amadey | 94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1rp24xV4.exeDBD8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1rp24xV4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1rp24xV4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	DBD8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1rp24xV4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1rp24xV4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1rp24xV4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1rp24xV4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	DBD8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	DBD8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	DBD8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	DBD8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	DBD8.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3916-83-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/5444-365-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2wC017am.exe	family_redline
behavioral2/memory/5860-403-0x00000000004C0000-0x00000000004FE000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2wC017am.exe	family_redline
behavioral2/memory/5748-412-0x00000000005C0000-0x000000000061A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

oneetx.exeexplothe.exeE0AD.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	E0AD.exe

Executes dropped EXE 25 IoCs

Processes:

et2SX16.exeAA1sY98.exeMG5EG62.exe1rp24xV4.exe2OW1017.exe3gG70Mz.exe4Jx126bI.exe5Bu9Gq9.exeD4EF.exeTm1Rk1co.exeD647.exeYS9no9ju.exeUe6ca1fb.exeCS7Xh5WC.exe1lG57av0.exeDA70.exeDBD8.exemsedge.exeE0AD.exeexplothe.exeE486.exe2wC017am.exeoneetx.exeexplothe.exeoneetx.exe

pid	process
1872	et2SX16.exe
1236	AA1sY98.exe
4320	MG5EG62.exe
2344	1rp24xV4.exe
1072	2OW1017.exe
4892	3gG70Mz.exe
2844	4Jx126bI.exe
4780	5Bu9Gq9.exe
1704	D4EF.exe
4612	Tm1Rk1co.exe
2580	D647.exe
2324	YS9no9ju.exe
4632	Ue6ca1fb.exe
3080	CS7Xh5WC.exe
4172	1lG57av0.exe
5188	DA70.exe
5260	DBD8.exe
5384	msedge.exe
5572	E0AD.exe
5716	explothe.exe
5748	E486.exe
5860	2wC017am.exe
5976	oneetx.exe
5984	explothe.exe
6040	oneetx.exe

Loads dropped DLL 3 IoCs

Processes:

E486.exerundll32.exe

pid process

5748 E486.exe
5748 E486.exe
6016 rundll32.exe

pid	process
5748	E486.exe
5748	E486.exe
6016	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

1rp24xV4.exeDBD8.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1rp24xV4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1rp24xV4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	DBD8.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

D4EF.exeTm1Rk1co.exeUe6ca1fb.exeNEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exeet2SX16.exeAA1sY98.exeMG5EG62.exeYS9no9ju.exeCS7Xh5WC.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	D4EF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Tm1Rk1co.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ue6ca1fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	et2SX16.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	AA1sY98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	MG5EG62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	YS9no9ju.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	CS7Xh5WC.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

2OW1017.exe3gG70Mz.exe4Jx126bI.exeD647.exe1lG57av0.exeDA70.exe

description	pid	process	target process
PID 1072 set thread context of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 4892 set thread context of 4768	4892	3gG70Mz.exe	AppLaunch.exe
PID 2844 set thread context of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2580 set thread context of 5152	2580	D647.exe	AppLaunch.exe
PID 4172 set thread context of 5292	4172	1lG57av0.exe	AppLaunch.exe
PID 5188 set thread context of 5444	5188	DA70.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3984	1072	WerFault.exe	2OW1017.exe
2748	4588	WerFault.exe	AppLaunch.exe
3692	4892	WerFault.exe	3gG70Mz.exe
2528	2844	WerFault.exe	4Jx126bI.exe
5300	2580	WerFault.exe	D647.exe
5460	4172	WerFault.exe	1lG57av0.exe
5504	5292	WerFault.exe	AppLaunch.exe
5588	5188	WerFault.exe	DA70.exe
5244	5748	WerFault.exe	E486.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5956 schtasks.exe
5164 schtasks.exe

pid	process
5956	schtasks.exe
5164	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1rp24xV4.exeAppLaunch.exemsedge.exemsedge.exemsedge.exe

pid	process
2344	1rp24xV4.exe
2344	1rp24xV4.exe
4768	AppLaunch.exe
4768	AppLaunch.exe
3184
3184
3708	msedge.exe
3708	msedge.exe
3184
3184
1540	msedge.exe
1540	msedge.exe
3184
3184
1628	msedge.exe
1628	msedge.exe
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184
3184

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

4768 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe

pid	process
4768	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

1rp24xV4.exeDBD8.exe

description	pid	process
Token: SeDebugPrivilege	2344	1rp24xV4.exe
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeDebugPrivilege	5260	DBD8.exe
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184
Token: SeShutdownPrivilege	3184
Token: SeCreatePagefilePrivilege	3184

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exeE0AD.exe

pid	process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
5572	E0AD.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exeet2SX16.exeAA1sY98.exeMG5EG62.exe2OW1017.exe3gG70Mz.exe4Jx126bI.exe5Bu9Gq9.execmd.exemsedge.exemsedge.exe

description	pid	process	target process
PID 1964 wrote to memory of 1872	1964	NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe	et2SX16.exe
PID 1964 wrote to memory of 1872	1964	NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe	et2SX16.exe
PID 1964 wrote to memory of 1872	1964	NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe	et2SX16.exe
PID 1872 wrote to memory of 1236	1872	et2SX16.exe	AA1sY98.exe
PID 1872 wrote to memory of 1236	1872	et2SX16.exe	AA1sY98.exe
PID 1872 wrote to memory of 1236	1872	et2SX16.exe	AA1sY98.exe
PID 1236 wrote to memory of 4320	1236	AA1sY98.exe	MG5EG62.exe
PID 1236 wrote to memory of 4320	1236	AA1sY98.exe	MG5EG62.exe
PID 1236 wrote to memory of 4320	1236	AA1sY98.exe	MG5EG62.exe
PID 4320 wrote to memory of 2344	4320	MG5EG62.exe	1rp24xV4.exe
PID 4320 wrote to memory of 2344	4320	MG5EG62.exe	1rp24xV4.exe
PID 4320 wrote to memory of 2344	4320	MG5EG62.exe	1rp24xV4.exe
PID 4320 wrote to memory of 1072	4320	MG5EG62.exe	2OW1017.exe
PID 4320 wrote to memory of 1072	4320	MG5EG62.exe	2OW1017.exe
PID 4320 wrote to memory of 1072	4320	MG5EG62.exe	2OW1017.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1072 wrote to memory of 4588	1072	2OW1017.exe	AppLaunch.exe
PID 1236 wrote to memory of 4892	1236	AA1sY98.exe	3gG70Mz.exe
PID 1236 wrote to memory of 4892	1236	AA1sY98.exe	3gG70Mz.exe
PID 1236 wrote to memory of 4892	1236	AA1sY98.exe	3gG70Mz.exe
PID 4892 wrote to memory of 4768	4892	3gG70Mz.exe	AppLaunch.exe
PID 4892 wrote to memory of 4768	4892	3gG70Mz.exe	AppLaunch.exe
PID 4892 wrote to memory of 4768	4892	3gG70Mz.exe	AppLaunch.exe
PID 4892 wrote to memory of 4768	4892	3gG70Mz.exe	AppLaunch.exe
PID 4892 wrote to memory of 4768	4892	3gG70Mz.exe	AppLaunch.exe
PID 4892 wrote to memory of 4768	4892	3gG70Mz.exe	AppLaunch.exe
PID 1872 wrote to memory of 2844	1872	et2SX16.exe	4Jx126bI.exe
PID 1872 wrote to memory of 2844	1872	et2SX16.exe	4Jx126bI.exe
PID 1872 wrote to memory of 2844	1872	et2SX16.exe	4Jx126bI.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 2844 wrote to memory of 3916	2844	4Jx126bI.exe	AppLaunch.exe
PID 1964 wrote to memory of 4780	1964	NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe	5Bu9Gq9.exe
PID 1964 wrote to memory of 4780	1964	NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe	5Bu9Gq9.exe
PID 1964 wrote to memory of 4780	1964	NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe	5Bu9Gq9.exe
PID 4780 wrote to memory of 320	4780	5Bu9Gq9.exe	cmd.exe
PID 4780 wrote to memory of 320	4780	5Bu9Gq9.exe	cmd.exe
PID 320 wrote to memory of 4276	320	cmd.exe	msedge.exe
PID 320 wrote to memory of 4276	320	cmd.exe	msedge.exe
PID 4276 wrote to memory of 4980	4276	msedge.exe	msedge.exe
PID 4276 wrote to memory of 4980	4276	msedge.exe	msedge.exe
PID 320 wrote to memory of 1628	320	cmd.exe	msedge.exe
PID 320 wrote to memory of 1628	320	cmd.exe	msedge.exe
PID 1628 wrote to memory of 4660	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 4660	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1228	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1228	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1228	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1228	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1228	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1228	1628	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\et2SX16.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\et2SX16.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1872

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AA1sY98.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AA1sY98.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MG5EG62.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MG5EG62.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp24xV4.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rp24xV4.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2OW1017.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2OW1017.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 540
7⤵
- Program crash
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 560
6⤵
- Program crash
PID:3984

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gG70Mz.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gG70Mz.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 216
5⤵
- Program crash
PID:3692

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Jx126bI.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Jx126bI.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 564
4⤵
- Program crash
PID:2528

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Bu9Gq9.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Bu9Gq9.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7C8E.tmp\7C8F.tmp\7C90.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Bu9Gq9.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff9f18946f8,0x7ff9f1894708,0x7ff9f1894718
5⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3639958149437628784,46667038117252496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
5⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3639958149437628784,46667038117252496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9f18946f8,0x7ff9f1894708,0x7ff9f1894718
5⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
5⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
5⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
5⤵
PID:520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
5⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
5⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
5⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
5⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
5⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
5⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
5⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
5⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
5⤵
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
5⤵
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,10906040535445254598,18383529543232823423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
5⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4588 -ip 4588
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1072 -ip 1072
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4892 -ip 4892
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2844 -ip 2844
1⤵
PID:824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\D4EF.exe
C:\Users\Admin\AppData\Local\Temp\D4EF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1704

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tm1Rk1co.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tm1Rk1co.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4612

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YS9no9ju.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YS9no9ju.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2324

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ue6ca1fb.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ue6ca1fb.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4632

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\CS7Xh5WC.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\CS7Xh5WC.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3080

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1lG57av0.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1lG57av0.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 540
8⤵
- Program crash
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 192
7⤵
- Program crash
PID:5460

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2wC017am.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2wC017am.exe
6⤵
- Executes dropped EXE
PID:5860

C:\Users\Admin\AppData\Local\Temp\D647.exe
C:\Users\Admin\AppData\Local\Temp\D647.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 416
2⤵
- Program crash
PID:5300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D87B.bat" "
1⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f18946f8,0x7ff9f1894708,0x7ff9f1894718
3⤵
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
- Executes dropped EXE
PID:5384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f18946f8,0x7ff9f1894708,0x7ff9f1894718
3⤵
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2580 -ip 2580
1⤵
PID:5172

C:\Users\Admin\AppData\Local\Temp\DA70.exe
C:\Users\Admin\AppData\Local\Temp\DA70.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 388
2⤵
- Program crash
PID:5588

C:\Users\Admin\AppData\Local\Temp\DBD8.exe
C:\Users\Admin\AppData\Local\Temp\DBD8.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4172 -ip 4172
1⤵
PID:5340

C:\Users\Admin\AppData\Local\Temp\DE2B.exe
C:\Users\Admin\AppData\Local\Temp\DE2B.exe
1⤵
PID:5384

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5716

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:5956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
3⤵
PID:6024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5560

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
4⤵
PID:2936

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
4⤵
PID:5648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5548

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
4⤵
PID:5436

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
4⤵
PID:5332

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5292 -ip 5292
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5188 -ip 5188
1⤵
PID:5488

C:\Users\Admin\AppData\Local\Temp\E0AD.exe
C:\Users\Admin\AppData\Local\Temp\E0AD.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5572

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5976

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:5164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
3⤵
PID:5256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5332

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
4⤵
PID:5612

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
4⤵
PID:6020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:2804

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:N"
4⤵
PID:4728

C:\Windows\SysWOW64\cacls.exe
CACLS "..\207aa4515d" /P "Admin:R" /E
4⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\E486.exe
C:\Users\Admin\AppData\Local\Temp\E486.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 784
2⤵
- Program crash
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5748 -ip 5748
1⤵
PID:5376

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:6040

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

System Information Discovery