amadey | 20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1d

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1Wo21gF3.exe464F.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Wo21gF3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Wo21gF3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	464F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	464F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	464F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1Wo21gF3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Wo21gF3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	464F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	464F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	464F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Wo21gF3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Wo21gF3.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2092-84-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/5488-363-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/5680-511-0x00000000004C0000-0x00000000004FE000-memory.dmp	family_redline
behavioral2/memory/5556-542-0x0000000000470000-0x00000000004CA000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

oneetx.exe48A2.exeexplothe.exe4D56.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	48A2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	4D56.exe

Executes dropped EXE 28 IoCs

Processes:

RN1pf94.exeaW3vU52.exeSj0rh73.exe1Wo21gF3.exe2lZ8941.exe3Ya70CP.exe4Sh859Wh.exe5Hc1Mr3.exe3B10.exehi3Au5PI.exexF4cu2Po.exeuH9UJ6zN.exe3D63.exeqR5UA0XD.exe1rh66mO9.exe4516.exe464F.exe48A2.exe4D56.exeexplothe.exe519D.exe2Sr732yu.exeoneetx.exe5DF2.exeoneetx.exeexplothe.exeoneetx.exeexplothe.exe

pid	process
3800	RN1pf94.exe
2276	aW3vU52.exe
1164	Sj0rh73.exe
4620	1Wo21gF3.exe
1940	2lZ8941.exe
2044	3Ya70CP.exe
3044	4Sh859Wh.exe
1820	5Hc1Mr3.exe
3804	3B10.exe
3584	hi3Au5PI.exe
4924	xF4cu2Po.exe
1556	uH9UJ6zN.exe
716	3D63.exe
5084	qR5UA0XD.exe
4208	1rh66mO9.exe
5308	4516.exe
5348	464F.exe
5548	48A2.exe
5996	4D56.exe
6052	explothe.exe
5556	519D.exe
5680	2Sr732yu.exe
6008	oneetx.exe
5224	5DF2.exe
5784	oneetx.exe
5924	explothe.exe
4048	oneetx.exe
5948	explothe.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

5560 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5560	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

464F.exe1Wo21gF3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	464F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1Wo21gF3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Wo21gF3.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exeaW3vU52.exeSj0rh73.exehi3Au5PI.exexF4cu2Po.exeuH9UJ6zN.exeqR5UA0XD.exeRN1pf94.exe3B10.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	aW3vU52.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Sj0rh73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	hi3Au5PI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xF4cu2Po.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	uH9UJ6zN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	qR5UA0XD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	RN1pf94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3B10.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

Processes:

2lZ8941.exe3Ya70CP.exe4Sh859Wh.exe1rh66mO9.exe4516.exe

description	pid	process	target process
PID 1940 set thread context of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 2044 set thread context of 3444	2044	3Ya70CP.exe	AppLaunch.exe
PID 3044 set thread context of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 716 set thread context of 2600	716		AppLaunch.exe
PID 4208 set thread context of 2020	4208	1rh66mO9.exe	AppLaunch.exe
PID 5308 set thread context of 5488	5308	4516.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4936	408	WerFault.exe	AppLaunch.exe
4176	1940	WerFault.exe	2lZ8941.exe
1752	2044	WerFault.exe	3Ya70CP.exe
628	3044	WerFault.exe	4Sh859Wh.exe
856	716	WerFault.exe	3D63.exe
5208	4208	WerFault.exe	1rh66mO9.exe
5220	2020	WerFault.exe	AppLaunch.exe
5620	5308	WerFault.exe	4516.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AppLaunch.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

5DF2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	5DF2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	5DF2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5656 schtasks.exe
3648 schtasks.exe

pid	process
5656	schtasks.exe
3648	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1Wo21gF3.exeAppLaunch.exemsedge.exemsedge.exemsedge.exe

pid	process
4620	1Wo21gF3.exe
4620	1Wo21gF3.exe
3444	AppLaunch.exe
3444	AppLaunch.exe
3908	msedge.exe
3908	msedge.exe
3932	msedge.exe
3932	msedge.exe
4368	msedge.exe
4368	msedge.exe
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608
2608

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

3444 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe
4368 msedge.exe

pid	process
3444	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

1Wo21gF3.exe464F.exe519D.exe5DF2.exe

description	pid	process
Token: SeDebugPrivilege	4620	1Wo21gF3.exe
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeDebugPrivilege	5348	464F.exe
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608
Token: SeDebugPrivilege	5556	519D.exe
Token: SeDebugPrivilege	5224	5DF2.exe
Token: SeShutdownPrivilege	2608
Token: SeCreatePagefilePrivilege	2608

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe4D56.exe

pid	process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
5996	4D56.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2608

pid	process
2608

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exeRN1pf94.exeaW3vU52.exeSj0rh73.exe2lZ8941.exe3Ya70CP.exe4Sh859Wh.exe5Hc1Mr3.execmd.exemsedge.exemsedge.exe

description	pid	process	target process
PID 3540 wrote to memory of 3800	3540	NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe	RN1pf94.exe
PID 3540 wrote to memory of 3800	3540	NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe	RN1pf94.exe
PID 3540 wrote to memory of 3800	3540	NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe	RN1pf94.exe
PID 3800 wrote to memory of 2276	3800	RN1pf94.exe	aW3vU52.exe
PID 3800 wrote to memory of 2276	3800	RN1pf94.exe	aW3vU52.exe
PID 3800 wrote to memory of 2276	3800	RN1pf94.exe	aW3vU52.exe
PID 2276 wrote to memory of 1164	2276	aW3vU52.exe	Sj0rh73.exe
PID 2276 wrote to memory of 1164	2276	aW3vU52.exe	Sj0rh73.exe
PID 2276 wrote to memory of 1164	2276	aW3vU52.exe	Sj0rh73.exe
PID 1164 wrote to memory of 4620	1164	Sj0rh73.exe	1Wo21gF3.exe
PID 1164 wrote to memory of 4620	1164	Sj0rh73.exe	1Wo21gF3.exe
PID 1164 wrote to memory of 4620	1164	Sj0rh73.exe	1Wo21gF3.exe
PID 1164 wrote to memory of 1940	1164	Sj0rh73.exe	2lZ8941.exe
PID 1164 wrote to memory of 1940	1164	Sj0rh73.exe	2lZ8941.exe
PID 1164 wrote to memory of 1940	1164	Sj0rh73.exe	2lZ8941.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 1940 wrote to memory of 408	1940	2lZ8941.exe	AppLaunch.exe
PID 2276 wrote to memory of 2044	2276	aW3vU52.exe	3Ya70CP.exe
PID 2276 wrote to memory of 2044	2276	aW3vU52.exe	3Ya70CP.exe
PID 2276 wrote to memory of 2044	2276	aW3vU52.exe	3Ya70CP.exe
PID 2044 wrote to memory of 3444	2044	3Ya70CP.exe	AppLaunch.exe
PID 2044 wrote to memory of 3444	2044	3Ya70CP.exe	AppLaunch.exe
PID 2044 wrote to memory of 3444	2044	3Ya70CP.exe	AppLaunch.exe
PID 2044 wrote to memory of 3444	2044	3Ya70CP.exe	AppLaunch.exe
PID 2044 wrote to memory of 3444	2044	3Ya70CP.exe	AppLaunch.exe
PID 2044 wrote to memory of 3444	2044	3Ya70CP.exe	AppLaunch.exe
PID 3800 wrote to memory of 3044	3800	RN1pf94.exe	4Sh859Wh.exe
PID 3800 wrote to memory of 3044	3800	RN1pf94.exe	4Sh859Wh.exe
PID 3800 wrote to memory of 3044	3800	RN1pf94.exe	4Sh859Wh.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3044 wrote to memory of 2092	3044	4Sh859Wh.exe	AppLaunch.exe
PID 3540 wrote to memory of 1820	3540	NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe	5Hc1Mr3.exe
PID 3540 wrote to memory of 1820	3540	NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe	5Hc1Mr3.exe
PID 3540 wrote to memory of 1820	3540	NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe	5Hc1Mr3.exe
PID 1820 wrote to memory of 4668	1820	5Hc1Mr3.exe	cmd.exe
PID 1820 wrote to memory of 4668	1820	5Hc1Mr3.exe	cmd.exe
PID 4668 wrote to memory of 4488	4668	cmd.exe	msedge.exe
PID 4668 wrote to memory of 4488	4668	cmd.exe	msedge.exe
PID 4668 wrote to memory of 4368	4668	cmd.exe	msedge.exe
PID 4668 wrote to memory of 4368	4668	cmd.exe	msedge.exe
PID 4488 wrote to memory of 2320	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2320	4488	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1792	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1792	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1372	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1372	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1372	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1372	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1372	4368	msedge.exe	msedge.exe
PID 4368 wrote to memory of 1372	4368	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1dexe_JC.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3540

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RN1pf94.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RN1pf94.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3800

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aW3vU52.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aW3vU52.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Sj0rh73.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Sj0rh73.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Wo21gF3.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Wo21gF3.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2lZ8941.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2lZ8941.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 540
7⤵
- Program crash
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 148
6⤵
- Program crash
PID:4176

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Ya70CP.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Ya70CP.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 156
5⤵
- Program crash
PID:1752

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sh859Wh.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sh859Wh.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 428
4⤵
- Program crash
PID:628

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Hc1Mr3.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Hc1Mr3.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E2AF.tmp\E2B0.tmp\E2B1.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Hc1Mr3.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff8dbcf46f8,0x7ff8dbcf4708,0x7ff8dbcf4718
5⤵
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,3042702886137031049,5608901345467802809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,3042702886137031049,5608901345467802809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
5⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff8dbcf46f8,0x7ff8dbcf4708,0x7ff8dbcf4718
5⤵
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
5⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
5⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
5⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
5⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
5⤵
PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
5⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
5⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
5⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
5⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
5⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
5⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
5⤵
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
5⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12251277299516585462,9608792498564948136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
5⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1940 -ip 1940
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 408 -ip 408
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2044 -ip 2044
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3044 -ip 3044
1⤵
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:312

C:\Users\Admin\AppData\Local\Temp\3B10.exe
C:\Users\Admin\AppData\Local\Temp\3B10.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3804

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hi3Au5PI.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hi3Au5PI.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3584

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xF4cu2Po.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xF4cu2Po.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4924

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uH9UJ6zN.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\uH9UJ6zN.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1556

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\qR5UA0XD.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\qR5UA0XD.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5084

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1rh66mO9.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1rh66mO9.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 540
8⤵
- Program crash
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 572
7⤵
- Program crash
PID:5208

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Sr732yu.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Sr732yu.exe
6⤵
- Executes dropped EXE
PID:5680

C:\Users\Admin\AppData\Local\Temp\3D63.exe
C:\Users\Admin\AppData\Local\Temp\3D63.exe
1⤵
- Executes dropped EXE
PID:716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 216
2⤵
- Program crash
PID:856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\40A0.bat" "
1⤵
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff8dbcf46f8,0x7ff8dbcf4708,0x7ff8dbcf4718
3⤵
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dbcf46f8,0x7ff8dbcf4708,0x7ff8dbcf4718
3⤵
PID:6108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 716 -ip 716
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4208 -ip 4208
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2020 -ip 2020
1⤵
PID:5180

C:\Users\Admin\AppData\Local\Temp\4516.exe
C:\Users\Admin\AppData\Local\Temp\4516.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 388
2⤵
- Program crash
PID:5620

C:\Users\Admin\AppData\Local\Temp\464F.exe
C:\Users\Admin\AppData\Local\Temp\464F.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5308 -ip 5308
1⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\48A2.exe
C:\Users\Admin\AppData\Local\Temp\48A2.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5548

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:6052

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:5656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
3⤵
PID:5816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:800

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
4⤵
PID:4636

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
4⤵
PID:5896

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
4⤵
PID:5632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5540

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
4⤵
PID:5648

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:5560

C:\Users\Admin\AppData\Local\Temp\4D56.exe
C:\Users\Admin\AppData\Local\Temp\4D56.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5996

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:6008

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:3648

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
3⤵
PID:624

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
4⤵
PID:5660

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5628

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
4⤵
PID:5780

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
4⤵
PID:5784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5776

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
4⤵
PID:5952

C:\Users\Admin\AppData\Local\Temp\519D.exe
C:\Users\Admin\AppData\Local\Temp\519D.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Users\Admin\AppData\Local\Temp\5DF2.exe
C:\Users\Admin\AppData\Local\Temp\5DF2.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5224

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:5784

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5924

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:4048

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery