amadey | fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 8 IoCs

resource	yara_rule
behavioral1/memory/2820-124-0x0000000000530000-0x0000000000680000-memory.dmp	family_redline
behavioral1/memory/2956-125-0x0000000000800000-0x000000000085A000-memory.dmp	family_redline
behavioral1/memory/2820-131-0x0000000000530000-0x0000000000680000-memory.dmp	family_redline
behavioral1/memory/2496-189-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/4796-188-0x0000000000B80000-0x0000000000CC9000-memory.dmp	family_redline
behavioral1/memory/4796-194-0x0000000000B80000-0x0000000000CC9000-memory.dmp	family_redline
behavioral1/memory/4916-343-0x0000000000B80000-0x0000000000CC9000-memory.dmp	family_redline
behavioral1/memory/4916-352-0x0000000000B80000-0x0000000000CC9000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

pid	Process
5104	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	u8698610.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	legota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	rockas.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	Meduza1234.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	t7527431.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation	explonde.exe

Executes dropped EXE 37 IoCs

pid	Process
1736	z1192555.exe
4352	z7082900.exe
2064	z7483594.exe
4864	z2598499.exe
1028	q2226632.exe
4056	r9807976.exe
4736	s9982967.exe
1136	t7527431.exe
2172	explonde.exe
1436	u8698610.exe
376	legota.exe
212	w4301647.exe
4180	rockas.exe
2820	gqnz5n3uw.exe
3932	oneetx.exe
1736	ss41.exe
3396	build.exe
4796	taskhost.exe
452	Meduza1234.exe
4588	winlog.exe
5080	cmd.exe
4736	msedge.exe
1144	toolspub2.exe
4916	taskhost.exe
3496	toolspub2.exe
3132	winlog.exe
756	msedge.exe
4896	31839b57a4f11171d6abc8bbc4451ee4.exe
2200	taskhost.exe
2764	explonde.exe
732	oneetx.exe
1184	legota.exe
3604	winlog.exe
4256	msedge.exe
1136	latestX.exe
2244	taskhost.exe
4388	winlog.exe

Loads dropped DLL 2 IoCs

pid	Process
3396	build.exe
3396	build.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza1234.exe
Key opened	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza1234.exe
Key opened	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza1234.exe
Key opened	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza1234.exe
Key opened	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza1234.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z7082900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z7483594.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z2598499.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AppLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1192555.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
62	api.ipify.org
63	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4588	winlog.exe
3132	winlog.exe
3604	winlog.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 1028 set thread context of 2236	1028	q2226632.exe	102
PID 4056 set thread context of 1512	4056	r9807976.exe	108
PID 4736 set thread context of 1980	4736	s9982967.exe	116
PID 2820 set thread context of 2956	2820	gqnz5n3uw.exe	157
PID 4796 set thread context of 2496	4796	taskhost.exe	163
PID 1144 set thread context of 3496	1144	toolspub2.exe	182
PID 4916 set thread context of 2908	4916	taskhost.exe	171
PID 2200 set thread context of 3068	2200	taskhost.exe	185
PID 2244 set thread context of 2728	2244	taskhost.exe	190

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5104	sc.exe
2032	sc.exe
4448	sc.exe
5088	sc.exe
4968	sc.exe
2076	sc.exe
5060	sc.exe
4356	sc.exe
1240	sc.exe
1252	sc.exe
800	sc.exe
1720	sc.exe
1472	sc.exe
820	sc.exe
1776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5004	4816	WerFault.exe	83
2312	1028	WerFault.exe	99
2820	4056	WerFault.exe	105
4384	1512	WerFault.exe	108
5076	4736	WerFault.exe	113
2936	3396	WerFault.exe	160

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3820	schtasks.exe
3236	schtasks.exe
3180	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4332	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	121	Go-http-client/1.1

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1804	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2236	AppLaunch.exe
2236	AppLaunch.exe
1980	AppLaunch.exe
1980	AppLaunch.exe
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found
2596	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1980	AppLaunch.exe
3496	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	AppLaunch.exe
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeDebugPrivilege	2496	vbc.exe
Token: SeDebugPrivilege	2956	vbc.exe
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found
Token: SeDebugPrivilege	2908	vbc.exe
Token: SeDebugPrivilege	3068	vbc.exe
Token: SeShutdownPrivilege	2596	Process not Found
Token: SeCreatePagefilePrivilege	2596	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4180	rockas.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 4816 wrote to memory of 1240	4816	fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe	92
PID 1240 wrote to memory of 1736	1240	AppLaunch.exe	94
PID 1240 wrote to memory of 1736	1240	AppLaunch.exe	94
PID 1240 wrote to memory of 1736	1240	AppLaunch.exe	94
PID 1736 wrote to memory of 4352	1736	z1192555.exe	96
PID 1736 wrote to memory of 4352	1736	z1192555.exe	96
PID 1736 wrote to memory of 4352	1736	z1192555.exe	96
PID 4352 wrote to memory of 2064	4352	z7082900.exe	97
PID 4352 wrote to memory of 2064	4352	z7082900.exe	97
PID 4352 wrote to memory of 2064	4352	z7082900.exe	97
PID 2064 wrote to memory of 4864	2064	z7483594.exe	98
PID 2064 wrote to memory of 4864	2064	z7483594.exe	98
PID 2064 wrote to memory of 4864	2064	z7483594.exe	98
PID 4864 wrote to memory of 1028	4864	z2598499.exe	99
PID 4864 wrote to memory of 1028	4864	z2598499.exe	99
PID 4864 wrote to memory of 1028	4864	z2598499.exe	99
PID 1028 wrote to memory of 3716	1028	q2226632.exe	100
PID 1028 wrote to memory of 3716	1028	q2226632.exe	100
PID 1028 wrote to memory of 3716	1028	q2226632.exe	100
PID 1028 wrote to memory of 5060	1028	q2226632.exe	101
PID 1028 wrote to memory of 5060	1028	q2226632.exe	101
PID 1028 wrote to memory of 5060	1028	q2226632.exe	101
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 1028 wrote to memory of 2236	1028	q2226632.exe	102
PID 4864 wrote to memory of 4056	4864	z2598499.exe	105
PID 4864 wrote to memory of 4056	4864	z2598499.exe	105
PID 4864 wrote to memory of 4056	4864	z2598499.exe	105
PID 4056 wrote to memory of 4956	4056	r9807976.exe	107
PID 4056 wrote to memory of 4956	4056	r9807976.exe	107
PID 4056 wrote to memory of 4956	4056	r9807976.exe	107
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 4056 wrote to memory of 1512	4056	r9807976.exe	108
PID 2064 wrote to memory of 4736	2064	z7483594.exe	113
PID 2064 wrote to memory of 4736	2064	z7483594.exe	113
PID 2064 wrote to memory of 4736	2064	z7483594.exe	113
PID 4736 wrote to memory of 1384	4736	s9982967.exe	114
PID 4736 wrote to memory of 1384	4736	s9982967.exe	114
PID 4736 wrote to memory of 1384	4736	s9982967.exe	114
PID 4736 wrote to memory of 1432	4736	s9982967.exe	115
PID 4736 wrote to memory of 1432	4736	s9982967.exe	115
PID 4736 wrote to memory of 1432	4736	s9982967.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza1234.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Meduza1234.exe

C:\Users\Admin\AppData\Local\Temp\fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe
"C:\Users\Admin\AppData\Local\Temp\fe7d32da2ec2d9ce4a753b71e738b716af3ab2343eed8501e76c7072a66d61a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1192555.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1192555.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7082900.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7082900.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7483594.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7483594.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2598499.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2598499.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2226632.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2226632.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:3716
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:5060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 580
        8⤵
        Program crash
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9807976.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9807976.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:4956
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 560
        9⤵
        Program crash
        
        PID:4384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 572
        8⤵
        Program crash
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9982967.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9982967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1384
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 584
        7⤵
        Program crash
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7527431.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7527431.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:3820
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        7⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        8⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        8⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        8⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        8⤵
        
        PID:404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        7⤵
        
        PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8698610.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8698610.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:376
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3236
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        7⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        7⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:800
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        7⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        7⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\1000001001\rockas.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000001001\rockas.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3932
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
        8⤵
        Creates scheduled task(s)
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
        8⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        9⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        9⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:640
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:N"
        9⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:R" /E
        9⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\1000447001\ss41.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000447001\ss41.exe"
        8⤵
        Executes dropped EXE
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4796
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
        8⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\1000448001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000448001\toolspub2.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\1000448001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000448001\toolspub2.exe"
        9⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4916
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
        8⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2200
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\1000449001\31839b57a4f11171d6abc8bbc4451ee4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000449001\31839b57a4f11171d6abc8bbc4451ee4.exe"
        8⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\1000449001\31839b57a4f11171d6abc8bbc4451ee4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000449001\31839b57a4f11171d6abc8bbc4451ee4.exe"
        9⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        10⤵
        
        PID:3152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        10⤵
        
        PID:4448
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        11⤵
        Modifies Windows Firewall
        
        PID:5104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        10⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        10⤵
        
        PID:3208
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        10⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3604
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        9⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
        8⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\1000450001\latestX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000450001\latestX.exe"
        8⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2244
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        9⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
        8⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
        8⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\1000002001\gqnz5n3uw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000002001\gqnz5n3uw.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2820
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\1000004001\build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\build.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3396
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1000004001\build.exe" & exit
        7⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:4332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 2120
        7⤵
        Program crash
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\1000005001\Meduza1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\Meduza1234.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        outlook_office_path
        outlook_win_path
        
        PID:452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1000005001\Meduza1234.exe"
        7⤵
        
        PID:3220
        
        C:\Windows\system32\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        8⤵
        Runs ping.exe
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\1000016001\Black_Saturn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000016001\Black_Saturn.exe"
        6⤵
        
        PID:5080
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        6⤵
        
        PID:4764
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4301647.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4301647.exe
    3⤵
    - Executes dropped EXE
    PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 240
  2⤵
  - Program crash
  PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4816 -ip 4816
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1028 -ip 1028
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4056 -ip 4056
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1512 -ip 1512
1⤵
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4736 -ip 4736
1⤵
PID:4984

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:732

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:1184

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3396 -ip 3396
1⤵
PID:1716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2952

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:2116
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1472
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:820
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2032
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:1240
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:4448

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:4708
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:1044
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:2720
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:4476
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:4432

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
PID:4728

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
PID:3244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:776

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
- Executes dropped EXE
PID:5080
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1252
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:800
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1720
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:1776
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:5088

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:2376

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:3404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qbjrr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:4412

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:4332
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:1472
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:2000
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:1384
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4448

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:4968

C:\Users\Admin\AppData\Local\Temp\868B.exe
C:\Users\Admin\AppData\Local\Temp\868B.exe
1⤵
PID:1260
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -u X6PA.74k /S
  2⤵
  PID:1244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:3892

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:1336
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5104
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2076
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4968
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:4356

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:3092
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:4364
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:776
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:4832
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:644

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
PID:2468

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery