amadey | 3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	CE20.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	C5F0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	791.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	39AF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	yiueea.exe

Executes dropped EXE 20 IoCs

pid	Process
1236	C5F0.exe
3972	C5F0.exe
1188	C8CF.exe
3760	CE20.exe
4996	CE20.exe
5088	C5F0.exe
2052	CE20.exe
4132	791.exe
3800	2FBB.exe
4592	CE20.exe
2552	C5F0.exe
3788	791.exe
3732	39AF.exe
1308	791.exe
3808	yiueea.exe
2320	791.exe
2996	3DD6.exe
3420	4019.exe
4632	EA45.exe
1892	yiueea.exe

Loads dropped DLL 1 IoCs

pid	Process
1300	regsvr32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1980	icacls.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1d22faaa-36fd-4252-b877-43443dc85bef\\C5F0.exe\" --AutoStart"	C5F0.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	api.2ip.ua
31	api.2ip.ua
32	api.2ip.ua
40	api.2ip.ua

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 3972	1236	C5F0.exe	89
PID 3760 set thread context of 4996	3760	CE20.exe	94
PID 2052 set thread context of 4592	2052	CE20.exe	105
PID 5088 set thread context of 2552	5088	C5F0.exe	106
PID 4132 set thread context of 3788	4132	791.exe	107
PID 3800 set thread context of 4456	3800	2FBB.exe	114
PID 1308 set thread context of 2320	1308	791.exe	120
PID 3420 set thread context of 4148	3420	4019.exe	148
PID 4632 set thread context of 1120	4632	EA45.exe	158

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
764	2552	WerFault.exe	106
1416	4592	WerFault.exe	105
4680	2320	WerFault.exe	120

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3DD6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3DD6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3DD6.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1748	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2376	3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe
2376	3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found
3204	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3204	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2376	3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe
2996	3DD6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found
Token: SeShutdownPrivilege	3204	Process not Found
Token: SeCreatePagefilePrivilege	3204	Process not Found

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 1236	3204	Process not Found	87
PID 3204 wrote to memory of 1236	3204	Process not Found	87
PID 3204 wrote to memory of 1236	3204	Process not Found	87
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 1236 wrote to memory of 3972	1236	C5F0.exe	89
PID 3204 wrote to memory of 1188	3204	Process not Found	88
PID 3204 wrote to memory of 1188	3204	Process not Found	88
PID 3204 wrote to memory of 1188	3204	Process not Found	88
PID 3204 wrote to memory of 4956	3204	Process not Found	91
PID 3204 wrote to memory of 4956	3204	Process not Found	91
PID 4956 wrote to memory of 1300	4956	regsvr32.exe	92
PID 4956 wrote to memory of 1300	4956	regsvr32.exe	92
PID 4956 wrote to memory of 1300	4956	regsvr32.exe	92
PID 3204 wrote to memory of 3760	3204	Process not Found	93
PID 3204 wrote to memory of 3760	3204	Process not Found	93
PID 3204 wrote to memory of 3760	3204	Process not Found	93
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3760 wrote to memory of 4996	3760	CE20.exe	94
PID 3972 wrote to memory of 1980	3972	C5F0.exe	95
PID 3972 wrote to memory of 1980	3972	C5F0.exe	95
PID 3972 wrote to memory of 1980	3972	C5F0.exe	95
PID 4996 wrote to memory of 2052	4996	CE20.exe	97
PID 4996 wrote to memory of 2052	4996	CE20.exe	97
PID 4996 wrote to memory of 2052	4996	CE20.exe	97
PID 3972 wrote to memory of 5088	3972	C5F0.exe	99
PID 3972 wrote to memory of 5088	3972	C5F0.exe	99
PID 3972 wrote to memory of 5088	3972	C5F0.exe	99
PID 3204 wrote to memory of 4132	3204	Process not Found	100
PID 3204 wrote to memory of 4132	3204	Process not Found	100
PID 3204 wrote to memory of 4132	3204	Process not Found	100
PID 3204 wrote to memory of 3800	3204	Process not Found	103
PID 3204 wrote to memory of 3800	3204	Process not Found	103
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 5088 wrote to memory of 2552	5088	C5F0.exe	106
PID 5088 wrote to memory of 2552	5088	C5F0.exe	106
PID 5088 wrote to memory of 2552	5088	C5F0.exe	106
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 2052 wrote to memory of 4592	2052	CE20.exe	105
PID 5088 wrote to memory of 2552	5088	C5F0.exe	106
PID 5088 wrote to memory of 2552	5088	C5F0.exe	106
PID 5088 wrote to memory of 2552	5088	C5F0.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe
"C:\Users\Admin\AppData\Local\Temp\3ed0e48ab3bd7192bfc2df108b5d0bb2266cd817ee9f66d691fe9d3a1650158e.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2376

C:\Users\Admin\AppData\Local\Temp\C5F0.exe
C:\Users\Admin\AppData\Local\Temp\C5F0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\C5F0.exe
  C:\Users\Admin\AppData\Local\Temp\C5F0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\1d22faaa-36fd-4252-b877-43443dc85bef" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\C5F0.exe
    "C:\Users\Admin\AppData\Local\Temp\C5F0.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\C5F0.exe
      "C:\Users\Admin\AppData\Local\Temp\C5F0.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 568
        5⤵
        Program crash
        
        PID:764

C:\Users\Admin\AppData\Local\Temp\C8CF.exe
C:\Users\Admin\AppData\Local\Temp\C8CF.exe
1⤵
- Executes dropped EXE
PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=C8CF.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3472 /prefetch:8
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:3
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3304 /prefetch:2
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
    3⤵
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9380550461751575399,10819621123240729321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
    3⤵
    PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=C8CF.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff80d3646f8,0x7ff80d364708,0x7ff80d364718
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10219686737648069931,3186521401245570172,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10219686737648069931,3186521401245570172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    PID:1476

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CCC8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CCC8.dll
  2⤵
  - Loads dropped DLL
  PID:1300

C:\Users\Admin\AppData\Local\Temp\CE20.exe
C:\Users\Admin\AppData\Local\Temp\CE20.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\CE20.exe
  C:\Users\Admin\AppData\Local\Temp\CE20.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\CE20.exe
    "C:\Users\Admin\AppData\Local\Temp\CE20.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\CE20.exe
      "C:\Users\Admin\AppData\Local\Temp\CE20.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:4592
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 568
        5⤵
        Program crash
        
        PID:1416

C:\Users\Admin\AppData\Local\Temp\791.exe
C:\Users\Admin\AppData\Local\Temp\791.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4132
- C:\Users\Admin\AppData\Local\Temp\791.exe
  C:\Users\Admin\AppData\Local\Temp\791.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3788
- - C:\Users\Admin\AppData\Local\Temp\791.exe
    "C:\Users\Admin\AppData\Local\Temp\791.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\791.exe
      "C:\Users\Admin\AppData\Local\Temp\791.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 568
        5⤵
        Program crash
        
        PID:4680

C:\Users\Admin\AppData\Local\Temp\2FBB.exe
C:\Users\Admin\AppData\Local\Temp\2FBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2552 -ip 2552
1⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80d3646f8,0x7ff80d364708,0x7ff80d364718
1⤵
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4592 -ip 4592
1⤵
PID:4516

C:\Users\Admin\AppData\Local\Temp\39AF.exe
C:\Users\Admin\AppData\Local\Temp\39AF.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3732
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3808
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
    3⤵
    PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2072
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:N"
      4⤵
      PID:4944
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:R" /E
      4⤵
      PID:4600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:N"
      4⤵
      PID:2556
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:R" /E
      4⤵
      PID:1356

C:\Users\Admin\AppData\Local\Temp\3DD6.exe
C:\Users\Admin\AppData\Local\Temp\3DD6.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2320 -ip 2320
1⤵
PID:4068

C:\Users\Admin\AppData\Local\Temp\4019.exe
C:\Users\Admin\AppData\Local\Temp\4019.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Users\Admin\AppData\Local\Temp\EA45.exe
C:\Users\Admin\AppData\Local\Temp\EA45.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1120
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2448

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
1⤵
- Executes dropped EXE
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery