amadey | c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	6D82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	5B7E.exe

Executes dropped EXE 20 IoCs

pid	Process
1912	4B7B.exe
4612	Fq4lH5oI.exe
912	oZ9cO4sI.exe
1908	bT5hH3cg.exe
2476	4FB2.exe
1804	Dj8SY5jr.exe
4140	1VB98fp2.exe
4732	CompPkgSrv.exe
3088	msedge.exe
228	5B7E.exe
2692	2nS296pH.exe
1044	explothe.exe
3904	61E8.exe
2280	65FF.exe
232	6D82.exe
4508	oneetx.exe
736	oneetx.exe
5444	explothe.exe
5588	oneetx.exe
4072	explothe.exe

Loads dropped DLL 3 IoCs

pid	Process
2280	65FF.exe
2280	65FF.exe
5188	rundll32.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4B7B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Fq4lH5oI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	oZ9cO4sI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	bT5hH3cg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Dj8SY5jr.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 2272	1816	c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe	85
PID 2476 set thread context of 4392	2476	4FB2.exe	108
PID 4140 set thread context of 2824	4140	1VB98fp2.exe	114
PID 4732 set thread context of 4012	4732	CompPkgSrv.exe	123
PID 3904 set thread context of 3756	3904	61E8.exe	141

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3796	1816	WerFault.exe	83
2284	2476	WerFault.exe	101
4400	2824	WerFault.exe	114
4704	4140	WerFault.exe	104
3060	4732	WerFault.exe	115
4920	2280	WerFault.exe	134

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2752	schtasks.exe
3172	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2272	AppLaunch.exe
2272	AppLaunch.exe
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3180	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2272	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeDebugPrivilege	3088	msedge.exe
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
232	6D82.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3180	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2272	1816	c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe	85
PID 1816 wrote to memory of 2272	1816	c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe	85
PID 1816 wrote to memory of 2272	1816	c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe	85
PID 1816 wrote to memory of 2272	1816	c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe	85
PID 1816 wrote to memory of 2272	1816	c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe	85
PID 1816 wrote to memory of 2272	1816	c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe	85
PID 3180 wrote to memory of 1912	3180	Process not Found	97
PID 3180 wrote to memory of 1912	3180	Process not Found	97
PID 3180 wrote to memory of 1912	3180	Process not Found	97
PID 1912 wrote to memory of 4612	1912	4B7B.exe	98
PID 1912 wrote to memory of 4612	1912	4B7B.exe	98
PID 1912 wrote to memory of 4612	1912	4B7B.exe	98
PID 4612 wrote to memory of 912	4612	Fq4lH5oI.exe	99
PID 4612 wrote to memory of 912	4612	Fq4lH5oI.exe	99
PID 4612 wrote to memory of 912	4612	Fq4lH5oI.exe	99
PID 912 wrote to memory of 1908	912	oZ9cO4sI.exe	100
PID 912 wrote to memory of 1908	912	oZ9cO4sI.exe	100
PID 912 wrote to memory of 1908	912	oZ9cO4sI.exe	100
PID 3180 wrote to memory of 2476	3180	Process not Found	101
PID 3180 wrote to memory of 2476	3180	Process not Found	101
PID 3180 wrote to memory of 2476	3180	Process not Found	101
PID 1908 wrote to memory of 1804	1908	bT5hH3cg.exe	103
PID 1908 wrote to memory of 1804	1908	bT5hH3cg.exe	103
PID 1908 wrote to memory of 1804	1908	bT5hH3cg.exe	103
PID 1804 wrote to memory of 4140	1804	Dj8SY5jr.exe	104
PID 1804 wrote to memory of 4140	1804	Dj8SY5jr.exe	104
PID 1804 wrote to memory of 4140	1804	Dj8SY5jr.exe	104
PID 3180 wrote to memory of 1808	3180	Process not Found	106
PID 3180 wrote to memory of 1808	3180	Process not Found	106
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 2476 wrote to memory of 4392	2476	4FB2.exe	108
PID 4140 wrote to memory of 1512	4140	1VB98fp2.exe	111
PID 4140 wrote to memory of 1512	4140	1VB98fp2.exe	111
PID 4140 wrote to memory of 1512	4140	1VB98fp2.exe	111
PID 4140 wrote to memory of 3760	4140	1VB98fp2.exe	148
PID 4140 wrote to memory of 3760	4140	1VB98fp2.exe	148
PID 4140 wrote to memory of 3760	4140	1VB98fp2.exe	148
PID 4140 wrote to memory of 1328	4140	1VB98fp2.exe	113
PID 4140 wrote to memory of 1328	4140	1VB98fp2.exe	113
PID 4140 wrote to memory of 1328	4140	1VB98fp2.exe	113
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 4140 wrote to memory of 2824	4140	1VB98fp2.exe	114
PID 3180 wrote to memory of 4732	3180	Process not Found	158
PID 3180 wrote to memory of 4732	3180	Process not Found	158
PID 3180 wrote to memory of 4732	3180	Process not Found	158
PID 3180 wrote to memory of 3088	3180	Process not Found	178
PID 3180 wrote to memory of 3088	3180	Process not Found	178
PID 3180 wrote to memory of 228	3180	Process not Found	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe
"C:\Users\Admin\AppData\Local\Temp\c0769575538bca0aa1b98a67548cb8dddeb1a1bf65d4d78b5400ba5ced2ef476.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 408
  2⤵
  - Program crash
  PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1816 -ip 1816
1⤵
PID:4672

C:\Users\Admin\AppData\Local\Temp\4B7B.exe
C:\Users\Admin\AppData\Local\Temp\4B7B.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fq4lH5oI.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fq4lH5oI.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oZ9cO4sI.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oZ9cO4sI.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bT5hH3cg.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bT5hH3cg.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Dj8SY5jr.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Dj8SY5jr.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1VB98fp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1VB98fp2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1512
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3760
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1328
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 540
        8⤵
        Program crash
        
        PID:4400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 628
        7⤵
        Program crash
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2nS296pH.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2nS296pH.exe
        6⤵
        Executes dropped EXE
        
        PID:2692

C:\Users\Admin\AppData\Local\Temp\4FB2.exe
C:\Users\Admin\AppData\Local\Temp\4FB2.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 152
  2⤵
  - Program crash
  PID:2284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\532E.bat" "
1⤵
PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffe37ab46f8,0x7ffe37ab4708,0x7ffe37ab4718
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8995101826180451744,6112836351702123064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe37ab46f8,0x7ffe37ab4708,0x7ffe37ab4718
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,7365147184271584261,6551698656864086447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2476 -ip 2476
1⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\57B3.exe
C:\Users\Admin\AppData\Local\Temp\57B3.exe
1⤵
PID:4732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 152
  2⤵
  - Program crash
  PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4140 -ip 4140
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2824 -ip 2824
1⤵
PID:3204

C:\Users\Admin\AppData\Local\Temp\58DD.exe
C:\Users\Admin\AppData\Local\Temp\58DD.exe
1⤵
PID:3088

C:\Users\Admin\AppData\Local\Temp\5B7E.exe
C:\Users\Admin\AppData\Local\Temp\5B7E.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:228
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1044
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1448
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:5492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5560
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:5604
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:5700
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4732 -ip 4732
1⤵
PID:3836

C:\Users\Admin\AppData\Local\Temp\61E8.exe
C:\Users\Admin\AppData\Local\Temp\61E8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3756

C:\Users\Admin\AppData\Local\Temp\65FF.exe
C:\Users\Admin\AppData\Local\Temp\65FF.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 792
  2⤵
  - Program crash
  PID:4920

C:\Users\Admin\AppData\Local\Temp\6D82.exe
C:\Users\Admin\AppData\Local\Temp\6D82.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:232
- C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4508
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
    3⤵
    PID:4420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5440
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:5456
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:5612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5656
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:N"
      4⤵
      PID:5692
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:R" /E
      4⤵
      PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2280 -ip 2280
1⤵
PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5196

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:736

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5444

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:5588

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery