gh0strat | eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db

Modify Registry

T1112

Processes:

svchos.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240599859.txt"	svchos.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

TXPlatforn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

HD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe

Executes dropped EXE 24 IoCs

Processes:

svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exemsedge.exesvchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exe

pid	process
2628	svchost.exe
2840	TXPlatforn.exe
5084	TXPlatforn.exe
652	svchos.exe
3316	HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
3192	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
4148	msedge.exe
4460	svchost.exe
852	TXPlatforn.exe
1040	TXPlatforn.exe
2320	svchos.exe
4376	HD_msedge.exe
2864	HD_msedge.exe
4188	HD_msedge.exe
1432	HD_msedge.exe
3676	HD_msedge.exe
2256	HD_msedge.exe
4212	HD_msedge.exe
4984	HD_msedge.exe
1560	HD_msedge.exe
5048	HD_msedge.exe
1620	HD_msedge.exe
900	HD_msedge.exe
652	HD_msedge.exe

Loads dropped DLL 3 IoCs

Processes:

svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exe

pid process

652 svchos.exe
1288 svchost.exe
3192 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
652	svchos.exe
1288	svchost.exe
3192	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2628-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2628-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2628-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2628-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2840-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2840-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2840-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2840-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5084-30-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5084-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5084-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5084-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2840-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

HD_msedge.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA HD_msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_msedge.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

HD_msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	HD_msedge.exe

Drops file in System32 directory 6 IoCs

Processes:

svchost.exesvchos.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File created	C:\Windows\SysWOW64\240599859.txt	svchos.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe

Drops file in Program Files directory 7 IoCs

Processes:

eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exemsedge.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

HD_msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HD_msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

4372 PING.EXE
2628 PING.EXE

pid	process
4372	PING.EXE
2628	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exemsedge.exeHD_msedge.exeHD_msedge.exeidentity_helper.exeHD_msedge.exe

pid	process
2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
4148	msedge.exe
4148	msedge.exe
1432	HD_msedge.exe
1432	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
1480	identity_helper.exe
1480	identity_helper.exe
652	HD_msedge.exe
652	HD_msedge.exe
652	HD_msedge.exe
652	HD_msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatforn.exe

pid process

5084 TXPlatforn.exe

pid	process
5084	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

svchost.exeTXPlatforn.exesvchost.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: SeLoadDriverPrivilege	5084	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4460	svchost.exe
Token: 33	5084	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	5084	TXPlatforn.exe
Token: 33	5084	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	5084	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

HD_msedge.exe

pid	process
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

HD_msedge.exe

pid	process
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe
4376	HD_msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exemsedge.exe

pid	process
2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exeTXPlatforn.exesvchost.execmd.exesvchost.exeHD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exemsedge.exesvchost.exeTXPlatforn.exeHD_msedge.execmd.exe

description	pid	process	target process
PID 2856 wrote to memory of 2628	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	svchost.exe
PID 2856 wrote to memory of 2628	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	svchost.exe
PID 2856 wrote to memory of 2628	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	svchost.exe
PID 2840 wrote to memory of 5084	2840	TXPlatforn.exe	TXPlatforn.exe
PID 2840 wrote to memory of 5084	2840	TXPlatforn.exe	TXPlatforn.exe
PID 2840 wrote to memory of 5084	2840	TXPlatforn.exe	TXPlatforn.exe
PID 2628 wrote to memory of 2256	2628	svchost.exe	cmd.exe
PID 2628 wrote to memory of 2256	2628	svchost.exe	cmd.exe
PID 2628 wrote to memory of 2256	2628	svchost.exe	cmd.exe
PID 2856 wrote to memory of 652	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	svchos.exe
PID 2856 wrote to memory of 652	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	svchos.exe
PID 2856 wrote to memory of 652	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	svchos.exe
PID 2856 wrote to memory of 3316	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
PID 2856 wrote to memory of 3316	2856	eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
PID 2256 wrote to memory of 4372	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 4372	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 4372	2256	cmd.exe	PING.EXE
PID 1288 wrote to memory of 3192	1288	svchost.exe	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 1288 wrote to memory of 3192	1288	svchost.exe	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 1288 wrote to memory of 3192	1288	svchost.exe	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 3316 wrote to memory of 4148	3316	HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	msedge.exe
PID 3316 wrote to memory of 4148	3316	HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	msedge.exe
PID 3316 wrote to memory of 4148	3316	HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe	msedge.exe
PID 4148 wrote to memory of 4460	4148	msedge.exe	svchost.exe
PID 4148 wrote to memory of 4460	4148	msedge.exe	svchost.exe
PID 4148 wrote to memory of 4460	4148	msedge.exe	svchost.exe
PID 4460 wrote to memory of 5052	4460	svchost.exe	cmd.exe
PID 4460 wrote to memory of 5052	4460	svchost.exe	cmd.exe
PID 4460 wrote to memory of 5052	4460	svchost.exe	cmd.exe
PID 852 wrote to memory of 1040	852	TXPlatforn.exe	TXPlatforn.exe
PID 852 wrote to memory of 1040	852	TXPlatforn.exe	TXPlatforn.exe
PID 852 wrote to memory of 1040	852	TXPlatforn.exe	TXPlatforn.exe
PID 4148 wrote to memory of 2320	4148	msedge.exe	svchos.exe
PID 4148 wrote to memory of 2320	4148	msedge.exe	svchos.exe
PID 4148 wrote to memory of 2320	4148	msedge.exe	svchos.exe
PID 4148 wrote to memory of 4376	4148	msedge.exe	HD_msedge.exe
PID 4148 wrote to memory of 4376	4148	msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 2864	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 2864	4376	HD_msedge.exe	HD_msedge.exe
PID 5052 wrote to memory of 2628	5052	cmd.exe	PING.EXE
PID 5052 wrote to memory of 2628	5052	cmd.exe	PING.EXE
PID 5052 wrote to memory of 2628	5052	cmd.exe	PING.EXE
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe
PID 4376 wrote to memory of 4188	4376	HD_msedge.exe	HD_msedge.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

HD_msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection HD_msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	HD_msedge.exe

C:\Users\Admin\AppData\Local\Temp\eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
"C:\Users\Admin\AppData\Local\Temp\eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4372
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:652
- C:\Users\Admin\AppData\Local\Temp\HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
  C:\Users\Admin\AppData\Local\Temp\HD_eb64152bd1f3b3fa887c327d3e3f6af57ed2abf2b4db4ad659cc81d4e3e2e1db.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\svchost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5052
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\svchos.exe
      C:\Users\Admin\AppData\Local\Temp\\svchos.exe
      4⤵
      Executes dropped EXE
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks system information in the registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e76846f8,0x7ff8e7684708,0x7ff8e7684718
        5⤵
        Executes dropped EXE
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:4188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2112,12161138030648477665,7397663447907389687,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3940 /prefetch:2
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:652

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:5084

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:396

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240599859.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3192

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:1040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery