amadey | 1055e85f63c4918500650bf56924ee225d9d62db0c778ea8f606f844e6d13bf9

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1zg68IH7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1zg68IH7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1zg68IH7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	F721.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	F721.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	F721.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1zg68IH7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1zg68IH7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1zg68IH7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	F721.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	F721.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	F721.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/memory/1684-83-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/5652-373-0x00000000005F0000-0x000000000062E000-memory.dmp	family_redline
behavioral2/memory/3544-445-0x00000000005E0000-0x000000000063A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	D7B0.bat
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	F9D1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	5hl0oq6.exe

Executes dropped EXE 26 IoCs

pid	Process
4352	tE5gS63.exe
1028	HG5ka69.exe
4628	sq6CQ71.exe
4568	1zg68IH7.exe
3360	2Yy4755.exe
1672	3Uw30ar.exe
2996	4Bh039GC.exe
4780	5hl0oq6.exe
212	C7C0.exe
2388	jB0xw0Vd.exe
4316	CB3B.exe
4900	Ay3zl0rC.exe
1048	D7B0.bat
2988	PJ9VB9fv.exe
1656	E156.exe
3280	IS2mS9Rs.exe
3140	F721.exe
4912	1ov99zg1.exe
3720	F9D1.exe
2992	explothe.exe
5652	2Zk984aX.exe
1980	3312.exe
3544	C90A.exe
1028	explothe.exe
4216	E127.exe
3484	ddvtvbj

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1zg68IH7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1zg68IH7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	F721.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	jB0xw0Vd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ay3zl0rC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	HG5ka69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tE5gS63.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	sq6CQ71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	C7C0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	PJ9VB9fv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\""	IS2mS9Rs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd2fde4b51e79039d00b43f7cd00b31f.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3360 set thread context of 5096	3360	2Yy4755.exe	94
PID 1672 set thread context of 4232	1672	3Uw30ar.exe	102
PID 2996 set thread context of 1684	2996	4Bh039GC.exe	108
PID 4316 set thread context of 828	4316	CB3B.exe	120
PID 1656 set thread context of 4284	1656	E156.exe	129
PID 4912 set thread context of 1420	4912	1ov99zg1.exe	140

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
748	5096	WerFault.exe	94
3892	3360	WerFault.exe	93
3808	1672	WerFault.exe	101
4652	2996	WerFault.exe	107
3588	4316	WerFault.exe	118
2276	1656	WerFault.exe	128
2984	4912	WerFault.exe	134
2140	1420	WerFault.exe	140

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1480	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	1zg68IH7.exe
4568	1zg68IH7.exe
4232	AppLaunch.exe
4232	AppLaunch.exe
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found
3120	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3120	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4232	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	1zg68IH7.exe
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeDebugPrivilege	3140	F721.exe
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found
Token: SeShutdownPrivilege	3120	Process not Found
Token: SeCreatePagefilePrivilege	3120	Process not Found

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3120	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4352	4136	fd2fde4b51e79039d00b43f7cd00b31f.exe	83
PID 4136 wrote to memory of 4352	4136	fd2fde4b51e79039d00b43f7cd00b31f.exe	83
PID 4136 wrote to memory of 4352	4136	fd2fde4b51e79039d00b43f7cd00b31f.exe	83
PID 4352 wrote to memory of 1028	4352	tE5gS63.exe	84
PID 4352 wrote to memory of 1028	4352	tE5gS63.exe	84
PID 4352 wrote to memory of 1028	4352	tE5gS63.exe	84
PID 1028 wrote to memory of 4628	1028	HG5ka69.exe	85
PID 1028 wrote to memory of 4628	1028	HG5ka69.exe	85
PID 1028 wrote to memory of 4628	1028	HG5ka69.exe	85
PID 4628 wrote to memory of 4568	4628	sq6CQ71.exe	86
PID 4628 wrote to memory of 4568	4628	sq6CQ71.exe	86
PID 4628 wrote to memory of 4568	4628	sq6CQ71.exe	86
PID 4628 wrote to memory of 3360	4628	sq6CQ71.exe	93
PID 4628 wrote to memory of 3360	4628	sq6CQ71.exe	93
PID 4628 wrote to memory of 3360	4628	sq6CQ71.exe	93
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 3360 wrote to memory of 5096	3360	2Yy4755.exe	94
PID 1028 wrote to memory of 1672	1028	HG5ka69.exe	101
PID 1028 wrote to memory of 1672	1028	HG5ka69.exe	101
PID 1028 wrote to memory of 1672	1028	HG5ka69.exe	101
PID 1672 wrote to memory of 4232	1672	3Uw30ar.exe	102
PID 1672 wrote to memory of 4232	1672	3Uw30ar.exe	102
PID 1672 wrote to memory of 4232	1672	3Uw30ar.exe	102
PID 1672 wrote to memory of 4232	1672	3Uw30ar.exe	102
PID 1672 wrote to memory of 4232	1672	3Uw30ar.exe	102
PID 1672 wrote to memory of 4232	1672	3Uw30ar.exe	102
PID 4352 wrote to memory of 2996	4352	tE5gS63.exe	107
PID 4352 wrote to memory of 2996	4352	tE5gS63.exe	107
PID 4352 wrote to memory of 2996	4352	tE5gS63.exe	107
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 2996 wrote to memory of 1684	2996	4Bh039GC.exe	108
PID 4136 wrote to memory of 4780	4136	fd2fde4b51e79039d00b43f7cd00b31f.exe	111
PID 4136 wrote to memory of 4780	4136	fd2fde4b51e79039d00b43f7cd00b31f.exe	111
PID 4136 wrote to memory of 4780	4136	fd2fde4b51e79039d00b43f7cd00b31f.exe	111
PID 4780 wrote to memory of 3004	4780	5hl0oq6.exe	113
PID 4780 wrote to memory of 3004	4780	5hl0oq6.exe	113
PID 3120 wrote to memory of 212	3120	Process not Found	116
PID 3120 wrote to memory of 212	3120	Process not Found	116
PID 3120 wrote to memory of 212	3120	Process not Found	116
PID 212 wrote to memory of 2388	212	C7C0.exe	117
PID 212 wrote to memory of 2388	212	C7C0.exe	117
PID 212 wrote to memory of 2388	212	C7C0.exe	117
PID 3120 wrote to memory of 4316	3120	Process not Found	118
PID 3120 wrote to memory of 4316	3120	Process not Found	118
PID 3120 wrote to memory of 4316	3120	Process not Found	118
PID 2388 wrote to memory of 4900	2388	jB0xw0Vd.exe	119
PID 2388 wrote to memory of 4900	2388	jB0xw0Vd.exe	119
PID 2388 wrote to memory of 4900	2388	jB0xw0Vd.exe	119
PID 4316 wrote to memory of 828	4316	CB3B.exe	120
PID 4316 wrote to memory of 828	4316	CB3B.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fd2fde4b51e79039d00b43f7cd00b31f.exe
"C:\Users\Admin\AppData\Local\Temp\fd2fde4b51e79039d00b43f7cd00b31f.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tE5gS63.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tE5gS63.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HG5ka69.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HG5ka69.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sq6CQ71.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sq6CQ71.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1zg68IH7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1zg68IH7.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yy4755.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yy4755.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3360
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 540
        7⤵
        Program crash
        
        PID:748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 600
        6⤵
        Program crash
        
        PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Uw30ar.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Uw30ar.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 572
        5⤵
        Program crash
        
        PID:3808
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Bh039GC.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Bh039GC.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 600
      4⤵
      Program crash
      PID:4652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5hl0oq6.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5hl0oq6.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A9F7.tmp\A9F8.tmp\A9F9.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5hl0oq6.exe"
    3⤵
    PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe73a546f8,0x7ffe73a54708,0x7ffe73a54718
        5⤵
        
        PID:4840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,13248724105942639123,18036861538726391374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,13248724105942639123,18036861538726391374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
        5⤵
        
        PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:1144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe73a546f8,0x7ffe73a54708,0x7ffe73a54718
        5⤵
        
        PID:4336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3457594786716871093,797338356687871618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        5⤵
        
        PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5096 -ip 5096
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3360 -ip 3360
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1672 -ip 1672
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2996 -ip 2996
1⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\C7C0.exe
C:\Users\Admin\AppData\Local\Temp\C7C0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jB0xw0Vd.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jB0xw0Vd.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ay3zl0rC.exe
    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ay3zl0rC.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\PJ9VB9fv.exe
      C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\PJ9VB9fv.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IS2mS9Rs.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IS2mS9Rs.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ov99zg1.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ov99zg1.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4912
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 540
        8⤵
        Program crash
        
        PID:2140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 572
        7⤵
        Program crash
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\2Zk984aX.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\2Zk984aX.exe
        6⤵
        Executes dropped EXE
        
        PID:5652

C:\Users\Admin\AppData\Local\Temp\CB3B.exe
C:\Users\Admin\AppData\Local\Temp\CB3B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 388
  2⤵
  - Program crash
  PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4316 -ip 4316
1⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\D7B0.bat
"C:\Users\Admin\AppData\Local\Temp\D7B0.bat"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1048
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DFBC.tmp\DFBD.tmp\DFBE.bat C:\Users\Admin\AppData\Local\Temp\D7B0.bat"
  2⤵
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe73a546f8,0x7ffe73a54708,0x7ffe73a54718
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,17364492967293443303,9665243193902436964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1556,17364492967293443303,9665243193902436964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffe73a546f8,0x7ffe73a54708,0x7ffe73a54718
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11346153850629866202,5934924018015821008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      PID:5016

C:\Users\Admin\AppData\Local\Temp\E156.exe
C:\Users\Admin\AppData\Local\Temp\E156.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 388
  2⤵
  - Program crash
  PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1656 -ip 1656
1⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\F721.exe
C:\Users\Admin\AppData\Local\Temp\F721.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Users\Admin\AppData\Local\Temp\F9D1.exe
C:\Users\Admin\AppData\Local\Temp\F9D1.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3720
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2992
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - DcRat
    - Creates scheduled task(s)
    PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:5636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:5892
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:5132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:6040
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4912 -ip 4912
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1420 -ip 1420
1⤵
PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\3312.exe
C:\Users\Admin\AppData\Local\Temp\3312.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Users\Admin\AppData\Local\Temp\C90A.exe
C:\Users\Admin\AppData\Local\Temp\C90A.exe
1⤵
- Executes dropped EXE
PID:3544

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:1028

C:\Users\Admin\AppData\Local\Temp\E127.exe
C:\Users\Admin\AppData\Local\Temp\E127.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Users\Admin\AppData\Roaming\ddvtvbj
C:\Users\Admin\AppData\Roaming\ddvtvbj
1⤵
- Executes dropped EXE
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery