amadey | ba7d7b08570791de7be1dde3df48ec5f6c0c30729defdb9063cdd4ca955e74cc

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	91727117241811693969.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	E574.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	E237.exe

Executes dropped EXE 12 IoCs

pid	Process
3016	E237.exe
3796	E574.exe
1408	oneetx.exe
4404	91727117241811693969.exe
3196	51262673181872436380.exe
1088	91727117241811693969.exe
3660	svcservice.exe
1504	oneetx.exe
1256	oneetx.exe
1208	svcservice.exe
4524	oneetx.exe
2032	oneetx.exe

Loads dropped DLL 8 IoCs

pid	Process
3016	E237.exe
3016	E237.exe
744	rundll32.exe
4036	rundll32.exe
2236	rundll32.exe
1380	rundll32.exe
4176	rundll32.exe
4300	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023140-710.dat	upx
behavioral2/files/0x000b000000023140-715.dat	upx
behavioral2/files/0x000b000000023140-714.dat	upx
behavioral2/memory/3196-742-0x00000000007B0000-0x0000000001613000-memory.dmp	upx

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	91727117241811693969.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4404 set thread context of 1088	4404	91727117241811693969.exe	175
PID 3660 set thread context of 1208	3660	svcservice.exe	203

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 42 IoCs

pid	pid_target	Process	procid_target
4420	3796	WerFault.exe	92
4972	3796	WerFault.exe	92
3136	3796	WerFault.exe	92
832	3796	WerFault.exe	92
3736	3796	WerFault.exe	92
4628	3796	WerFault.exe	92
2728	3796	WerFault.exe	92
3308	3796	WerFault.exe	92
924	3796	WerFault.exe	92
5076	3796	WerFault.exe	92
1216	1408	WerFault.exe	119
3324	1408	WerFault.exe	119
3584	1408	WerFault.exe	119
3912	1408	WerFault.exe	119
3576	1408	WerFault.exe	119
2664	1408	WerFault.exe	119
1424	1408	WerFault.exe	119
2312	1408	WerFault.exe	119
3268	1408	WerFault.exe	119
2516	1408	WerFault.exe	119
4328	1408	WerFault.exe	119
4556	1408	WerFault.exe	119
5108	1408	WerFault.exe	119
4236	1408	WerFault.exe	119
3136	1408	WerFault.exe	119
4884	1408	WerFault.exe	119
924	3016	WerFault.exe	91
4560	1408	WerFault.exe	119
1380	1408	WerFault.exe	119
4656	1408	WerFault.exe	119
3608	1408	WerFault.exe	119
1220	1504	WerFault.exe	179
2180	1408	WerFault.exe	119
60	1408	WerFault.exe	119
3608	4300	WerFault.exe	190
2092	4176	WerFault.exe	189
4236	1380	WerFault.exe	172
4692	1408	WerFault.exe	119
3208	1256	WerFault.exe	200
4816	4524	WerFault.exe	204
744	1408	WerFault.exe	119
4300	2032	WerFault.exe	209

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	s.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	s.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	E237.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	E237.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3660	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3900	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3508	s.exe
3508	s.exe
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3140	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
3508	s.exe
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeDebugPrivilege	4404	91727117241811693969.exe
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3796	E574.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3016	3140	Process not Found	91
PID 3140 wrote to memory of 3016	3140	Process not Found	91
PID 3140 wrote to memory of 3016	3140	Process not Found	91
PID 3140 wrote to memory of 3796	3140	Process not Found	92
PID 3140 wrote to memory of 3796	3140	Process not Found	92
PID 3140 wrote to memory of 3796	3140	Process not Found	92
PID 3140 wrote to memory of 4952	3140	Process not Found	95
PID 3140 wrote to memory of 4952	3140	Process not Found	95
PID 3140 wrote to memory of 4952	3140	Process not Found	95
PID 3140 wrote to memory of 4952	3140	Process not Found	95
PID 3140 wrote to memory of 3396	3140	Process not Found	98
PID 3140 wrote to memory of 3396	3140	Process not Found	98
PID 3140 wrote to memory of 3396	3140	Process not Found	98
PID 3140 wrote to memory of 2492	3140	Process not Found	103
PID 3140 wrote to memory of 2492	3140	Process not Found	103
PID 3140 wrote to memory of 2492	3140	Process not Found	103
PID 3140 wrote to memory of 2492	3140	Process not Found	103
PID 3140 wrote to memory of 3028	3140	Process not Found	109
PID 3140 wrote to memory of 3028	3140	Process not Found	109
PID 3140 wrote to memory of 3028	3140	Process not Found	109
PID 3140 wrote to memory of 3572	3140	Process not Found	112
PID 3140 wrote to memory of 3572	3140	Process not Found	112
PID 3140 wrote to memory of 3572	3140	Process not Found	112
PID 3140 wrote to memory of 3572	3140	Process not Found	112
PID 3140 wrote to memory of 1404	3140	Process not Found	115
PID 3140 wrote to memory of 1404	3140	Process not Found	115
PID 3140 wrote to memory of 1404	3140	Process not Found	115
PID 3140 wrote to memory of 1404	3140	Process not Found	115
PID 3140 wrote to memory of 1460	3140	Process not Found	118
PID 3140 wrote to memory of 1460	3140	Process not Found	118
PID 3140 wrote to memory of 1460	3140	Process not Found	118
PID 3140 wrote to memory of 1460	3140	Process not Found	118
PID 3796 wrote to memory of 1408	3796	E574.exe	119
PID 3796 wrote to memory of 1408	3796	E574.exe	119
PID 3796 wrote to memory of 1408	3796	E574.exe	119
PID 3140 wrote to memory of 4048	3140	Process not Found	122
PID 3140 wrote to memory of 4048	3140	Process not Found	122
PID 3140 wrote to memory of 4048	3140	Process not Found	122
PID 3140 wrote to memory of 4844	3140	Process not Found	125
PID 3140 wrote to memory of 4844	3140	Process not Found	125
PID 3140 wrote to memory of 4844	3140	Process not Found	125
PID 3140 wrote to memory of 4844	3140	Process not Found	125
PID 3016 wrote to memory of 4404	3016	E237.exe	132
PID 3016 wrote to memory of 4404	3016	E237.exe	132
PID 3016 wrote to memory of 4404	3016	E237.exe	132
PID 1408 wrote to memory of 3660	1408	oneetx.exe	142
PID 1408 wrote to memory of 3660	1408	oneetx.exe	142
PID 1408 wrote to memory of 3660	1408	oneetx.exe	142
PID 3016 wrote to memory of 3196	3016	E237.exe	158
PID 3016 wrote to memory of 3196	3016	E237.exe	158
PID 3196 wrote to memory of 4512	3196	51262673181872436380.exe	161
PID 3196 wrote to memory of 4512	3196	51262673181872436380.exe	161
PID 4512 wrote to memory of 4280	4512	cmd.exe	163
PID 4512 wrote to memory of 4280	4512	cmd.exe	163
PID 3016 wrote to memory of 4548	3016	E237.exe	165
PID 3016 wrote to memory of 4548	3016	E237.exe	165
PID 3016 wrote to memory of 4548	3016	E237.exe	165
PID 4548 wrote to memory of 3900	4548	cmd.exe	171
PID 4548 wrote to memory of 3900	4548	cmd.exe	171
PID 4548 wrote to memory of 3900	4548	cmd.exe	171
PID 4404 wrote to memory of 1088	4404	91727117241811693969.exe	175
PID 4404 wrote to memory of 1088	4404	91727117241811693969.exe	175
PID 4404 wrote to memory of 1088	4404	91727117241811693969.exe	175
PID 4404 wrote to memory of 1088	4404	91727117241811693969.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\s.exe
"C:\Users\Admin\AppData\Local\Temp\s.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3508

C:\Users\Admin\AppData\Local\Temp\E237.exe
C:\Users\Admin\AppData\Local\Temp\E237.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3016
- C:\ProgramData\91727117241811693969.exe
  "C:\ProgramData\91727117241811693969.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\ProgramData\91727117241811693969.exe
    "C:\ProgramData\91727117241811693969.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1088
  - - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
      "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3660
    - - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
        5⤵
        Executes dropped EXE
        
        PID:1208
- C:\ProgramData\51262673181872436380.exe
  "C:\ProgramData\51262673181872436380.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\51262673181872436380.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 0
      4⤵
      PID:4280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E237.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:3900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2312
  2⤵
  - Program crash
  PID:924

C:\Users\Admin\AppData\Local\Temp\E574.exe
C:\Users\Admin\AppData\Local\Temp\E574.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 568
  2⤵
  - Program crash
  PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 652
  2⤵
  - Program crash
  PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 752
  2⤵
  - Program crash
  PID:3136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 816
  2⤵
  - Program crash
  PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 852
  2⤵
  - Program crash
  PID:3736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 824
  2⤵
  - Program crash
  PID:4628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1104
  2⤵
  - Program crash
  PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1128
  2⤵
  - Program crash
  PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1128
  2⤵
  - Program crash
  PID:924
- C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 528
    3⤵
    - Program crash
    PID:1216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 832
    3⤵
    - Program crash
    PID:3324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 840
    3⤵
    - Program crash
    PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 840
    3⤵
    - Program crash
    PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1012
    3⤵
    - Program crash
    PID:3576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 976
    3⤵
    - Program crash
    PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1040
    3⤵
    - Program crash
    PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 984
    3⤵
    - Program crash
    PID:2312
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:3660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 912
    3⤵
    - Program crash
    PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1212
    3⤵
    - Program crash
    PID:2516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 528
    3⤵
    - Program crash
    PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 676
    3⤵
    - Program crash
    PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1156
    3⤵
    - Program crash
    PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 792
    3⤵
    - Program crash
    PID:4236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 672
    3⤵
    - Program crash
    PID:3136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 912
    3⤵
    - Program crash
    PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1352
    3⤵
    - Program crash
    PID:4560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1360
    3⤵
    - Program crash
    PID:1380
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1380 -s 644
      4⤵
      Program crash
      PID:4236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1572
    3⤵
    - Program crash
    PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1028
    3⤵
    - Program crash
    PID:3608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1700
    3⤵
    - Program crash
    PID:2180
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:2236
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4176
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4176 -s 644
        5⤵
        Program crash
        
        PID:2092
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:744
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1380
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4036
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\396554bad854c4\cred64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4300
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4300 -s 644
        5⤵
        Program crash
        
        PID:3608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 676
    3⤵
    - Program crash
    PID:60
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1684
    3⤵
    - Program crash
    PID:4692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1476
    3⤵
    - Program crash
    PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1588
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3796 -ip 3796
1⤵
PID:4036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3796 -ip 3796
1⤵
PID:4772

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3796 -ip 3796
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3796 -ip 3796
1⤵
PID:3956

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3796 -ip 3796
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3796 -ip 3796
1⤵
PID:4696

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3796 -ip 3796
1⤵
PID:1796

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3796 -ip 3796
1⤵
PID:3260

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3796 -ip 3796
1⤵
PID:1508

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3796 -ip 3796
1⤵
PID:4948

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1408 -ip 1408
1⤵
PID:2324

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1408 -ip 1408
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1408 -ip 1408
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1408 -ip 1408
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1408 -ip 1408
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1408 -ip 1408
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1408 -ip 1408
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1408 -ip 1408
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1408 -ip 1408
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1408 -ip 1408
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1408 -ip 1408
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1408 -ip 1408
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1408 -ip 1408
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1408 -ip 1408
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1408 -ip 1408
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1408 -ip 1408
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1408 -ip 1408
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3016 -ip 3016
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1408 -ip 1408
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1408 -ip 1408
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1408 -ip 1408
1⤵
PID:4660

C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
1⤵
- Executes dropped EXE
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 416
  2⤵
  - Program crash
  PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1504 -ip 1504
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1408 -ip 1408
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1408 -ip 1408
1⤵
PID:3324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 4176 -ip 4176
1⤵
PID:3736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 4300 -ip 4300
1⤵
PID:2408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 1380 -ip 1380
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1408 -ip 1408
1⤵
PID:3320

C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
1⤵
- Executes dropped EXE
PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 416
  2⤵
  - Program crash
  PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1256 -ip 1256
1⤵
PID:5112

C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
1⤵
- Executes dropped EXE
PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 416
  2⤵
  - Program crash
  PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4524 -ip 4524
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1408 -ip 1408
1⤵
PID:3168

C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cfe42aa7a6\oneetx.exe
1⤵
- Executes dropped EXE
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 308
  2⤵
  - Program crash
  PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2032 -ip 2032
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery