote to memory of 1360	2720	Process not Found	95
PID 2720 wrote to memory of 1360	2720	Process not Found	95
PID 2720 wrote to memory of 1360	2720	Process not Found	95
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 3960 wrote to memory of 4724	3960	BB18.exe	96
PID 2720 wrote to memory of 4264	2720	Process not Found	97
PID 2720 wrote to memory of 4264	2720	Process not Found	97
PID 2720 wrote to memory of 4264	2720	Process not Found	97
PID 4264 wrote to memory of 2580	4264	D433.exe	99
PID 4264 wrote to memory of 2580	4264	D433.exe	99
PID 4264 wrote to memory of 2580	4264	D433.exe	99
PID 1360 wrote to memory of 1620	1360	CE08.exe	98
PID 1360 wrote to memory of 1620	1360	CE08.exe	98
PID 1360 wrote to memory of 1620	1360	CE08.exe	98
PID 4264 wrote to memory of 1124	4264	D433.exe	100
PID 4264 wrote to memory of 1124	4264	D433.exe	100
PID 1360 wrote to memory of 3620	1360	CE08.exe	101
PID 1360 wrote to memory of 3620	1360	CE08.exe	101
PID 4264 wrote to memory of 1420	4264	D433.exe	102
PID 4264 wrote to memory of 1420	4264	D433.exe	102
PID 4264 wrote to memory of 1420	4264	D433.exe	102
PID 1360 wrote to memory of 592	1360	CE08.exe	103
PID 1360 wrote to memory of 592	1360	CE08.exe	103
PID 1360 wrote to memory of 592	1360	CE08.exe	103
PID 4264 wrote to memory of 3184	4264	D433.exe	105
PID 4264 wrote to memory of 3184	4264	D433.exe	105
PID 4264 wrote to memory of 3184	4264	D433.exe	105
PID 1360 wrote to memory of 1696	1360	CE08.exe	144
PID 1360 wrote to memory of 1696	1360	CE08.exe	144
PID 1360 wrote to memory of 1696	1360	CE08.exe	144
PID 1696 wrote to memory of 2428	1696	svchost.exe	109
PID 1696 wrote to memory of 2428	1696	svchost.exe	109
PID 1696 wrote to memory of 2428	1696	svchost.exe	109
PID 3184 wrote to memory of 4312	3184	Player3.exe	108
PID 3184 wrote to memory of 4312	3184	Player3.exe	108
PID 3184 wrote to memory of 4312	3184	Player3.exe	108
PID 592 wrote to memory of 1552	592	liuc.exe	110
PID 592 wrote to memory of 1552	592	liuc.exe	110

C:\Users\Admin\AppData\Local\Temp\4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe
"C:\Users\Admin\AppData\Local\Temp\4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4624

C:\Users\Admin\AppData\Local\Temp\B9EE.exe
C:\Users\Admin\AppData\Local\Temp\B9EE.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:3456
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Creates scheduled task(s)
  PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 1028
  2⤵
  - Program crash
  PID:1492

C:\Users\Admin\AppData\Local\Temp\BB18.exe
C:\Users\Admin\AppData\Local\Temp\BB18.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\BB18.exe
  C:\Users\Admin\AppData\Local\Temp\BB18.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  PID:4724
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\c8ff3453-d6da-438b-af7a-fed0a1671f82" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\BB18.exe
    "C:\Users\Admin\AppData\Local\Temp\BB18.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:908
  - - C:\Users\Admin\AppData\Local\Temp\BB18.exe
      "C:\Users\Admin\AppData\Local\Temp\BB18.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:1628
    - - C:\Users\Admin\AppData\Local\dbf0d53b-5b10-46ae-9cf3-4152c337a88b\build2.exe
        
        "C:\Users\Admin\AppData\Local\dbf0d53b-5b10-46ae-9cf3-4152c337a88b\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3936
      - C:\Users\Admin\AppData\Local\dbf0d53b-5b10-46ae-9cf3-4152c337a88b\build2.exe
        
        "C:\Users\Admin\AppData\Local\dbf0d53b-5b10-46ae-9cf3-4152c337a88b\build2.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3480
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\dbf0d53b-5b10-46ae-9cf3-4152c337a88b\build2.exe" & exit
        7⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\dbf0d53b-5b10-46ae-9cf3-4152c337a88b\build3.exe
        
        "C:\Users\Admin\AppData\Local\dbf0d53b-5b10-46ae-9cf3-4152c337a88b\build3.exe"
        5⤵
        Executes dropped EXE
        
        PID:4884
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1392

C:\Users\Admin\AppData\Local\Temp\BCDE.exe
C:\Users\Admin\AppData\Local\Temp\BCDE.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start rundll32 "C:\ProgramData\schk.dll" SystemCheck
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\rundll32.exe
    rundll32 "C:\ProgramData\schk.dll" SystemCheck
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "get-wmiobject win32_computersystem | select-object -expandproperty domain"
      4⤵
      PID:764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& nslookup myip.opendns.com resolver1.opendns.com"
      4⤵
      PID:4052
    - - C:\Windows\system32\nslookup.exe
        
        "C:\Windows\system32\nslookup.exe" myip.opendns.com resolver1.opendns.com
        5⤵
        
        PID:3624

C:\Users\Admin\AppData\Local\Temp\C154.exe
C:\Users\Admin\AppData\Local\Temp\C154.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3500

C:\Users\Admin\AppData\Local\Temp\C2BC.exe
C:\Users\Admin\AppData\Local\Temp\C2BC.exe
1⤵
- Executes dropped EXE
PID:3376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 344
  2⤵
  - Program crash
  PID:3224

C:\Users\Admin\AppData\Local\Temp\CE08.exe
C:\Users\Admin\AppData\Local\Temp\CE08.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 304
    3⤵
    - Program crash
    PID:3844
- C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
  "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\liuc.exe
  "C:\Users\Admin\AppData\Local\Temp\liuc.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Users\Admin\AppData\Local\Temp\liuc.exe
    "C:\Users\Admin\AppData\Local\Temp\liuc.exe" -h
    3⤵
    - Executes dropped EXE
    PID:1552
- C:\Users\Admin\AppData\Local\Temp\Player3.exe
  "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
  2⤵
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:2428
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3480
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
      4⤵
      PID:4908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4648
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        5⤵
        
        PID:2764
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        5⤵
        
        PID:3328
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:456
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:N"
        5⤵
        
        PID:1516
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:R" /E
        5⤵
        
        PID:3988
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2292
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:2844
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2844 -s 680
        6⤵
        Program crash
        
        PID:4812

C:\Users\Admin\AppData\Local\Temp\D433.exe
C:\Users\Admin\AppData\Local\Temp\D433.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 340
    3⤵
    - Program crash
    PID:320
- C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
  "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\liuc.exe
  "C:\Users\Admin\AppData\Local\Temp\liuc.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:1420
- - C:\Users\Admin\AppData\Local\Temp\liuc.exe
    "C:\Users\Admin\AppData\Local\Temp\liuc.exe" -h
    3⤵
    - Executes dropped EXE
    PID:4244
- C:\Users\Admin\AppData\Local\Temp\Player3.exe
  "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
    3⤵
    - Executes dropped EXE
    PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1620 -ip 1620
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3376 -ip 3376
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2580 -ip 2580
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3456 -ip 3456
1⤵
PID:4588

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:2812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 600
    3⤵
    - Program crash
    PID:4456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Loads dropped DLL
PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 600
  2⤵
  - Program crash
  PID:1564

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3108 -ip 3108
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2812 -ip 2812
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
- Executes dropped EXE
PID:796

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:2436
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3172

C:\Users\Admin\AppData\Local\Temp\C914.exe
C:\Users\Admin\AppData\Local\Temp\C914.exe
1⤵
- Executes dropped EXE
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rqdarrhtrsoihy.dll,start
  2⤵
  - Loads dropped DLL
  PID:3552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 412
  2⤵
  - Program crash
  PID:4008

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 2844 -ip 2844
1⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\1531.exe
C:\Users\Admin\AppData\Local\Temp\1531.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2144

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2376 -ip 2376
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery