dcrat | hxxps://gofile[.]io/d/FIgvWw

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Extra Woofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Extra Woofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Extra Woofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Extra Woofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Extra Woofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	BridgeServerDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Extra Woofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Extra Woofer.exe

Executes dropped EXE 13 IoCs

pid	Process
2880	Extra Woofer.exe
1384	BridgeServerDll.exe
5452	Extra Woofer.exe
5564	csrss.exe
5752	BridgeServerDll.exe
5964	Extra Woofer.exe
6040	Extra Woofer.exe
3168	BridgeServerDll.exe
5456	BridgeServerDll.exe
5572	Extra Woofer.exe
5696	BridgeServerDll.exe
5844	Extra Woofer.exe
4864	Extra Woofer.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\61a52ddc9dd915	BridgeServerDll.exe
File created	C:\Program Files (x86)\Google\msedge.exe	BridgeServerDll.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\886983d96e3d3e	BridgeServerDll.exe
File created	C:\Program Files (x86)\Common Files\msedge.exe	BridgeServerDll.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\csrss.exe	BridgeServerDll.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\886983d96e3d3e	BridgeServerDll.exe
File created	C:\Program Files\7-Zip\BridgeServerDll.exe	BridgeServerDll.exe
File created	C:\Program Files\7-Zip\f70c48fa48fc31	BridgeServerDll.exe
File created	C:\Program Files (x86)\Google\61a52ddc9dd915	BridgeServerDll.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\csrss.exe	BridgeServerDll.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\sihost.exe	BridgeServerDll.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\OCR\en-us\msedge.exe	BridgeServerDll.exe
File created	C:\Windows\InputMethod\SHARED\csrss.exe	BridgeServerDll.exe
File created	C:\Windows\InputMethod\SHARED\886983d96e3d3e	BridgeServerDll.exe
File created	C:\Windows\Provisioning\Packages\spoolsv.exe	BridgeServerDll.exe
File created	C:\Windows\Provisioning\Packages\f3b6ecef712a24	BridgeServerDll.exe
File created	C:\Windows\CSC\unsecapp.exe	BridgeServerDll.exe
File opened for modification	C:\Windows\Tasks\RuntimeBroker.exe	BridgeServerDll.exe
File created	C:\Windows\Tasks\9e8d7a4ca61bd9	BridgeServerDll.exe
File created	C:\Windows\Tasks\RuntimeBroker.exe	BridgeServerDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5376	schtasks.exe
5916	schtasks.exe
5820	schtasks.exe
5844	schtasks.exe
5860	schtasks.exe
5508	schtasks.exe
5764	schtasks.exe
5564	schtasks.exe
6108	schtasks.exe
960	schtasks.exe
5220	schtasks.exe
5280	schtasks.exe
5432	schtasks.exe
5288	schtasks.exe
5876	schtasks.exe
5176	schtasks.exe
5708	schtasks.exe
5264	schtasks.exe
5416	schtasks.exe
5652	schtasks.exe
5204	schtasks.exe
6036	schtasks.exe
5788	schtasks.exe
5692	schtasks.exe
5748	schtasks.exe
5204	schtasks.exe
5296	schtasks.exe
5264	schtasks.exe
5964	schtasks.exe
6092	schtasks.exe
5540	schtasks.exe
5992	schtasks.exe
5524	schtasks.exe
5580	schtasks.exe
5596	schtasks.exe
5804	schtasks.exe
5940	schtasks.exe
5320	schtasks.exe
5392	schtasks.exe
5336	schtasks.exe
5636	schtasks.exe
5732	schtasks.exe
5216	schtasks.exe
5220	schtasks.exe
5304	schtasks.exe
6020	schtasks.exe
5188	schtasks.exe
5620	schtasks.exe
6052	schtasks.exe
6132	schtasks.exe
5484	schtasks.exe
5676	schtasks.exe
5248	schtasks.exe
5900	schtasks.exe
6076	schtasks.exe
5360	schtasks.exe
5980	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Extra Woofer.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Extra Woofer.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Extra Woofer.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Extra Woofer.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Extra Woofer.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	BridgeServerDll.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Extra Woofer.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Extra Woofer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 771840.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
2532	msedge.exe
2532	msedge.exe
3596	identity_helper.exe
3596	identity_helper.exe
3356	msedge.exe
3356	msedge.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1988	taskmgr.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1384	BridgeServerDll.exe
1988	taskmgr.exe
1988	taskmgr.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
5564	csrss.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	taskmgr.exe
Token: SeSystemProfilePrivilege	1988	taskmgr.exe
Token: SeCreateGlobalPrivilege	1988	taskmgr.exe
Token: SeDebugPrivilege	1384	BridgeServerDll.exe
Token: 33	1988	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1988	taskmgr.exe
Token: SeDebugPrivilege	5564	csrss.exe
Token: SeDebugPrivilege	5752	BridgeServerDll.exe
Token: SeDebugPrivilege	960	taskmgr.exe
Token: SeSystemProfilePrivilege	960	taskmgr.exe
Token: SeCreateGlobalPrivilege	960	taskmgr.exe
Token: SeDebugPrivilege	3168	BridgeServerDll.exe
Token: SeDebugPrivilege	5456	BridgeServerDll.exe
Token: 33	960	taskmgr.exe
Token: SeIncBasePriorityPrivilege	960	taskmgr.exe
Token: SeDebugPrivilege	5696	BridgeServerDll.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
1988	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe
960	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1972	2532	msedge.exe	81
PID 2532 wrote to memory of 1972	2532	msedge.exe	81
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 2408	2532	msedge.exe	82
PID 2532 wrote to memory of 1852	2532	msedge.exe	83
PID 2532 wrote to memory of 1852	2532	msedge.exe	83
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84
PID 2532 wrote to memory of 1544	2532	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/FIgvWw
1⤵
- DcRat
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec5a346f8,0x7ffec5a34708,0x7ffec5a34718
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,5816931267653600235,15780892097103782911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4868

C:\Users\Admin\Downloads\Extra Woofer.exe
"C:\Users\Admin\Downloads\Extra Woofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2880
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesBrokersvc\v4zgQItSY7n.vbe"
  2⤵
  - Checks computer location settings
  PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\savesBrokersvc\QGHBzhbYs7.bat" "
    3⤵
    PID:1136
  - - C:\savesBrokersvc\BridgeServerDll.exe
      "C:\savesBrokersvc\BridgeServerDll.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1384
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zTiL5ovmOy.bat"
        5⤵
        
        PID:5352
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5412
      - C:\Windows\InputMethod\SHARED\csrss.exe
        
        "C:\Windows\InputMethod\SHARED\csrss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5564

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Configuration\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Configuration\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeServerDllB" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\BridgeServerDll.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeServerDll" /sc ONLOGON /tr "'C:\Program Files\7-Zip\BridgeServerDll.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeServerDllB" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\BridgeServerDll.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\savesBrokersvc\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\savesBrokersvc\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\savesBrokersvc\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\savesBrokersvc\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\savesBrokersvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\savesBrokersvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\savesBrokersvc\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\savesBrokersvc\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\savesBrokersvc\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\InputMethod\SHARED\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\SHARED\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Provisioning\Packages\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\Packages\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\savesBrokersvc\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\savesBrokersvc\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\savesBrokersvc\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\savesBrokersvc\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\savesBrokersvc\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\savesBrokersvc\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\PackageManifests\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\PackageManifests\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5296

C:\Users\Admin\Downloads\Extra Woofer.exe
"C:\Users\Admin\Downloads\Extra Woofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5452
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesBrokersvc\v4zgQItSY7n.vbe"
  2⤵
  - Checks computer location settings
  PID:5500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\savesBrokersvc\QGHBzhbYs7.bat" "
    3⤵
    PID:5692
  - - C:\savesBrokersvc\BridgeServerDll.exe
      "C:\savesBrokersvc\BridgeServerDll.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5752

C:\Users\Admin\Downloads\Extra Woofer.exe
"C:\Users\Admin\Downloads\Extra Woofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesBrokersvc\v4zgQItSY7n.vbe"
  2⤵
  - Checks computer location settings
  PID:5168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\savesBrokersvc\QGHBzhbYs7.bat" "
    3⤵
    PID:5132
  - - C:\savesBrokersvc\BridgeServerDll.exe
      "C:\savesBrokersvc\BridgeServerDll.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3168

C:\Users\Admin\Downloads\Extra Woofer.exe
"C:\Users\Admin\Downloads\Extra Woofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:6040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesBrokersvc\v4zgQItSY7n.vbe"
  2⤵
  - Checks computer location settings
  PID:6124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\savesBrokersvc\QGHBzhbYs7.bat" "
    3⤵
    PID:2236
  - - C:\savesBrokersvc\BridgeServerDll.exe
      "C:\savesBrokersvc\BridgeServerDll.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5456

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:960

C:\Users\Admin\Downloads\Extra Woofer.exe
"C:\Users\Admin\Downloads\Extra Woofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5572
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesBrokersvc\v4zgQItSY7n.vbe"
  2⤵
  - Checks computer location settings
  PID:5352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\savesBrokersvc\QGHBzhbYs7.bat" "
    3⤵
    PID:1944
  - - C:\savesBrokersvc\BridgeServerDll.exe
      "C:\savesBrokersvc\BridgeServerDll.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5696

C:\Users\Admin\Downloads\Extra Woofer.exe
"C:\Users\Admin\Downloads\Extra Woofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5844
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesBrokersvc\v4zgQItSY7n.vbe"
  2⤵
  PID:912

C:\Users\Admin\Downloads\Extra Woofer.exe
"C:\Users\Admin\Downloads\Extra Woofer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4864
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesBrokersvc\v4zgQItSY7n.vbe"
  2⤵
  PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery