amadey | ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	4AA6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	4862.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	49DA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	9DFA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	B9A5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	410B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	yiueea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	5F68.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	A520.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	BF72.exe

Executes dropped EXE 46 IoCs

pid	Process
3604	410B.exe
3596	42C2.exe
1268	410B.exe
1700	4862.exe
3984	49DA.exe
3740	4AA6.exe
5068	4862.exe
4940	4AA6.exe
4256	49DA.exe
3588	5F68.exe
4400	5F68.exe
1564	CompPkgSrv.exe
4976	5F68.exe
2296	410B.exe
1400	yiueea.exe
4056	4AA6.exe
4136	49DA.exe
4560	msedge.exe
3560	AppLaunch.exe
3112	4AA6.exe
2008	49DA.exe
4832	4862.exe
1784	A231.exe
1036	A520.exe
2276	9DFA.exe
1124	5F68.exe
1196	A520.exe
4976	5F68.exe
2536	AC94.exe
3472	9DFA.exe
2540	B9A5.exe
1904	9DFA.exe
1580	msedge.exe
4864	BF72.exe
4484	B9A5.exe
2916	A520.exe
4188	BF72.exe
2972	CEC6.exe
312	B9A5.exe
4668	D530.exe
2236	B9A5.exe
1580	msedge.exe
884	DB5B.exe
4180	msedge.exe
3044	yiueea.exe
4892	yiueea.exe

Loads dropped DLL 4 IoCs

pid	Process
1060	regsvr32.exe
2972	regsvr32.exe
4612	regsvr32.exe
3260	regsvr32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4348	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6a952961-a95e-48d9-bbe4-38bac63ffe8c\\410B.exe\" --AutoStart"	410B.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
86	api.2ip.ua
97	api.2ip.ua
48	api.2ip.ua
55	api.2ip.ua
67	api.2ip.ua
53	api.2ip.ua
68	api.2ip.ua
49	api.2ip.ua
51	api.2ip.ua
52	api.2ip.ua

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 20 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 1268	3604	410B.exe	92
PID 1700 set thread context of 5068	1700	4862.exe	98
PID 3740 set thread context of 4940	3740	4AA6.exe	99
PID 3984 set thread context of 4256	3984	49DA.exe	100
PID 3588 set thread context of 4400	3588	5F68.exe	104
PID 4976 set thread context of 2296	4976	5F68.exe	110
PID 4056 set thread context of 3112	4056	4AA6.exe	117
PID 4136 set thread context of 2008	4136	49DA.exe	120
PID 4560 set thread context of 4832	4560	msedge.exe	122
PID 3560 set thread context of 2276	3560	AppLaunch.exe	135
PID 1036 set thread context of 1196	1036	A520.exe	143
PID 1124 set thread context of 4976	1124	5F68.exe	140
PID 3472 set thread context of 1904	3472	9DFA.exe	153
PID 2540 set thread context of 4484	2540	B9A5.exe	156
PID 1580 set thread context of 2916	1580	msedge.exe	163
PID 4864 set thread context of 4188	4864	BF72.exe	165
PID 312 set thread context of 2236	312	B9A5.exe	180
PID 1580 set thread context of 4180	1580	msedge.exe	203
PID 2972 set thread context of 3560	2972	CEC6.exe	186
PID 4668 set thread context of 4892	4668	D530.exe	190

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
1580	2296	WerFault.exe	110
3076	2296	WerFault.exe	110
4816	4832	WerFault.exe	122
3172	3112	WerFault.exe	117
4348	2008	WerFault.exe	120
5084	4976	WerFault.exe	140
884	1904	WerFault.exe	153
488	2916	WerFault.exe	163
3124	2236	WerFault.exe	180
3536	2972	WerFault.exe	175
4564	4180	WerFault.exe	185
1052	4668	WerFault.exe	178

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2460	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4560	ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe
4560	ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found
3080	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3080	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4560	ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found
Token: SeShutdownPrivilege	3080	Process not Found
Token: SeCreatePagefilePrivilege	3080	Process not Found

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
3080	Process not Found
3080	Process not Found

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 3604	3080	Process not Found	89
PID 3080 wrote to memory of 3604	3080	Process not Found	89
PID 3080 wrote to memory of 3604	3080	Process not Found	89
PID 3080 wrote to memory of 3596	3080	Process not Found	90
PID 3080 wrote to memory of 3596	3080	Process not Found	90
PID 3080 wrote to memory of 3596	3080	Process not Found	90
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3604 wrote to memory of 1268	3604	410B.exe	92
PID 3080 wrote to memory of 4620	3080	Process not Found	93
PID 3080 wrote to memory of 4620	3080	Process not Found	93
PID 4620 wrote to memory of 1060	4620	regsvr32.exe	94
PID 4620 wrote to memory of 1060	4620	regsvr32.exe	94
PID 4620 wrote to memory of 1060	4620	regsvr32.exe	94
PID 3080 wrote to memory of 1904	3080	Process not Found	95
PID 3080 wrote to memory of 1904	3080	Process not Found	95
PID 3080 wrote to memory of 1700	3080	Process not Found	96
PID 3080 wrote to memory of 1700	3080	Process not Found	96
PID 3080 wrote to memory of 1700	3080	Process not Found	96
PID 1904 wrote to memory of 2972	1904	regsvr32.exe	97
PID 1904 wrote to memory of 2972	1904	regsvr32.exe	97
PID 1904 wrote to memory of 2972	1904	regsvr32.exe	97
PID 3080 wrote to memory of 3984	3080	Process not Found	102
PID 3080 wrote to memory of 3984	3080	Process not Found	102
PID 3080 wrote to memory of 3984	3080	Process not Found	102
PID 3080 wrote to memory of 3740	3080	Process not Found	101
PID 3080 wrote to memory of 3740	3080	Process not Found	101
PID 3080 wrote to memory of 3740	3080	Process not Found	101
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 1700 wrote to memory of 5068	1700	4862.exe	98
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3740 wrote to memory of 4940	3740	4AA6.exe	99
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100
PID 3984 wrote to memory of 4256	3984	49DA.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe
"C:\Users\Admin\AppData\Local\Temp\ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4560

C:\Users\Admin\AppData\Local\Temp\410B.exe
C:\Users\Admin\AppData\Local\Temp\410B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\410B.exe
  C:\Users\Admin\AppData\Local\Temp\410B.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1268
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\6a952961-a95e-48d9-bbe4-38bac63ffe8c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\410B.exe
    "C:\Users\Admin\AppData\Local\Temp\410B.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\410B.exe
      "C:\Users\Admin\AppData\Local\Temp\410B.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 568
        5⤵
        Program crash
        
        PID:1580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 568
        5⤵
        Program crash
        
        PID:3076

C:\Users\Admin\AppData\Local\Temp\42C2.exe
C:\Users\Admin\AppData\Local\Temp\42C2.exe
1⤵
- Executes dropped EXE
PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=42C2.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97db846f8,0x7ff97db84708,0x7ff97db84718
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    - Executes dropped EXE
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13816154808821178485,15970483688525613099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=42C2.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97db846f8,0x7ff97db84708,0x7ff97db84718
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13269126774295374206,7301098322617827837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:1264

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4572.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4572.dll
  2⤵
  - Loads dropped DLL
  PID:1060

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4796.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4796.dll
  2⤵
  - Loads dropped DLL
  PID:2972

C:\Users\Admin\AppData\Local\Temp\4862.exe
C:\Users\Admin\AppData\Local\Temp\4862.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\4862.exe
  C:\Users\Admin\AppData\Local\Temp\4862.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5068
- - C:\Users\Admin\AppData\Local\Temp\4862.exe
    "C:\Users\Admin\AppData\Local\Temp\4862.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\4862.exe
      "C:\Users\Admin\AppData\Local\Temp\4862.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:4832
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 568
        5⤵
        Program crash
        
        PID:4816

C:\Users\Admin\AppData\Local\Temp\4AA6.exe
C:\Users\Admin\AppData\Local\Temp\4AA6.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4940
- C:\Users\Admin\AppData\Local\Temp\4AA6.exe
  "C:\Users\Admin\AppData\Local\Temp\4AA6.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4056
- - C:\Users\Admin\AppData\Local\Temp\4AA6.exe
    "C:\Users\Admin\AppData\Local\Temp\4AA6.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    PID:3112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 568
      4⤵
      Program crash
      PID:3172

C:\Users\Admin\AppData\Local\Temp\49DA.exe
C:\Users\Admin\AppData\Local\Temp\49DA.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4256
- C:\Users\Admin\AppData\Local\Temp\49DA.exe
  "C:\Users\Admin\AppData\Local\Temp\49DA.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\49DA.exe
    "C:\Users\Admin\AppData\Local\Temp\49DA.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    PID:2008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 568
      4⤵
      Program crash
      PID:4348

C:\Users\Admin\AppData\Local\Temp\4AA6.exe
C:\Users\Admin\AppData\Local\Temp\4AA6.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3740

C:\Users\Admin\AppData\Local\Temp\49DA.exe
C:\Users\Admin\AppData\Local\Temp\49DA.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3984

C:\Users\Admin\AppData\Local\Temp\5F68.exe
C:\Users\Admin\AppData\Local\Temp\5F68.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3588
- C:\Users\Admin\AppData\Local\Temp\5F68.exe
  C:\Users\Admin\AppData\Local\Temp\5F68.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\5F68.exe
    "C:\Users\Admin\AppData\Local\Temp\5F68.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\5F68.exe
      "C:\Users\Admin\AppData\Local\Temp\5F68.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 568
        5⤵
        Program crash
        
        PID:5084

C:\Users\Admin\AppData\Local\Temp\67C6.exe
C:\Users\Admin\AppData\Local\Temp\67C6.exe
1⤵
PID:1564
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1400
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
    3⤵
    PID:1916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:N"
      4⤵
      PID:4900
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:R" /E
      4⤵
      PID:3368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5080
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:N"
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:R" /E
      4⤵
      PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2296 -ip 2296
1⤵
PID:2000

C:\Users\Admin\AppData\Local\Temp\9DFA.exe
C:\Users\Admin\AppData\Local\Temp\9DFA.exe
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\9DFA.exe
  C:\Users\Admin\AppData\Local\Temp\9DFA.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\9DFA.exe
    "C:\Users\Admin\AppData\Local\Temp\9DFA.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\9DFA.exe
      "C:\Users\Admin\AppData\Local\Temp\9DFA.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:1904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 576
        5⤵
        Program crash
        
        PID:884

C:\Users\Admin\AppData\Local\Temp\A231.exe
C:\Users\Admin\AppData\Local\Temp\A231.exe
1⤵
- Executes dropped EXE
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3112 -ip 3112
1⤵
PID:3532

C:\Users\Admin\AppData\Local\Temp\A520.exe
C:\Users\Admin\AppData\Local\Temp\A520.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1036
- C:\Users\Admin\AppData\Local\Temp\A520.exe
  C:\Users\Admin\AppData\Local\Temp\A520.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1196
- - C:\Users\Admin\AppData\Local\Temp\A520.exe
    "C:\Users\Admin\AppData\Local\Temp\A520.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\A520.exe
      "C:\Users\Admin\AppData\Local\Temp\A520.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 568
        5⤵
        Program crash
        
        PID:488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4832 -ip 4832
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2008 -ip 2008
1⤵
PID:3536

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\A928.dll
1⤵
PID:2568
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\A928.dll
  2⤵
  - Loads dropped DLL
  PID:4612

C:\Users\Admin\AppData\Local\Temp\AC94.exe
C:\Users\Admin\AppData\Local\Temp\AC94.exe
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4976 -ip 4976
1⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\B9A5.exe
C:\Users\Admin\AppData\Local\Temp\B9A5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2540
- C:\Users\Admin\AppData\Local\Temp\B9A5.exe
  C:\Users\Admin\AppData\Local\Temp\B9A5.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\B9A5.exe
    "C:\Users\Admin\AppData\Local\Temp\B9A5.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:312
  - - C:\Users\Admin\AppData\Local\Temp\B9A5.exe
      "C:\Users\Admin\AppData\Local\Temp\B9A5.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 568
        5⤵
        Program crash
        
        PID:3124

C:\Users\Admin\AppData\Local\Temp\BF72.exe
C:\Users\Admin\AppData\Local\Temp\BF72.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4864
- C:\Users\Admin\AppData\Local\Temp\BF72.exe
  C:\Users\Admin\AppData\Local\Temp\BF72.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4188
- - C:\Users\Admin\AppData\Local\Temp\BF72.exe
    "C:\Users\Admin\AppData\Local\Temp\BF72.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\BF72.exe
      "C:\Users\Admin\AppData\Local\Temp\BF72.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:4180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 568
        5⤵
        Program crash
        
        PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1904 -ip 1904
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
- Executes dropped EXE
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2916 -ip 2916
1⤵
PID:4540

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CB2B.dll
1⤵
PID:2380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CB2B.dll
  2⤵
  - Loads dropped DLL
  PID:3260

C:\Users\Admin\AppData\Local\Temp\CEC6.exe
C:\Users\Admin\AppData\Local\Temp\CEC6.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 244
  2⤵
  - Program crash
  PID:3536

C:\Users\Admin\AppData\Local\Temp\D530.exe
C:\Users\Admin\AppData\Local\Temp\D530.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 140
  2⤵
  - Program crash
  PID:1052

C:\Users\Admin\AppData\Local\Temp\DB5B.exe
C:\Users\Admin\AppData\Local\Temp\DB5B.exe
1⤵
- Executes dropped EXE
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2236 -ip 2236
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2972 -ip 2972
1⤵
PID:4768

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
1⤵
- Executes dropped EXE
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4180 -ip 4180
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4668 -ip 4668
1⤵
PID:564

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
1⤵
- Executes dropped EXE
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery