amadey | 88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	5B81.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	675A.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	E69C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	E69C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	build2.exe

Executes dropped EXE 15 IoCs

pid	Process
4584	E69C.exe
4704	E8B0.exe
864	E69C.exe
3940	E69C.exe
3084	E69C.exe
4944	build2.exe
916	build2.exe
1016	build3.exe
1420	598C.exe
5108	5CF9.exe
2008	5B81.exe
532	675A.exe
4532	5B81.exe
4872	699D.exe
1808	5B81.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4496	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\29a82758-28e9-4c4a-9933-d3a0c6c628bf\\E69C.exe\" --AutoStart"	E69C.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
100	api.2ip.ua
105	api.2ip.ua
122	api.2ip.ua
132	api.2ip.ua
52	api.2ip.ua
54	api.2ip.ua
63	api.2ip.ua
66	api.2ip.ua

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 864	4584	E69C.exe	93
PID 3940 set thread context of 3084	3940	E69C.exe	98
PID 4944 set thread context of 916	4944	build2.exe	100
PID 2008 set thread context of 4532	2008	5B81.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1956	4872	WerFault.exe	113
1568	2020	WerFault.exe	143
2808	5016	WerFault.exe	145
2144	5108	WerFault.exe	109
4476	432	WerFault.exe	177
1732	2280	WerFault.exe	183

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E8B0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E8B0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E8B0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	598C.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	598C.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	598C.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3584	schtasks.exe
1084	schtasks.exe
4356	schtasks.exe
4764	schtasks.exe
3652	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2556	timeout.exe
5092	timeout.exe
3332	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	167	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2648	88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe
2648	88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found
3228	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3228	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2648	88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe
4704	E8B0.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3228	Process not Found
Token: SeCreatePagefilePrivilege	3228	Process not Found
Token: SeShutdownPrivilege	3228	Process not Found
Token: SeCreatePagefilePrivilege	3228	Process not Found
Token: SeShutdownPrivilege	3228	Process not Found
Token: SeCreatePagefilePrivilege	3228	Process not Found
Token: SeShutdownPrivilege	3228	Process not Found
Token: SeCreatePagefilePrivilege	3228	Process not Found
Token: SeShutdownPrivilege	3228	Process not Found
Token: SeCreatePagefilePrivilege	3228	Process not Found
Token: SeShutdownPrivilege	3228	Process not Found
Token: SeCreatePagefilePrivilege	3228	Process not Found
Token: SeShutdownPrivilege	3228	Process not Found
Token: SeCreatePagefilePrivilege	3228	Process not Found
Token: SeDebugPrivilege	5108	5CF9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4584	3228	Process not Found	91
PID 3228 wrote to memory of 4584	3228	Process not Found	91
PID 3228 wrote to memory of 4584	3228	Process not Found	91
PID 3228 wrote to memory of 4704	3228	Process not Found	92
PID 3228 wrote to memory of 4704	3228	Process not Found	92
PID 3228 wrote to memory of 4704	3228	Process not Found	92
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 4584 wrote to memory of 864	4584	E69C.exe	93
PID 864 wrote to memory of 4496	864	E69C.exe	94
PID 864 wrote to memory of 4496	864	E69C.exe	94
PID 864 wrote to memory of 4496	864	E69C.exe	94
PID 864 wrote to memory of 3940	864	E69C.exe	95
PID 864 wrote to memory of 3940	864	E69C.exe	95
PID 864 wrote to memory of 3940	864	E69C.exe	95
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3940 wrote to memory of 3084	3940	E69C.exe	98
PID 3084 wrote to memory of 4944	3084	E69C.exe	99
PID 3084 wrote to memory of 4944	3084	E69C.exe	99
PID 3084 wrote to memory of 4944	3084	E69C.exe	99
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 4944 wrote to memory of 916	4944	build2.exe	100
PID 3084 wrote to memory of 1016	3084	E69C.exe	101
PID 3084 wrote to memory of 1016	3084	E69C.exe	101
PID 3084 wrote to memory of 1016	3084	E69C.exe	101
PID 1016 wrote to memory of 1084	1016	build3.exe	102
PID 1016 wrote to memory of 1084	1016	build3.exe	102
PID 1016 wrote to memory of 1084	1016	build3.exe	102
PID 4936 wrote to memory of 2556	4936	cmd.exe	107
PID 4936 wrote to memory of 2556	4936	cmd.exe	107
PID 4936 wrote to memory of 2556	4936	cmd.exe	107
PID 3228 wrote to memory of 1420	3228	Process not Found	108
PID 3228 wrote to memory of 1420	3228	Process not Found	108
PID 3228 wrote to memory of 1420	3228	Process not Found	108
PID 3228 wrote to memory of 5108	3228	Process not Found	109
PID 3228 wrote to memory of 5108	3228	Process not Found	109
PID 3228 wrote to memory of 5108	3228	Process not Found	109
PID 3228 wrote to memory of 2008	3228	Process not Found	110
PID 3228 wrote to memory of 2008	3228	Process not Found	110
PID 3228 wrote to memory of 2008	3228	Process not Found	110
PID 3228 wrote to memory of 532	3228	Process not Found	111
PID 3228 wrote to memory of 532	3228	Process not Found	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe
"C:\Users\Admin\AppData\Local\Temp\88d15fc89f2f45a4b09ede5c715a57016519da8264306196743ad7740ed96ecd.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2648

C:\Users\Admin\AppData\Local\Temp\E69C.exe
C:\Users\Admin\AppData\Local\Temp\E69C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\E69C.exe
  C:\Users\Admin\AppData\Local\Temp\E69C.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\29a82758-28e9-4c4a-9933-d3a0c6c628bf" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\E69C.exe
    "C:\Users\Admin\AppData\Local\Temp\E69C.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\E69C.exe
      "C:\Users\Admin\AppData\Local\Temp\E69C.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3084
    - - C:\Users\Admin\AppData\Local\2140e962-9e11-4eb7-b7ba-64c51501c923\build2.exe
        
        "C:\Users\Admin\AppData\Local\2140e962-9e11-4eb7-b7ba-64c51501c923\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4944
      - C:\Users\Admin\AppData\Local\2140e962-9e11-4eb7-b7ba-64c51501c923\build2.exe
        
        "C:\Users\Admin\AppData\Local\2140e962-9e11-4eb7-b7ba-64c51501c923\build2.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Checks processor information in registry
        
        PID:916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\2140e962-9e11-4eb7-b7ba-64c51501c923\build2.exe" & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\2140e962-9e11-4eb7-b7ba-64c51501c923\build3.exe
        
        "C:\Users\Admin\AppData\Local\2140e962-9e11-4eb7-b7ba-64c51501c923\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1016
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1084

C:\Users\Admin\AppData\Local\Temp\E8B0.exe
C:\Users\Admin\AppData\Local\Temp\E8B0.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4704

C:\Users\Admin\AppData\Local\Temp\598C.exe
C:\Users\Admin\AppData\Local\Temp\598C.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1420

C:\Users\Admin\AppData\Local\Temp\5CF9.exe
C:\Users\Admin\AppData\Local\Temp\5CF9.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 1288
  2⤵
  - Program crash
  PID:2144

C:\Users\Admin\AppData\Local\Temp\5B81.exe
C:\Users\Admin\AppData\Local\Temp\5B81.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2008
- C:\Users\Admin\AppData\Local\Temp\5B81.exe
  C:\Users\Admin\AppData\Local\Temp\5B81.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\5B81.exe
    "C:\Users\Admin\AppData\Local\Temp\5B81.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\5B81.exe
      "C:\Users\Admin\AppData\Local\Temp\5B81.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:3832
    - - C:\Users\Admin\AppData\Local\e6ee9ea2-23d1-4126-ac56-c1d96cf5789d\build2.exe
        
        "C:\Users\Admin\AppData\Local\e6ee9ea2-23d1-4126-ac56-c1d96cf5789d\build2.exe"
        5⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\e6ee9ea2-23d1-4126-ac56-c1d96cf5789d\build2.exe
        
        "C:\Users\Admin\AppData\Local\e6ee9ea2-23d1-4126-ac56-c1d96cf5789d\build2.exe"
        6⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\e6ee9ea2-23d1-4126-ac56-c1d96cf5789d\build2.exe" & exit
        7⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\e6ee9ea2-23d1-4126-ac56-c1d96cf5789d\build3.exe
        
        "C:\Users\Admin\AppData\Local\e6ee9ea2-23d1-4126-ac56-c1d96cf5789d\build3.exe"
        5⤵
        
        PID:4884
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:4764

C:\Users\Admin\AppData\Local\Temp\675A.exe
C:\Users\Admin\AppData\Local\Temp\675A.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:532
- C:\Users\Admin\AppData\Local\Temp\lgz.exe
  "C:\Users\Admin\AppData\Local\Temp\lgz.exe"
  2⤵
  PID:3752
- - C:\Users\Admin\AppData\Local\Temp\lgz.exe
    "C:\Users\Admin\AppData\Local\Temp\lgz.exe" -h
    3⤵
    PID:5092
- C:\Users\Admin\AppData\Local\Temp\Player3.exe
  "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
  2⤵
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
    3⤵
    PID:1412
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
      4⤵
      PID:3984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1056
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        5⤵
        
        PID:4800
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        5⤵
        
        PID:1064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4644
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:N"
        5⤵
        
        PID:3144
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:R" /E
        5⤵
        
        PID:3308
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
      4⤵
      PID:2328
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        5⤵
        
        PID:432
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 432 -s 644
        6⤵
        Program crash
        
        PID:4476
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
      4⤵
      PID:4148
- C:\Users\Admin\AppData\Local\Temp\ss31.exe
  "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
  2⤵
  PID:5032

C:\Users\Admin\AppData\Local\Temp\699D.exe
C:\Users\Admin\AppData\Local\Temp\699D.exe
1⤵
- Executes dropped EXE
PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1172
  2⤵
  - Program crash
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\lgz.exe
  "C:\Users\Admin\AppData\Local\Temp\lgz.exe"
  2⤵
  PID:1836
- - C:\Users\Admin\AppData\Local\Temp\lgz.exe
    "C:\Users\Admin\AppData\Local\Temp\lgz.exe" -h
    3⤵
    PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4872 -ip 4872
1⤵
PID:384

C:\Users\Admin\AppData\Local\Temp\7789.exe
C:\Users\Admin\AppData\Local\Temp\7789.exe
1⤵
PID:1732
- C:\Users\Admin\AppData\Local\Temp\7789.exe
  C:\Users\Admin\AppData\Local\Temp\7789.exe
  2⤵
  PID:756
- - C:\Users\Admin\AppData\Local\Temp\7789.exe
    "C:\Users\Admin\AppData\Local\Temp\7789.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\7789.exe
      "C:\Users\Admin\AppData\Local\Temp\7789.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:4156
    - - C:\Users\Admin\AppData\Local\d0b425b8-f482-4e8e-a459-e01d26903554\build2.exe
        
        "C:\Users\Admin\AppData\Local\d0b425b8-f482-4e8e-a459-e01d26903554\build2.exe"
        5⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\d0b425b8-f482-4e8e-a459-e01d26903554\build2.exe
        
        "C:\Users\Admin\AppData\Local\d0b425b8-f482-4e8e-a459-e01d26903554\build2.exe"
        6⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\d0b425b8-f482-4e8e-a459-e01d26903554\build2.exe" & exit
        7⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\d0b425b8-f482-4e8e-a459-e01d26903554\build3.exe
        
        "C:\Users\Admin\AppData\Local\d0b425b8-f482-4e8e-a459-e01d26903554\build3.exe"
        5⤵
        
        PID:4112
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:3652

C:\Users\Admin\AppData\Local\Temp\7E40.exe
C:\Users\Admin\AppData\Local\Temp\7E40.exe
1⤵
PID:4956
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  PID:1260

C:\Users\Admin\AppData\Local\Temp\80D2.exe
C:\Users\Admin\AppData\Local\Temp\80D2.exe
1⤵
PID:4564

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 600
    3⤵
    - Program crash
    PID:1568

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:4576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 608
    3⤵
    - Program crash
    PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5016 -ip 5016
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2020 -ip 2020
1⤵
PID:4568

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:1368
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3584

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5108 -ip 5108
1⤵
PID:1460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 432 -ip 432
1⤵
PID:1360

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
PID:1196

C:\Users\Admin\AppData\Roaming\chitabr
C:\Users\Admin\AppData\Roaming\chitabr
1⤵
PID:872

C:\Users\Admin\AppData\Roaming\ititabr
C:\Users\Admin\AppData\Roaming\ititabr
1⤵
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 448
  2⤵
  - Program crash
  PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2280 -ip 2280
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery