amadey | 87b3109dda617d9459cfb758766910a68f46076050f274821dc3ffebb54642f1

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1mV08SP1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	BBFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1mV08SP1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1mV08SP1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1mV08SP1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1mV08SP1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1mV08SP1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	BBFC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	BBFC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	BBFC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	BBFC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	BBFC.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral2/memory/3880-82-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/files/0x0007000000023254-365.dat	family_redline
behavioral2/files/0x0007000000023254-366.dat	family_redline
behavioral2/memory/5140-367-0x0000000000610000-0x000000000064E000-memory.dmp	family_redline
behavioral2/memory/4788-717-0x00000000005F0000-0x000000000064A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	5uh7AH0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	B514.bat
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	BE8D.exe

Executes dropped EXE 23 IoCs

pid	Process
3476	LB2qB17.exe
2312	El4rr47.exe
1760	YL5st92.exe
3668	1mV08SP1.exe
3860	2Wc7828.exe
1848	3Vh52ZU.exe
4556	4BU568lC.exe
3848	5uh7AH0.exe
2672	A301.exe
5124	kx4St2pf.exe
5380	IB0tc6CQ.exe
5464	B264.exe
5316	Ok8bG1wv.exe
5424	FG2wS5ol.exe
5916	1OG42Qe5.exe
3776	B514.bat
3380	B8A0.exe
3664	BBFC.exe
5764	BE8D.exe
5140	2hH861vm.exe
5440	explothe.exe
4644	explothe.exe
6064	FFFC.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1mV08SP1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1mV08SP1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	BBFC.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	LB2qB17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	YL5st92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	IB0tc6CQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	El4rr47.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	A301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kx4St2pf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ok8bG1wv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	FG2wS5ol.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3860 set thread context of 1172	3860	2Wc7828.exe	102
PID 1848 set thread context of 1520	1848	3Vh52ZU.exe	109
PID 4556 set thread context of 3880	4556	4BU568lC.exe	113
PID 5464 set thread context of 6132	5464	B264.exe	153
PID 5916 set thread context of 4712	5916	1OG42Qe5.exe	158
PID 3380 set thread context of 5736	3380	B8A0.exe	170

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4868	3860	WerFault.exe	100
3508	1172	WerFault.exe	102
1888	1848	WerFault.exe	108
1048	4556	WerFault.exe	112
6084	5464	WerFault.exe	149
2996	5916	WerFault.exe	150
2444	4712	WerFault.exe	158
5456	3380	WerFault.exe	164

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5112	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3668	1mV08SP1.exe
3668	1mV08SP1.exe
1520	AppLaunch.exe
1520	AppLaunch.exe
404	msedge.exe
404	msedge.exe
3816	msedge.exe
3816	msedge.exe
2792	msedge.exe
2792	msedge.exe
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found
2568	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1520	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	1mV08SP1.exe
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeDebugPrivilege	3664	BBFC.exe
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found
Token: SeShutdownPrivilege	2568	Process not Found
Token: SeCreatePagefilePrivilege	2568	Process not Found

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2568	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3476	4064	file.exe	87
PID 4064 wrote to memory of 3476	4064	file.exe	87
PID 4064 wrote to memory of 3476	4064	file.exe	87
PID 3476 wrote to memory of 2312	3476	LB2qB17.exe	88
PID 3476 wrote to memory of 2312	3476	LB2qB17.exe	88
PID 3476 wrote to memory of 2312	3476	LB2qB17.exe	88
PID 2312 wrote to memory of 1760	2312	El4rr47.exe	89
PID 2312 wrote to memory of 1760	2312	El4rr47.exe	89
PID 2312 wrote to memory of 1760	2312	El4rr47.exe	89
PID 1760 wrote to memory of 3668	1760	YL5st92.exe	90
PID 1760 wrote to memory of 3668	1760	YL5st92.exe	90
PID 1760 wrote to memory of 3668	1760	YL5st92.exe	90
PID 1760 wrote to memory of 3860	1760	YL5st92.exe	100
PID 1760 wrote to memory of 3860	1760	YL5st92.exe	100
PID 1760 wrote to memory of 3860	1760	YL5st92.exe	100
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 3860 wrote to memory of 1172	3860	2Wc7828.exe	102
PID 2312 wrote to memory of 1848	2312	El4rr47.exe	108
PID 2312 wrote to memory of 1848	2312	El4rr47.exe	108
PID 2312 wrote to memory of 1848	2312	El4rr47.exe	108
PID 1848 wrote to memory of 1520	1848	3Vh52ZU.exe	109
PID 1848 wrote to memory of 1520	1848	3Vh52ZU.exe	109
PID 1848 wrote to memory of 1520	1848	3Vh52ZU.exe	109
PID 1848 wrote to memory of 1520	1848	3Vh52ZU.exe	109
PID 1848 wrote to memory of 1520	1848	3Vh52ZU.exe	109
PID 1848 wrote to memory of 1520	1848	3Vh52ZU.exe	109
PID 3476 wrote to memory of 4556	3476	LB2qB17.exe	112
PID 3476 wrote to memory of 4556	3476	LB2qB17.exe	112
PID 3476 wrote to memory of 4556	3476	LB2qB17.exe	112
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4556 wrote to memory of 3880	4556	4BU568lC.exe	113
PID 4064 wrote to memory of 3848	4064	file.exe	116
PID 4064 wrote to memory of 3848	4064	file.exe	116
PID 4064 wrote to memory of 3848	4064	file.exe	116
PID 3848 wrote to memory of 2272	3848	5uh7AH0.exe	117
PID 3848 wrote to memory of 2272	3848	5uh7AH0.exe	117
PID 2272 wrote to memory of 3680	2272	cmd.exe	120
PID 2272 wrote to memory of 3680	2272	cmd.exe	120
PID 3680 wrote to memory of 4992	3680	msedge.exe	121
PID 3680 wrote to memory of 4992	3680	msedge.exe	121
PID 2272 wrote to memory of 2792	2272	cmd.exe	122
PID 2272 wrote to memory of 2792	2272	cmd.exe	122
PID 2792 wrote to memory of 3824	2792	msedge.exe	123
PID 2792 wrote to memory of 3824	2792	msedge.exe	123
PID 3680 wrote to memory of 4160	3680	msedge.exe	125
PID 3680 wrote to memory of 4160	3680	msedge.exe	125
PID 3680 wrote to memory of 4160	3680	msedge.exe	125
PID 3680 wrote to memory of 4160	3680	msedge.exe	125
PID 3680 wrote to memory of 4160	3680	msedge.exe	125
PID 3680 wrote to memory of 4160	3680	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3860
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 540
        7⤵
        Program crash
        
        PID:3508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 536
        6⤵
        Program crash
        
        PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 568
        5⤵
        Program crash
        
        PID:1888
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3880
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 572
      4⤵
      Program crash
      PID:1048
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1548.tmp\1549.tmp\154A.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
        5⤵
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3183054514280126068,9414628779482904679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3183054514280126068,9414628779482904679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        5⤵
        
        PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
        5⤵
        
        PID:3824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        5⤵
        
        PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:1436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:4340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
        5⤵
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
        5⤵
        
        PID:5316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
        5⤵
        
        PID:5324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
        5⤵
        
        PID:5544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
        5⤵
        
        PID:5552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
        5⤵
        
        PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
        5⤵
        
        PID:5928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
        5⤵
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
        5⤵
        
        PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3860 -ip 3860
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1172 -ip 1172
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1848 -ip 1848
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4556 -ip 4556
1⤵
PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\A301.exe
C:\Users\Admin\AppData\Local\Temp\A301.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2672
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5124
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe
    C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe
      C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe
        6⤵
        Executes dropped EXE
        
        PID:5140

C:\Users\Admin\AppData\Local\Temp\B264.exe
C:\Users\Admin\AppData\Local\Temp\B264.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:6132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 416
  2⤵
  - Program crash
  PID:6084

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 540
    3⤵
    - Program crash
    PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 592
  2⤵
  - Program crash
  PID:2996

C:\Users\Admin\AppData\Local\Temp\B514.bat
"C:\Users\Admin\AppData\Local\Temp\B514.bat"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3776
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B65B.tmp\B65C.tmp\B65D.bat C:\Users\Admin\AppData\Local\Temp\B514.bat"
  2⤵
  PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
    3⤵
    PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
      4⤵
      PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5464 -ip 5464
1⤵
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5916 -ip 5916
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4712 -ip 4712
1⤵
PID:4948

C:\Users\Admin\AppData\Local\Temp\B8A0.exe
C:\Users\Admin\AppData\Local\Temp\B8A0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 416
  2⤵
  - Program crash
  PID:5456

C:\Users\Admin\AppData\Local\Temp\BBFC.exe
C:\Users\Admin\AppData\Local\Temp\BBFC.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
1⤵
PID:3668

C:\Users\Admin\AppData\Local\Temp\BE8D.exe
C:\Users\Admin\AppData\Local\Temp\BE8D.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5764
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5440
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - DcRat
    - Creates scheduled task(s)
    PID:5112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:4120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4816
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:724
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:4292
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:5672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4792
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:2844
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3380 -ip 3380
1⤵
PID:2160

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Users\Admin\AppData\Local\Temp\FFFC.exe
C:\Users\Admin\AppData\Local\Temp\FFFC.exe
1⤵
- Executes dropped EXE
PID:6064
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    PID:5772
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:5260
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:6036
- C:\Users\Admin\AppData\Local\Temp\source1.exe
  "C:\Users\Admin\AppData\Local\Temp\source1.exe"
  2⤵
  PID:5508
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:5092
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  PID:3784

C:\Users\Admin\AppData\Local\Temp\A4C9.exe
C:\Users\Admin\AppData\Local\Temp\A4C9.exe
1⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\B37F.exe
C:\Users\Admin\AppData\Local\Temp\B37F.exe
1⤵
PID:3552

C:\Users\Admin\AppData\Local\Temp\B824.exe
C:\Users\Admin\AppData\Local\Temp\B824.exe
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery