amadey | 05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9c

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

72BE.exe1hD97Id0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	72BE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1hD97Id0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1hD97Id0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1hD97Id0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1hD97Id0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1hD97Id0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	72BE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1hD97Id0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	72BE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	72BE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	72BE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	72BE.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4444-84-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/3012-365-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ek793RU.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ek793RU.exe	family_redline
behavioral2/memory/5244-386-0x0000000000DA0000-0x0000000000DDE000-memory.dmp	family_redline
behavioral2/memory/4204-418-0x0000000000470000-0x00000000004CA000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

7792.exeexplothe.exeoneetx.exe759D.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	7792.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	759D.exe

Executes dropped EXE 28 IoCs

Processes:

zT9tA25.exekG8dY74.exehv6Vk21.exe1hD97Id0.exe2EL1641.exe3Aq78uT.exe4PS866Ri.exe5Kc2IE7.exe6B48.exedx8EA9Ar.exelQ0Gc4nf.exe6E08.exegI0FE6YH.exeIh3ZH7kq.exe1Vg97KX6.exe7165.exe72BE.exe759D.exe7792.exe7B2D.exe2Ek793RU.exeexplothe.exe84E3.exeoneetx.exeexplothe.exeoneetx.exeexplothe.exeoneetx.exe

pid	process
3784	zT9tA25.exe
1648	kG8dY74.exe
2704	hv6Vk21.exe
3024	1hD97Id0.exe
968	2EL1641.exe
3788	3Aq78uT.exe
1808	4PS866Ri.exe
4044	5Kc2IE7.exe
3136	6B48.exe
924	dx8EA9Ar.exe
4324	lQ0Gc4nf.exe
1216	6E08.exe
4496	gI0FE6YH.exe
1276	Ih3ZH7kq.exe
3868	1Vg97KX6.exe
3392	7165.exe
3632	72BE.exe
2928	759D.exe
4752	7792.exe
4204	7B2D.exe
5244	2Ek793RU.exe
5452	explothe.exe
5552	84E3.exe
5904	oneetx.exe
1016	explothe.exe
5496	oneetx.exe
3384	explothe.exe
3904	oneetx.exe

Loads dropped DLL 3 IoCs

Processes:

7B2D.exerundll32.exe

pid process

4204 7B2D.exe
4204 7B2D.exe
4356 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4204	7B2D.exe
4204	7B2D.exe
4356	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

1hD97Id0.exe72BE.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1hD97Id0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1hD97Id0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	72BE.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exehv6Vk21.exedx8EA9Ar.exelQ0Gc4nf.exeIh3ZH7kq.exezT9tA25.exekG8dY74.exe6B48.exegI0FE6YH.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hv6Vk21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	dx8EA9Ar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	lQ0Gc4nf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	Ih3ZH7kq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zT9tA25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kG8dY74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6B48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	gI0FE6YH.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

2EL1641.exe3Aq78uT.exe4PS866Ri.execmd.exe1Vg97KX6.exe7165.exe

description	pid	process	target process
PID 968 set thread context of 2064	968	2EL1641.exe	AppLaunch.exe
PID 3788 set thread context of 2292	3788	3Aq78uT.exe	AppLaunch.exe
PID 1808 set thread context of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1216 set thread context of 4188	1216	cmd.exe	AppLaunch.exe
PID 3868 set thread context of 4896	3868	1Vg97KX6.exe	AppLaunch.exe
PID 3392 set thread context of 3012	3392	7165.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1392	968	WerFault.exe	2EL1641.exe
1092	2064	WerFault.exe	AppLaunch.exe
1784	3788	WerFault.exe	3Aq78uT.exe
1104	1808	WerFault.exe	4PS866Ri.exe
4452	1216	WerFault.exe	6E08.exe
2776	3868	WerFault.exe	1Vg97KX6.exe
4716	4896	WerFault.exe	AppLaunch.exe
4712	3392	WerFault.exe	7165.exe
6000	4204	WerFault.exe	7B2D.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AppLaunch.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

84E3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	84E3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	84E3.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5924 schtasks.exe
4776 schtasks.exe

pid	process
5924	schtasks.exe
4776	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1hD97Id0.exeAppLaunch.exemsedge.exemsedge.exemsedge.exe

pid	process
3024	1hD97Id0.exe
3024	1hD97Id0.exe
2292	AppLaunch.exe
2292	AppLaunch.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
5016	msedge.exe
5016	msedge.exe
3160
3160
4232	msedge.exe
4232	msedge.exe
3160
3160
3160
3160
3160
3160
4340	msedge.exe
4340	msedge.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

2292 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe
4340 msedge.exe

pid	process
2292	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

1hD97Id0.exe72BE.exe84E3.exe

description	pid	process
Token: SeDebugPrivilege	3024	1hD97Id0.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	3632	72BE.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	5552	84E3.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe7792.exe

pid	process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4752	7792.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3160

pid	process
3160

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exezT9tA25.exekG8dY74.exehv6Vk21.exe2EL1641.exe3Aq78uT.exe4PS866Ri.exe5Kc2IE7.execmd.exemsedge.exemsedge.exe

description	pid	process	target process
PID 2208 wrote to memory of 3784	2208	NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe	zT9tA25.exe
PID 2208 wrote to memory of 3784	2208	NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe	zT9tA25.exe
PID 2208 wrote to memory of 3784	2208	NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe	zT9tA25.exe
PID 3784 wrote to memory of 1648	3784	zT9tA25.exe	kG8dY74.exe
PID 3784 wrote to memory of 1648	3784	zT9tA25.exe	kG8dY74.exe
PID 3784 wrote to memory of 1648	3784	zT9tA25.exe	kG8dY74.exe
PID 1648 wrote to memory of 2704	1648	kG8dY74.exe	hv6Vk21.exe
PID 1648 wrote to memory of 2704	1648	kG8dY74.exe	hv6Vk21.exe
PID 1648 wrote to memory of 2704	1648	kG8dY74.exe	hv6Vk21.exe
PID 2704 wrote to memory of 3024	2704	hv6Vk21.exe	1hD97Id0.exe
PID 2704 wrote to memory of 3024	2704	hv6Vk21.exe	1hD97Id0.exe
PID 2704 wrote to memory of 3024	2704	hv6Vk21.exe	1hD97Id0.exe
PID 2704 wrote to memory of 968	2704	hv6Vk21.exe	2EL1641.exe
PID 2704 wrote to memory of 968	2704	hv6Vk21.exe	2EL1641.exe
PID 2704 wrote to memory of 968	2704	hv6Vk21.exe	2EL1641.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 968 wrote to memory of 2064	968	2EL1641.exe	AppLaunch.exe
PID 1648 wrote to memory of 3788	1648	kG8dY74.exe	3Aq78uT.exe
PID 1648 wrote to memory of 3788	1648	kG8dY74.exe	3Aq78uT.exe
PID 1648 wrote to memory of 3788	1648	kG8dY74.exe	3Aq78uT.exe
PID 3788 wrote to memory of 2292	3788	3Aq78uT.exe	AppLaunch.exe
PID 3788 wrote to memory of 2292	3788	3Aq78uT.exe	AppLaunch.exe
PID 3788 wrote to memory of 2292	3788	3Aq78uT.exe	AppLaunch.exe
PID 3788 wrote to memory of 2292	3788	3Aq78uT.exe	AppLaunch.exe
PID 3788 wrote to memory of 2292	3788	3Aq78uT.exe	AppLaunch.exe
PID 3788 wrote to memory of 2292	3788	3Aq78uT.exe	AppLaunch.exe
PID 3784 wrote to memory of 1808	3784	zT9tA25.exe	4PS866Ri.exe
PID 3784 wrote to memory of 1808	3784	zT9tA25.exe	4PS866Ri.exe
PID 3784 wrote to memory of 1808	3784	zT9tA25.exe	4PS866Ri.exe
PID 1808 wrote to memory of 5072	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 5072	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 5072	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 1808 wrote to memory of 4444	1808	4PS866Ri.exe	AppLaunch.exe
PID 2208 wrote to memory of 4044	2208	NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe	5Kc2IE7.exe
PID 2208 wrote to memory of 4044	2208	NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe	5Kc2IE7.exe
PID 2208 wrote to memory of 4044	2208	NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe	5Kc2IE7.exe
PID 4044 wrote to memory of 3416	4044	5Kc2IE7.exe	cmd.exe
PID 4044 wrote to memory of 3416	4044	5Kc2IE7.exe	cmd.exe
PID 3416 wrote to memory of 2080	3416	cmd.exe	msedge.exe
PID 3416 wrote to memory of 2080	3416	cmd.exe	msedge.exe
PID 3416 wrote to memory of 4340	3416	cmd.exe	msedge.exe
PID 3416 wrote to memory of 4340	3416	cmd.exe	msedge.exe
PID 4340 wrote to memory of 1332	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 1332	4340	msedge.exe	msedge.exe
PID 2080 wrote to memory of 320	2080	msedge.exe	msedge.exe
PID 2080 wrote to memory of 320	2080	msedge.exe	msedge.exe
PID 2080 wrote to memory of 2524	2080	msedge.exe	msedge.exe
PID 2080 wrote to memory of 2524	2080	msedge.exe	msedge.exe
PID 2080 wrote to memory of 2524	2080	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9cexe_JC.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zT9tA25.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zT9tA25.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3784

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kG8dY74.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kG8dY74.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hv6Vk21.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hv6Vk21.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2704

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hD97Id0.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hD97Id0.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2EL1641.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2EL1641.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 540
7⤵
- Program crash
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 596
6⤵
- Program crash
PID:1392

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Aq78uT.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Aq78uT.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 224
5⤵
- Program crash
PID:1784

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4PS866Ri.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4PS866Ri.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:5072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 608
4⤵
- Program crash
PID:1104

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Kc2IE7.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Kc2IE7.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\147D.tmp\147E.tmp\147F.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Kc2IE7.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffad35746f8,0x7ffad3574708,0x7ffad3574718
5⤵
PID:320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18092219302716752953,10734115858797061254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
5⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,18092219302716752953,10734115858797061254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffad35746f8,0x7ffad3574708,0x7ffad3574718
5⤵
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
5⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
5⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
5⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
5⤵
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
5⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
5⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
5⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
5⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
5⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
5⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
5⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
5⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16909810527448079092,17350725249940892653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
5⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 968 -ip 968
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 2064 -ip 2064
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3788 -ip 3788
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1808 -ip 1808
1⤵
PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Users\Admin\AppData\Local\Temp\6B48.exe
C:\Users\Admin\AppData\Local\Temp\6B48.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3136

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dx8EA9Ar.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dx8EA9Ar.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:924

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lQ0Gc4nf.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lQ0Gc4nf.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4324

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\gI0FE6YH.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\gI0FE6YH.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4496

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ih3ZH7kq.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ih3ZH7kq.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1276

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Vg97KX6.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Vg97KX6.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 540
8⤵
- Program crash
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 568
7⤵
- Program crash
PID:2776

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ek793RU.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ek793RU.exe
6⤵
- Executes dropped EXE
PID:5244

C:\Users\Admin\AppData\Local\Temp\6E08.exe
C:\Users\Admin\AppData\Local\Temp\6E08.exe
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 332
2⤵
- Program crash
PID:4452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6EF3.bat" "
1⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad35746f8,0x7ffad3574708,0x7ffad3574718
3⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad35746f8,0x7ffad3574708,0x7ffad3574718
3⤵
PID:5992

C:\Users\Admin\AppData\Local\Temp\7165.exe
C:\Users\Admin\AppData\Local\Temp\7165.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 416
2⤵
- Program crash
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1216 -ip 1216
1⤵
PID:2612

C:\Users\Admin\AppData\Local\Temp\72BE.exe
C:\Users\Admin\AppData\Local\Temp\72BE.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3868 -ip 3868
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4896 -ip 4896
1⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\759D.exe
C:\Users\Admin\AppData\Local\Temp\759D.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2928

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5452

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:5924

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
3⤵
PID:5976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5208

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
4⤵
PID:2168

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
4⤵
PID:5460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5424

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
4⤵
PID:5444

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
4⤵
PID:5512

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3392 -ip 3392
1⤵
PID:2612

C:\Users\Admin\AppData\Local\Temp\7792.exe
C:\Users\Admin\AppData\Local\Temp\7792.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:4752

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5904

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:4776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
3⤵
- Suspicious use of SetThreadContext
PID:1216

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5372

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
4⤵
PID:5332

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
4⤵
PID:5400

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
4⤵
PID:5596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5560

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
4⤵
PID:5584

C:\Users\Admin\AppData\Local\Temp\7B2D.exe
C:\Users\Admin\AppData\Local\Temp\7B2D.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 784
2⤵
- Program crash
PID:6000

C:\Users\Admin\AppData\Local\Temp\84E3.exe
C:\Users\Admin\AppData\Local\Temp\84E3.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4204 -ip 4204
1⤵
PID:5840

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:1016

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:5496

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:3384

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:3904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery