amadey | 35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	59727666462544262512.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	594C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	56AB.exe

Executes dropped EXE 11 IoCs

pid	Process
4412	56AB.exe
1304	594C.exe
3220	oneetx.exe
980	59727666462544262512.exe
3344	43047878231200440936.exe
3148	59727666462544262512.exe
3908	oneetx.exe
4448	trvrigr
4224	svcservice.exe
1312	oneetx.exe
376	svcservice.exe

Loads dropped DLL 8 IoCs

pid	Process
4412	56AB.exe
4412	56AB.exe
3832	rundll32.exe
4892	rundll32.exe
5028	rundll32.exe
4788	rundll32.exe
1684	rundll32.exe
1964	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0004000000023122-537.dat	upx
behavioral1/files/0x0004000000023122-542.dat	upx
behavioral1/files/0x0004000000023122-541.dat	upx
behavioral1/memory/3344-554-0x0000000000270000-0x00000000010D3000-memory.dmp	upx
behavioral1/memory/3344-573-0x0000000000270000-0x00000000010D3000-memory.dmp	upx

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	59727666462544262512.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 980 set thread context of 3148	980	59727666462544262512.exe	174
PID 4224 set thread context of 376	4224	svcservice.exe	203

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 39 IoCs

pid	pid_target	Process	procid_target
3808	1304	WerFault.exe	91
5000	1304	WerFault.exe	91
4516	1304	WerFault.exe	91
2876	1304	WerFault.exe	91
4600	1304	WerFault.exe	91
4988	1304	WerFault.exe	91
1764	1304	WerFault.exe	91
1544	1304	WerFault.exe	91
2532	1304	WerFault.exe	91
1512	1304	WerFault.exe	91
1252	3220	WerFault.exe	119
4228	3220	WerFault.exe	119
4644	3220	WerFault.exe	119
5084	3220	WerFault.exe	119
4180	3220	WerFault.exe	119
1992	3220	WerFault.exe	119
4228	3220	WerFault.exe	119
4720	3220	WerFault.exe	119
4008	4412	WerFault.exe	90
4996	3220	WerFault.exe	119
2700	3220	WerFault.exe	119
4144	3220	WerFault.exe	119
2960	3220	WerFault.exe	119
3336	3220	WerFault.exe	119
488	3220	WerFault.exe	119
2748	3220	WerFault.exe	119
2008	3220	WerFault.exe	119
1424	3220	WerFault.exe	119
4556	3220	WerFault.exe	119
1684	3220	WerFault.exe	119
1636	3908	WerFault.exe	175
644	3220	WerFault.exe	119
2784	3220	WerFault.exe	119
1572	3220	WerFault.exe	119
2532	1684	WerFault.exe	188
564	1964	WerFault.exe	191
2476	5028	WerFault.exe	187
3344	1312	WerFault.exe	198
1604	3220	WerFault.exe	119

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	trvrigr
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	trvrigr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	trvrigr

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	56AB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	56AB.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4200	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1308	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe
2532	35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3136	Process not Found

Suspicious behavior: MapViewOfSection 20 IoCs

pid	Process
2532	35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
3136	Process not Found
4448	trvrigr

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeDebugPrivilege	980	59727666462544262512.exe
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found
Token: SeCreatePagefilePrivilege	3136	Process not Found
Token: SeShutdownPrivilege	3136	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	594C.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4412	3136	Process not Found	90
PID 3136 wrote to memory of 4412	3136	Process not Found	90
PID 3136 wrote to memory of 4412	3136	Process not Found	90
PID 3136 wrote to memory of 1304	3136	Process not Found	91
PID 3136 wrote to memory of 1304	3136	Process not Found	91
PID 3136 wrote to memory of 1304	3136	Process not Found	91
PID 3136 wrote to memory of 1144	3136	Process not Found	94
PID 3136 wrote to memory of 1144	3136	Process not Found	94
PID 3136 wrote to memory of 1144	3136	Process not Found	94
PID 3136 wrote to memory of 1144	3136	Process not Found	94
PID 3136 wrote to memory of 1492	3136	Process not Found	98
PID 3136 wrote to memory of 1492	3136	Process not Found	98
PID 3136 wrote to memory of 1492	3136	Process not Found	98
PID 3136 wrote to memory of 4972	3136	Process not Found	102
PID 3136 wrote to memory of 4972	3136	Process not Found	102
PID 3136 wrote to memory of 4972	3136	Process not Found	102
PID 3136 wrote to memory of 4972	3136	Process not Found	102
PID 3136 wrote to memory of 4552	3136	Process not Found	106
PID 3136 wrote to memory of 4552	3136	Process not Found	106
PID 3136 wrote to memory of 4552	3136	Process not Found	106
PID 3136 wrote to memory of 484	3136	Process not Found	109
PID 3136 wrote to memory of 484	3136	Process not Found	109
PID 3136 wrote to memory of 484	3136	Process not Found	109
PID 3136 wrote to memory of 484	3136	Process not Found	109
PID 3136 wrote to memory of 1860	3136	Process not Found	112
PID 3136 wrote to memory of 1860	3136	Process not Found	112
PID 3136 wrote to memory of 1860	3136	Process not Found	112
PID 3136 wrote to memory of 1860	3136	Process not Found	112
PID 3136 wrote to memory of 4080	3136	Process not Found	115
PID 3136 wrote to memory of 4080	3136	Process not Found	115
PID 3136 wrote to memory of 4080	3136	Process not Found	115
PID 3136 wrote to memory of 4080	3136	Process not Found	115
PID 3136 wrote to memory of 3376	3136	Process not Found	118
PID 3136 wrote to memory of 3376	3136	Process not Found	118
PID 3136 wrote to memory of 3376	3136	Process not Found	118
PID 1304 wrote to memory of 3220	1304	594C.exe	119
PID 1304 wrote to memory of 3220	1304	594C.exe	119
PID 1304 wrote to memory of 3220	1304	594C.exe	119
PID 3136 wrote to memory of 1048	3136	Process not Found	122
PID 3136 wrote to memory of 1048	3136	Process not Found	122
PID 3136 wrote to memory of 1048	3136	Process not Found	122
PID 3136 wrote to memory of 1048	3136	Process not Found	122
PID 4412 wrote to memory of 980	4412	56AB.exe	123
PID 4412 wrote to memory of 980	4412	56AB.exe	123
PID 4412 wrote to memory of 980	4412	56AB.exe	123
PID 4412 wrote to memory of 3344	4412	56AB.exe	139
PID 4412 wrote to memory of 3344	4412	56AB.exe	139
PID 3344 wrote to memory of 4600	3344	43047878231200440936.exe	160
PID 3344 wrote to memory of 4600	3344	43047878231200440936.exe	160
PID 4412 wrote to memory of 4988	4412	56AB.exe	144
PID 4412 wrote to memory of 4988	4412	56AB.exe	144
PID 4412 wrote to memory of 4988	4412	56AB.exe	144
PID 4600 wrote to memory of 5108	4600	WerFault.exe	148
PID 4600 wrote to memory of 5108	4600	WerFault.exe	148
PID 3220 wrote to memory of 4200	3220	oneetx.exe	149
PID 3220 wrote to memory of 4200	3220	oneetx.exe	149
PID 3220 wrote to memory of 4200	3220	oneetx.exe	149
PID 4988 wrote to memory of 1308	4988	cmd.exe	153
PID 4988 wrote to memory of 1308	4988	cmd.exe	153
PID 4988 wrote to memory of 1308	4988	cmd.exe	153
PID 980 wrote to memory of 3148	980	59727666462544262512.exe	174
PID 980 wrote to memory of 3148	980	59727666462544262512.exe	174
PID 980 wrote to memory of 3148	980	59727666462544262512.exe	174
PID 980 wrote to memory of 3148	980	59727666462544262512.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe
"C:\Users\Admin\AppData\Local\Temp\35b5c184946cb438a09e005c7d5ec94a41fb1cfada0569eafa64ac936aa6afc9.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2532

C:\Users\Admin\AppData\Local\Temp\56AB.exe
C:\Users\Admin\AppData\Local\Temp\56AB.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4412
- C:\ProgramData\59727666462544262512.exe
  "C:\ProgramData\59727666462544262512.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\ProgramData\59727666462544262512.exe
    "C:\ProgramData\59727666462544262512.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3148
  - - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
      "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4224
    - - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
        5⤵
        Executes dropped EXE
        
        PID:376
- C:\ProgramData\43047878231200440936.exe
  "C:\ProgramData\43047878231200440936.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\43047878231200440936.exe
    3⤵
    PID:4600
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 0
      4⤵
      PID:5108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\56AB.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:1308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 2132
  2⤵
  - Program crash
  PID:4008

C:\Users\Admin\AppData\Local\Temp\594C.exe
C:\Users\Admin\AppData\Local\Temp\594C.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 568
  2⤵
  - Program crash
  PID:3808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 656
  2⤵
  - Program crash
  PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 720
  2⤵
  - Program crash
  PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 728
  2⤵
  - Program crash
  PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 728
  2⤵
  - Program crash
  PID:4600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 728
  2⤵
  - Program crash
  PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1112
  2⤵
  - Program crash
  PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1116
  2⤵
  - Program crash
  PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1240
  2⤵
  - Program crash
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 592
    3⤵
    - Program crash
    PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 736
    3⤵
    - Program crash
    PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 960
    3⤵
    - Program crash
    PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 968
    3⤵
    - Program crash
    PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 996
    3⤵
    - Program crash
    PID:4180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1008
    3⤵
    - Program crash
    PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1000
    3⤵
    - Program crash
    PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1028
    3⤵
    - Program crash
    PID:4720
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 892
    3⤵
    - Program crash
    PID:4996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1192
    3⤵
    - Program crash
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 812
    3⤵
    - Program crash
    PID:4144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1220
    3⤵
    - Program crash
    PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1208
    3⤵
    - Program crash
    PID:3336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1296
    3⤵
    - Program crash
    PID:488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1304
    3⤵
    - Program crash
    PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1412
    3⤵
    - Program crash
    PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1412
    3⤵
    - Program crash
    PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 644
    3⤵
    - Program crash
    PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1420
    3⤵
    - Program crash
    PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 972
    3⤵
    - Program crash
    PID:644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1692
    3⤵
    - Program crash
    PID:2784
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4892
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1964
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1964 -s 644
        5⤵
        Program crash
        
        PID:564
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4788
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1684
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1684 -s 644
        5⤵
        Program crash
        
        PID:2532
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:3832
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:5028
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5028 -s 644
        5⤵
        Program crash
        
        PID:2476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 908
    3⤵
    - Program crash
    PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1704
    3⤵
    - Program crash
    PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1172
  2⤵
  - Program crash
  PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1304 -ip 1304
1⤵
PID:4100

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1304 -ip 1304
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1304 -ip 1304
1⤵
PID:892

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1304 -ip 1304
1⤵
PID:5044

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1304 -ip 1304
1⤵
PID:4148

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1304 -ip 1304
1⤵
PID:3496

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1304 -ip 1304
1⤵
PID:2236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1304 -ip 1304
1⤵
PID:4880

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1304 -ip 1304
1⤵
PID:3924

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1304 -ip 1304
1⤵
PID:1564

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3220 -ip 3220
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3220 -ip 3220
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3220 -ip 3220
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3220 -ip 3220
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3220 -ip 3220
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3220 -ip 3220
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3220 -ip 3220
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3220 -ip 3220
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4412 -ip 4412
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3220 -ip 3220
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3220 -ip 3220
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3220 -ip 3220
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3220 -ip 3220
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3220 -ip 3220
1⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3220 -ip 3220
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3220 -ip 3220
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3220 -ip 3220
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3220 -ip 3220
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3220 -ip 3220
1⤵
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3220 -ip 3220
1⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
1⤵
- Executes dropped EXE
PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 416
  2⤵
  - Program crash
  PID:1636

C:\Users\Admin\AppData\Roaming\trvrigr
C:\Users\Admin\AppData\Roaming\trvrigr
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3908 -ip 3908
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3220 -ip 3220
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3220 -ip 3220
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3220 -ip 3220
1⤵
PID:2800

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 1684 -ip 1684
1⤵
PID:2912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 1964 -ip 1964
1⤵
PID:3276

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 5028 -ip 5028
1⤵
PID:3340

C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
1⤵
- Executes dropped EXE
PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 416
  2⤵
  - Program crash
  PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1312 -ip 1312
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3220 -ip 3220
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery