amadey | 2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1Lp80kM7.exe4CC3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Lp80kM7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	4CC3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	4CC3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4CC3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4CC3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Lp80kM7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Lp80kM7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Lp80kM7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4CC3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1Lp80kM7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Lp80kM7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4CC3.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4760-83-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Zr099uY.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Zr099uY.exe	family_redline
behavioral1/memory/5144-412-0x0000000000390000-0x00000000003CE000-memory.dmp	family_redline
behavioral1/memory/5328-523-0x0000000002090000-0x00000000020EA000-memory.dmp	family_redline
behavioral1/memory/6036-522-0x0000000000D90000-0x0000000000F7A000-memory.dmp	family_redline
behavioral1/memory/5488-527-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/6036-536-0x0000000000D90000-0x0000000000F7A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

oneetx.exe5119.exeexplothe.exe5521.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	5119.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	5521.exe

Executes dropped EXE 28 IoCs

Processes:

Un0ES82.exepQ0TF01.exeGY2Dm07.exe1Lp80kM7.exe2Fp0420.exe3nY12wN.exe4dZ149yb.exe5pN7SH1.exe43D5.exe452E.exeqK3KX6MI.exedQ9bt7Jo.exeiP0Gh4is.exeTw2sV6tB.exe1gc97KG2.exe4A7F.exe4CC3.exe5119.exe5521.exe5BE9.exeexplothe.exe2Zr099uY.exe661B.exeoneetx.exeexplothe.exeoneetx.exeexplothe.exeoneetx.exe

pid	process
2020	Un0ES82.exe
3588	pQ0TF01.exe
2064	GY2Dm07.exe
3860	1Lp80kM7.exe
1904	2Fp0420.exe
4732	3nY12wN.exe
1508	4dZ149yb.exe
3884	5pN7SH1.exe
1240	43D5.exe
1276	452E.exe
2988	qK3KX6MI.exe
4972	dQ9bt7Jo.exe
5128	iP0Gh4is.exe
5196	Tw2sV6tB.exe
5268	1gc97KG2.exe
5316	4A7F.exe
5404	4CC3.exe
5540	5119.exe
5780	5521.exe
6036	5BE9.exe
6096	explothe.exe
5144	2Zr099uY.exe
5328	661B.exe
5992	oneetx.exe
2208	explothe.exe
5936	oneetx.exe
3876	explothe.exe
4700	oneetx.exe

Loads dropped DLL 3 IoCs

Processes:

661B.exerundll32.exe

pid process

5328 661B.exe
5328 661B.exe
5880 rundll32.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
5328	661B.exe
5328	661B.exe
5880	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

1Lp80kM7.exe4CC3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1Lp80kM7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Lp80kM7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	4CC3.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

qK3KX6MI.exeiP0Gh4is.exeTw2sV6tB.exe2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exepQ0TF01.exeGY2Dm07.exe43D5.exeUn0ES82.exedQ9bt7Jo.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	qK3KX6MI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	iP0Gh4is.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	Tw2sV6tB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	pQ0TF01.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	GY2Dm07.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	43D5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Un0ES82.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	dQ9bt7Jo.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

2Fp0420.exe3nY12wN.exe4dZ149yb.exe452E.exe1gc97KG2.exe4A7F.exe5BE9.exe

description	pid	process	target process
PID 1904 set thread context of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 4732 set thread context of 4060	4732	3nY12wN.exe	AppLaunch.exe
PID 1508 set thread context of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1276 set thread context of 5388	1276	452E.exe	AppLaunch.exe
PID 5268 set thread context of 5556	5268	1gc97KG2.exe	AppLaunch.exe
PID 5316 set thread context of 5676	5316	4A7F.exe	AppLaunch.exe
PID 6036 set thread context of 5488	6036	5BE9.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
848	1904	WerFault.exe	2Fp0420.exe
2056	608	WerFault.exe	AppLaunch.exe
2016	4732	WerFault.exe	3nY12wN.exe
5092	1508	WerFault.exe	4dZ149yb.exe
5512	1276	WerFault.exe	452E.exe
5668	5268	WerFault.exe	1gc97KG2.exe
5728	5556	WerFault.exe	AppLaunch.exe
5844	5316	WerFault.exe	4A7F.exe
5512	5328	WerFault.exe	661B.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5724 schtasks.exe
5516 schtasks.exe

pid	process
5724	schtasks.exe
5516	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1Lp80kM7.exeAppLaunch.exemsedge.exemsedge.exemsedge.exe

pid	process
3860	1Lp80kM7.exe
3860	1Lp80kM7.exe
4060	AppLaunch.exe
4060	AppLaunch.exe
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
536
1248	msedge.exe
1248	msedge.exe
536
536
5000	msedge.exe
5000	msedge.exe
536
536
536
536
536
536
536
536
536
536
3820	msedge.exe
3820	msedge.exe
536
536

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

4060 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3820 msedge.exe
3820 msedge.exe
3820 msedge.exe
3820 msedge.exe
3820 msedge.exe
3820 msedge.exe
3820 msedge.exe
3820 msedge.exe
3820 msedge.exe

pid	process
4060	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1Lp80kM7.exe4CC3.exe

description	pid	process
Token: SeDebugPrivilege	3860	1Lp80kM7.exe
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeDebugPrivilege	5404	4CC3.exe
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536
Token: SeShutdownPrivilege	536
Token: SeCreatePagefilePrivilege	536

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe5521.exe

pid	process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
5780	5521.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

536

pid	process
536

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exeUn0ES82.exepQ0TF01.exeGY2Dm07.exe2Fp0420.exe3nY12wN.exe4dZ149yb.exe5pN7SH1.execmd.exemsedge.exemsedge.exe

description	pid	process	target process
PID 444 wrote to memory of 2020	444	2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe	Un0ES82.exe
PID 444 wrote to memory of 2020	444	2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe	Un0ES82.exe
PID 444 wrote to memory of 2020	444	2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe	Un0ES82.exe
PID 2020 wrote to memory of 3588	2020	Un0ES82.exe	pQ0TF01.exe
PID 2020 wrote to memory of 3588	2020	Un0ES82.exe	pQ0TF01.exe
PID 2020 wrote to memory of 3588	2020	Un0ES82.exe	pQ0TF01.exe
PID 3588 wrote to memory of 2064	3588	pQ0TF01.exe	GY2Dm07.exe
PID 3588 wrote to memory of 2064	3588	pQ0TF01.exe	GY2Dm07.exe
PID 3588 wrote to memory of 2064	3588	pQ0TF01.exe	GY2Dm07.exe
PID 2064 wrote to memory of 3860	2064	GY2Dm07.exe	1Lp80kM7.exe
PID 2064 wrote to memory of 3860	2064	GY2Dm07.exe	1Lp80kM7.exe
PID 2064 wrote to memory of 3860	2064	GY2Dm07.exe	1Lp80kM7.exe
PID 2064 wrote to memory of 1904	2064	GY2Dm07.exe	2Fp0420.exe
PID 2064 wrote to memory of 1904	2064	GY2Dm07.exe	2Fp0420.exe
PID 2064 wrote to memory of 1904	2064	GY2Dm07.exe	2Fp0420.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 1904 wrote to memory of 608	1904	2Fp0420.exe	AppLaunch.exe
PID 3588 wrote to memory of 4732	3588	pQ0TF01.exe	3nY12wN.exe
PID 3588 wrote to memory of 4732	3588	pQ0TF01.exe	3nY12wN.exe
PID 3588 wrote to memory of 4732	3588	pQ0TF01.exe	3nY12wN.exe
PID 4732 wrote to memory of 4060	4732	3nY12wN.exe	AppLaunch.exe
PID 4732 wrote to memory of 4060	4732	3nY12wN.exe	AppLaunch.exe
PID 4732 wrote to memory of 4060	4732	3nY12wN.exe	AppLaunch.exe
PID 4732 wrote to memory of 4060	4732	3nY12wN.exe	AppLaunch.exe
PID 4732 wrote to memory of 4060	4732	3nY12wN.exe	AppLaunch.exe
PID 4732 wrote to memory of 4060	4732	3nY12wN.exe	AppLaunch.exe
PID 2020 wrote to memory of 1508	2020	Un0ES82.exe	4dZ149yb.exe
PID 2020 wrote to memory of 1508	2020	Un0ES82.exe	4dZ149yb.exe
PID 2020 wrote to memory of 1508	2020	Un0ES82.exe	4dZ149yb.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 1508 wrote to memory of 4760	1508	4dZ149yb.exe	AppLaunch.exe
PID 444 wrote to memory of 3884	444	2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe	5pN7SH1.exe
PID 444 wrote to memory of 3884	444	2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe	5pN7SH1.exe
PID 444 wrote to memory of 3884	444	2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe	5pN7SH1.exe
PID 3884 wrote to memory of 4880	3884	5pN7SH1.exe	cmd.exe
PID 3884 wrote to memory of 4880	3884	5pN7SH1.exe	cmd.exe
PID 4880 wrote to memory of 3568	4880	cmd.exe	msedge.exe
PID 4880 wrote to memory of 3568	4880	cmd.exe	msedge.exe
PID 3568 wrote to memory of 2916	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2916	3568	msedge.exe	msedge.exe
PID 4880 wrote to memory of 3820	4880	cmd.exe	msedge.exe
PID 4880 wrote to memory of 3820	4880	cmd.exe	msedge.exe
PID 3820 wrote to memory of 3100	3820	msedge.exe	msedge.exe
PID 3820 wrote to memory of 3100	3820	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2132	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2132	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2132	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2132	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2132	3568	msedge.exe	msedge.exe
PID 3568 wrote to memory of 2132	3568	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe
"C:\Users\Admin\AppData\Local\Temp\2d47bbc89145e9da609a357b57ff6fc15b6533a461e5a5ae36aec039bc38b323.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:444

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Un0ES82.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Un0ES82.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pQ0TF01.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pQ0TF01.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3588

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GY2Dm07.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GY2Dm07.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Lp80kM7.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Lp80kM7.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Fp0420.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Fp0420.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 540
7⤵
- Program crash
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 592
6⤵
- Program crash
PID:848

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3nY12wN.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3nY12wN.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 596
5⤵
- Program crash
PID:2016

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4dZ149yb.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4dZ149yb.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 152
4⤵
- Program crash
PID:5092

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5pN7SH1.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5pN7SH1.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E6A2.tmp\E6A3.tmp\E6A4.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5pN7SH1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x70,0x78,0x80,0x15c,0x84,0x7fff68aa46f8,0x7fff68aa4708,0x7fff68aa4718
5⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12949189282144146559,16019176674671393145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
5⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12949189282144146559,16019176674671393145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff68aa46f8,0x7fff68aa4708,0x7fff68aa4718
5⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
5⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
5⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
5⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
5⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
5⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
5⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
5⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
5⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
5⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
5⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
5⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
5⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7992735330921392383,9462621636257980535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
5⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1904 -ip 1904
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 608 -ip 608
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4732 -ip 4732
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1508 -ip 1508
1⤵
PID:2248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

C:\Users\Admin\AppData\Local\Temp\43D5.exe
C:\Users\Admin\AppData\Local\Temp\43D5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1240

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qK3KX6MI.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qK3KX6MI.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2988

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dQ9bt7Jo.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dQ9bt7Jo.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4972

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iP0Gh4is.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iP0Gh4is.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5128

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Tw2sV6tB.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Tw2sV6tB.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5196

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1gc97KG2.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1gc97KG2.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 540
8⤵
- Program crash
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 148
7⤵
- Program crash
PID:5668

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Zr099uY.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Zr099uY.exe
6⤵
- Executes dropped EXE
PID:5144

C:\Users\Admin\AppData\Local\Temp\452E.exe
C:\Users\Admin\AppData\Local\Temp\452E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 152
2⤵
- Program crash
PID:5512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4668.bat" "
1⤵
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff68aa46f8,0x7fff68aa4708,0x7fff68aa4718
3⤵
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff68aa46f8,0x7fff68aa4708,0x7fff68aa4718
3⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\4A7F.exe
C:\Users\Admin\AppData\Local\Temp\4A7F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 152
2⤵
- Program crash
PID:5844

C:\Users\Admin\AppData\Local\Temp\4CC3.exe
C:\Users\Admin\AppData\Local\Temp\4CC3.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1276 -ip 1276
1⤵
PID:5432

C:\Users\Admin\AppData\Local\Temp\5119.exe
C:\Users\Admin\AppData\Local\Temp\5119.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5540

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:6096

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:5724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
3⤵
PID:5984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5492

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
4⤵
PID:5796

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
4⤵
PID:1704

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
4⤵
PID:5912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5504

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
4⤵
PID:5204

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5268 -ip 5268
1⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5556 -ip 5556
1⤵
PID:5644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5316 -ip 5316
1⤵
PID:5720

C:\Users\Admin\AppData\Local\Temp\5521.exe
C:\Users\Admin\AppData\Local\Temp\5521.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5780

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5992

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:5516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
3⤵
PID:5160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5696

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
4⤵
PID:2368

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
4⤵
PID:684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:1684

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
4⤵
PID:2208

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
4⤵
PID:5172

C:\Users\Admin\AppData\Local\Temp\5BE9.exe
C:\Users\Admin\AppData\Local\Temp\5BE9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:5488

C:\Users\Admin\AppData\Local\Temp\661B.exe
C:\Users\Admin\AppData\Local\Temp\661B.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 792
2⤵
- Program crash
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5328 -ip 5328
1⤵
PID:5580

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:2208

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:5936

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:4700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery