amadey | 999d43ee4c9a1ec38c0b00fc38abe0b29b13cc83983c6ee895cbb2768b29022d

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1xr29Lp5.exe89E0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	89E0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	89E0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	89E0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	89E0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	89E0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	89E0.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 8 IoCs

Processes:

resource	yara_rule
behavioral17/memory/2820-83-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2cF846oZ.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2cF846oZ.exe	family_redline
behavioral17/memory/5676-362-0x0000000000D90000-0x0000000000DCE000-memory.dmp	family_redline
behavioral17/memory/5512-479-0x00000000001F0000-0x00000000003DA000-memory.dmp	family_redline
behavioral17/memory/5868-482-0x00000000009C0000-0x00000000009FE000-memory.dmp	family_redline
behavioral17/memory/5512-487-0x00000000001F0000-0x00000000003DA000-memory.dmp	family_redline
behavioral17/memory/5912-492-0x00000000020D0000-0x000000000212A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

8EA4.exeexplothe.exe9200.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	8EA4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	9200.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 28 IoCs

Processes:

Xm8nn94.exeaN9yW71.exers1OO36.exe1xr29Lp5.exe2ti1092.exe3bm04hw.exe4xZ521Ep.exe5uO4WE2.exe7C9D.exeLv5HV3JY.exedl7iV2Cr.exeOx5sB0nC.exeAL0Xt3rw.exe1BG75LX5.exe8171.exe88D5.exe2cF846oZ.exe89E0.exe8EA4.exe9200.exeexplothe.exe9ADB.exeoneetx.exeA20F.exeoneetx.exeexplothe.exeoneetx.exeexplothe.exe

pid	process
4332	Xm8nn94.exe
1612	aN9yW71.exe
4432	rs1OO36.exe
336	1xr29Lp5.exe
1412	2ti1092.exe
2976	3bm04hw.exe
3048	4xZ521Ep.exe
3976	5uO4WE2.exe
4668	7C9D.exe
4624	Lv5HV3JY.exe
1452	dl7iV2Cr.exe
208	Ox5sB0nC.exe
3364	AL0Xt3rw.exe
796	1BG75LX5.exe
4092	8171.exe
5632	88D5.exe
5676	2cF846oZ.exe
5716	89E0.exe
5888	8EA4.exe
6080	9200.exe
5284	explothe.exe
5512	9ADB.exe
5808	oneetx.exe
5912	A20F.exe
3484	oneetx.exe
5400	explothe.exe
5964	oneetx.exe
5140	explothe.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

5640 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
5640	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

1xr29Lp5.exe89E0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	89E0.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

Xm8nn94.exeaN9yW71.exe7C9D.exedl7iV2Cr.exeOx5sB0nC.exe913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exers1OO36.exeLv5HV3JY.exeAL0Xt3rw.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Xm8nn94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	aN9yW71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7C9D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	dl7iV2Cr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ox5sB0nC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	rs1OO36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Lv5HV3JY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	AL0Xt3rw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 7 IoCs

Processes:

2ti1092.exe3bm04hw.exe4xZ521Ep.exe1BG75LX5.exe8171.exe88D5.exe9ADB.exe

description	pid	process	target process
PID 1412 set thread context of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 2976 set thread context of 2384	2976	3bm04hw.exe	AppLaunch.exe
PID 3048 set thread context of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 796 set thread context of 4520	796	1BG75LX5.exe	AppLaunch.exe
PID 4092 set thread context of 3016	4092	8171.exe	AppLaunch.exe
PID 5632 set thread context of 5972	5632	88D5.exe	AppLaunch.exe
PID 5512 set thread context of 5868	5512	9ADB.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3700	1412	WerFault.exe	2ti1092.exe
3964	3052	WerFault.exe	AppLaunch.exe
4236	2976	WerFault.exe	3bm04hw.exe
5008	3048	WerFault.exe	4xZ521Ep.exe
464	796	WerFault.exe	1BG75LX5.exe
5176	4520	WerFault.exe	AppLaunch.exe
5228	4092	WerFault.exe	8171.exe
6044	5632	WerFault.exe	88D5.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2252 schtasks.exe
5020 schtasks.exe

pid	process
2252	schtasks.exe
5020	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1xr29Lp5.exeAppLaunch.exe

pid	process
336	1xr29Lp5.exe
336	1xr29Lp5.exe
2384	AppLaunch.exe
2384	AppLaunch.exe
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

2384 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

500 msedge.exe
500 msedge.exe
500 msedge.exe
500 msedge.exe
500 msedge.exe
500 msedge.exe
500 msedge.exe
500 msedge.exe
500 msedge.exe

pid	process
2384	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1xr29Lp5.exe89E0.exe

description	pid	process
Token: SeDebugPrivilege	336	1xr29Lp5.exe
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeDebugPrivilege	5716	89E0.exe
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136
Token: SeShutdownPrivilege	3136
Token: SeCreatePagefilePrivilege	3136

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe9200.exe

pid	process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
6080	9200.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exeXm8nn94.exeaN9yW71.exers1OO36.exe2ti1092.exe3bm04hw.exe4xZ521Ep.exe5uO4WE2.execmd.exemsedge.exemsedge.exe

description	pid	process	target process
PID 5020 wrote to memory of 4332	5020	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	Xm8nn94.exe
PID 5020 wrote to memory of 4332	5020	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	Xm8nn94.exe
PID 5020 wrote to memory of 4332	5020	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	Xm8nn94.exe
PID 4332 wrote to memory of 1612	4332	Xm8nn94.exe	aN9yW71.exe
PID 4332 wrote to memory of 1612	4332	Xm8nn94.exe	aN9yW71.exe
PID 4332 wrote to memory of 1612	4332	Xm8nn94.exe	aN9yW71.exe
PID 1612 wrote to memory of 4432	1612	aN9yW71.exe	rs1OO36.exe
PID 1612 wrote to memory of 4432	1612	aN9yW71.exe	rs1OO36.exe
PID 1612 wrote to memory of 4432	1612	aN9yW71.exe	rs1OO36.exe
PID 4432 wrote to memory of 336	4432	rs1OO36.exe	1xr29Lp5.exe
PID 4432 wrote to memory of 336	4432	rs1OO36.exe	1xr29Lp5.exe
PID 4432 wrote to memory of 336	4432	rs1OO36.exe	1xr29Lp5.exe
PID 4432 wrote to memory of 1412	4432	rs1OO36.exe	2ti1092.exe
PID 4432 wrote to memory of 1412	4432	rs1OO36.exe	2ti1092.exe
PID 4432 wrote to memory of 1412	4432	rs1OO36.exe	2ti1092.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1412 wrote to memory of 3052	1412	2ti1092.exe	AppLaunch.exe
PID 1612 wrote to memory of 2976	1612	aN9yW71.exe	3bm04hw.exe
PID 1612 wrote to memory of 2976	1612	aN9yW71.exe	3bm04hw.exe
PID 1612 wrote to memory of 2976	1612	aN9yW71.exe	3bm04hw.exe
PID 2976 wrote to memory of 2384	2976	3bm04hw.exe	AppLaunch.exe
PID 2976 wrote to memory of 2384	2976	3bm04hw.exe	AppLaunch.exe
PID 2976 wrote to memory of 2384	2976	3bm04hw.exe	AppLaunch.exe
PID 2976 wrote to memory of 2384	2976	3bm04hw.exe	AppLaunch.exe
PID 2976 wrote to memory of 2384	2976	3bm04hw.exe	AppLaunch.exe
PID 2976 wrote to memory of 2384	2976	3bm04hw.exe	AppLaunch.exe
PID 4332 wrote to memory of 3048	4332	Xm8nn94.exe	4xZ521Ep.exe
PID 4332 wrote to memory of 3048	4332	Xm8nn94.exe	4xZ521Ep.exe
PID 4332 wrote to memory of 3048	4332	Xm8nn94.exe	4xZ521Ep.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 3048 wrote to memory of 2820	3048	4xZ521Ep.exe	AppLaunch.exe
PID 5020 wrote to memory of 3976	5020	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	5uO4WE2.exe
PID 5020 wrote to memory of 3976	5020	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	5uO4WE2.exe
PID 5020 wrote to memory of 3976	5020	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	5uO4WE2.exe
PID 3976 wrote to memory of 8	3976	5uO4WE2.exe	cmd.exe
PID 3976 wrote to memory of 8	3976	5uO4WE2.exe	cmd.exe
PID 8 wrote to memory of 500	8	cmd.exe	msedge.exe
PID 8 wrote to memory of 500	8	cmd.exe	msedge.exe
PID 500 wrote to memory of 2636	500	msedge.exe	msedge.exe
PID 500 wrote to memory of 2636	500	msedge.exe	msedge.exe
PID 8 wrote to memory of 4904	8	cmd.exe	msedge.exe
PID 8 wrote to memory of 4904	8	cmd.exe	msedge.exe
PID 4904 wrote to memory of 1672	4904	msedge.exe	msedge.exe
PID 4904 wrote to memory of 1672	4904	msedge.exe	msedge.exe
PID 500 wrote to memory of 1408	500	msedge.exe	msedge.exe
PID 500 wrote to memory of 1408	500	msedge.exe	msedge.exe
PID 500 wrote to memory of 1408	500	msedge.exe	msedge.exe
PID 500 wrote to memory of 1408	500	msedge.exe	msedge.exe
PID 500 wrote to memory of 1408	500	msedge.exe	msedge.exe
PID 500 wrote to memory of 1408	500	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe
"C:\Users\Admin\AppData\Local\Temp\913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5020

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xm8nn94.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xm8nn94.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4332

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aN9yW71.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aN9yW71.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rs1OO36.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rs1OO36.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4432

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1xr29Lp5.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1xr29Lp5.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:336

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ti1092.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ti1092.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 184
7⤵
- Program crash
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 596
6⤵
- Program crash
PID:3700

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bm04hw.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bm04hw.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 600
5⤵
- Program crash
PID:4236

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4xZ521Ep.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4xZ521Ep.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 600
4⤵
- Program crash
PID:5008

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uO4WE2.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uO4WE2.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2B41.tmp\2B42.tmp\2B43.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uO4WE2.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff871c846f8,0x7ff871c84708,0x7ff871c84718
5⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
5⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
5⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
5⤵
PID:568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
5⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
5⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
5⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
5⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
5⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
5⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
5⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
5⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
5⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
5⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6800305960071610411,9007969463835401771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
5⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff871c846f8,0x7ff871c84708,0x7ff871c84718
5⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15048565601854333965,13315388071356057641,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
5⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15048565601854333965,13315388071356057641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
5⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1412 -ip 1412
1⤵
PID:568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3052 -ip 3052
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2976 -ip 2976
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3048 -ip 3048
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Users\Admin\AppData\Local\Temp\7C9D.exe
C:\Users\Admin\AppData\Local\Temp\7C9D.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4668

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lv5HV3JY.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lv5HV3JY.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4624

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dl7iV2Cr.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dl7iV2Cr.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1452

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ox5sB0nC.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ox5sB0nC.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:208

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AL0Xt3rw.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\AL0Xt3rw.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3364

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1BG75LX5.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1BG75LX5.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 540
8⤵
- Program crash
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 156
7⤵
- Program crash
PID:464

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2cF846oZ.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2cF846oZ.exe
6⤵
- Executes dropped EXE
PID:5676

C:\Users\Admin\AppData\Local\Temp\8171.exe
C:\Users\Admin\AppData\Local\Temp\8171.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 248
2⤵
- Program crash
PID:5228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\82E9.bat" "
1⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff871c846f8,0x7ff871c84708,0x7ff871c84718
3⤵
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff871c846f8,0x7ff871c84708,0x7ff871c84718
3⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 796 -ip 796
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4092 -ip 4092
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4520 -ip 4520
1⤵
PID:3648

C:\Users\Admin\AppData\Local\Temp\88D5.exe
C:\Users\Admin\AppData\Local\Temp\88D5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 404
2⤵
- Program crash
PID:6044

C:\Users\Admin\AppData\Local\Temp\89E0.exe
C:\Users\Admin\AppData\Local\Temp\89E0.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Users\Admin\AppData\Local\Temp\8EA4.exe
C:\Users\Admin\AppData\Local\Temp\8EA4.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5888

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5284

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:5020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
3⤵
PID:796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5804

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
4⤵
PID:5844

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
4⤵
PID:1828

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
4⤵
PID:6028

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
4⤵
PID:5204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5344

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5632 -ip 5632
1⤵
PID:6008

C:\Users\Admin\AppData\Local\Temp\9200.exe
C:\Users\Admin\AppData\Local\Temp\9200.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:6080

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5808

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:2252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
3⤵
PID:5152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5188

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
4⤵
PID:5240

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
4⤵
PID:3040

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
4⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5212

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
4⤵
PID:5396

C:\Users\Admin\AppData\Local\Temp\9ADB.exe
C:\Users\Admin\AppData\Local\Temp\9ADB.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:5868

C:\Users\Admin\AppData\Local\Temp\A20F.exe
C:\Users\Admin\AppData\Local\Temp\A20F.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:5964

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery