darkcomet | hxxps://github[.]com/daedalus/NanoCore/blob/master/sample/NanoCore[.]exe

Processes:

CRACKED.EXE

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Processes:

IDMAN.exeCRACKED.EXE

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	IDMAN.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	CRACKED.EXE
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	CRACKED.EXE
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	CRACKED.EXE
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	IDMAN.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	IDMAN.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

NanoCore.exeCRACKED.EXENanoCore.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	NanoCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	CRACKED.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	NanoCore.exe

Executes dropped EXE 7 IoCs

Processes:

NanoCore.exeCRACKED.EXENANOCORE.EXEIDMAN.exeNanoCore.exeCRACKED.EXENANOCORE.EXE

pid	Process
5428	NanoCore.exe
5580	CRACKED.EXE
5640	NANOCORE.EXE
5820	IDMAN.exe
6032	NanoCore.exe
6108	CRACKED.EXE
5016	NANOCORE.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

CRACKED.EXEIDMAN.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	IDMAN.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
63	raw.githubusercontent.com
64	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

dw20.exedw20.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

Processes:

dw20.exemsedge.exedw20.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 495610.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	Process
1284	msedge.exe
1284	msedge.exe
1956	msedge.exe
1956	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
5312	msedge.exe
5312	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IDMAN.exe

pid	Process
5820	IDMAN.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

CRACKED.EXEIDMAN.exedw20.exeCRACKED.EXE

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5580	CRACKED.EXE
Token: SeSecurityPrivilege	5580	CRACKED.EXE
Token: SeTakeOwnershipPrivilege	5580	CRACKED.EXE
Token: SeLoadDriverPrivilege	5580	CRACKED.EXE
Token: SeSystemProfilePrivilege	5580	CRACKED.EXE
Token: SeSystemtimePrivilege	5580	CRACKED.EXE
Token: SeProfSingleProcessPrivilege	5580	CRACKED.EXE
Token: SeIncBasePriorityPrivilege	5580	CRACKED.EXE
Token: SeCreatePagefilePrivilege	5580	CRACKED.EXE
Token: SeBackupPrivilege	5580	CRACKED.EXE
Token: SeRestorePrivilege	5580	CRACKED.EXE
Token: SeShutdownPrivilege	5580	CRACKED.EXE
Token: SeDebugPrivilege	5580	CRACKED.EXE
Token: SeSystemEnvironmentPrivilege	5580	CRACKED.EXE
Token: SeChangeNotifyPrivilege	5580	CRACKED.EXE
Token: SeRemoteShutdownPrivilege	5580	CRACKED.EXE
Token: SeUndockPrivilege	5580	CRACKED.EXE
Token: SeManageVolumePrivilege	5580	CRACKED.EXE
Token: SeImpersonatePrivilege	5580	CRACKED.EXE
Token: SeCreateGlobalPrivilege	5580	CRACKED.EXE
Token: 33	5580	CRACKED.EXE
Token: 34	5580	CRACKED.EXE
Token: 35	5580	CRACKED.EXE
Token: 36	5580	CRACKED.EXE
Token: SeIncreaseQuotaPrivilege	5820	IDMAN.exe
Token: SeSecurityPrivilege	5820	IDMAN.exe
Token: SeTakeOwnershipPrivilege	5820	IDMAN.exe
Token: SeLoadDriverPrivilege	5820	IDMAN.exe
Token: SeSystemProfilePrivilege	5820	IDMAN.exe
Token: SeSystemtimePrivilege	5820	IDMAN.exe
Token: SeProfSingleProcessPrivilege	5820	IDMAN.exe
Token: SeIncBasePriorityPrivilege	5820	IDMAN.exe
Token: SeCreatePagefilePrivilege	5820	IDMAN.exe
Token: SeBackupPrivilege	5820	IDMAN.exe
Token: SeRestorePrivilege	5820	IDMAN.exe
Token: SeShutdownPrivilege	5820	IDMAN.exe
Token: SeDebugPrivilege	5820	IDMAN.exe
Token: SeSystemEnvironmentPrivilege	5820	IDMAN.exe
Token: SeChangeNotifyPrivilege	5820	IDMAN.exe
Token: SeRemoteShutdownPrivilege	5820	IDMAN.exe
Token: SeUndockPrivilege	5820	IDMAN.exe
Token: SeManageVolumePrivilege	5820	IDMAN.exe
Token: SeImpersonatePrivilege	5820	IDMAN.exe
Token: SeCreateGlobalPrivilege	5820	IDMAN.exe
Token: 33	5820	IDMAN.exe
Token: 34	5820	IDMAN.exe
Token: 35	5820	IDMAN.exe
Token: 36	5820	IDMAN.exe
Token: SeBackupPrivilege	5940	dw20.exe
Token: SeBackupPrivilege	5940	dw20.exe
Token: SeIncreaseQuotaPrivilege	6108	CRACKED.EXE
Token: SeSecurityPrivilege	6108	CRACKED.EXE
Token: SeTakeOwnershipPrivilege	6108	CRACKED.EXE
Token: SeLoadDriverPrivilege	6108	CRACKED.EXE
Token: SeSystemProfilePrivilege	6108	CRACKED.EXE
Token: SeSystemtimePrivilege	6108	CRACKED.EXE
Token: SeProfSingleProcessPrivilege	6108	CRACKED.EXE
Token: SeIncBasePriorityPrivilege	6108	CRACKED.EXE
Token: SeCreatePagefilePrivilege	6108	CRACKED.EXE
Token: SeBackupPrivilege	6108	CRACKED.EXE
Token: SeRestorePrivilege	6108	CRACKED.EXE
Token: SeShutdownPrivilege	6108	CRACKED.EXE
Token: SeDebugPrivilege	6108	CRACKED.EXE
Token: SeSystemEnvironmentPrivilege	6108	CRACKED.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IDMAN.exe

pid	Process
5820	IDMAN.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 1956 wrote to memory of 4788	1956	msedge.exe	83
PID 1956 wrote to memory of 4788	1956	msedge.exe	83
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 1284	1956	msedge.exe	85
PID 1956 wrote to memory of 1284	1956	msedge.exe	85
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86
PID 1956 wrote to memory of 692	1956	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/daedalus/NanoCore/blob/master/sample/NanoCore.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe080f46f8,0x7ffe080f4708,0x7ffe080f4718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Users\Admin\Downloads\NanoCore.exe
  "C:\Users\Admin\Downloads\NanoCore.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5428
- - C:\Users\Admin\AppData\Roaming\CRACKED.EXE
    "C:\Users\Admin\AppData\Roaming\CRACKED.EXE"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
  - - C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe
      "C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe"
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5820
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:5876
- - C:\Users\Admin\AppData\Roaming\NANOCORE.EXE
    "C:\Users\Admin\AppData\Roaming\NANOCORE.EXE"
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1136
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:5940
- C:\Users\Admin\Downloads\NanoCore.exe
  "C:\Users\Admin\Downloads\NanoCore.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:6032
- - C:\Users\Admin\AppData\Roaming\CRACKED.EXE
    "C:\Users\Admin\AppData\Roaming\CRACKED.EXE"
    3⤵
    - Modifies firewall policy service
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:6108
- - C:\Users\Admin\AppData\Roaming\NANOCORE.EXE
    "C:\Users\Admin\AppData\Roaming\NANOCORE.EXE"
    3⤵
    - Executes dropped EXE
    PID:5016
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1080
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6725421692444289032,17528627265941602019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery