rhadamanthys | hxxps://executorwave[.]pro/

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

WaveInstaller.exeWaveInstaller.exeWaveInstaller.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	WaveInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	WaveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	WaveInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	WaveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	WaveInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	WaveInstaller.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid	Process
5952	tasklist.exe
3632	tasklist.exe
5652	tasklist.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

driver1.exedriver1.exedriver1.exe

description	pid	Process	procid_target
PID 3288 set thread context of 5920	3288	driver1.exe	153
PID 5532 set thread context of 996	5532	driver1.exe	177
PID 1472 set thread context of 3620	1472	driver1.exe	198

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
6140	5920	WerFault.exe	153
1664	5920	WerFault.exe	153
5468	996	WerFault.exe	177
5488	996	WerFault.exe	177
3328	3620	WerFault.exe	198
6108	3620	WerFault.exe	198

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

BitLockerToGo.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

Processes:

wmic.exewmic.exewmic.exe

pid	Process
5716	wmic.exe
5612	wmic.exe
5648	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

GoLang User-Agent 7 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description	flow	ioc
HTTP User-Agent header	121	Go-http-client/1.1
HTTP User-Agent header	122	Go-http-client/1.1
HTTP User-Agent header	112	Go-http-client/1.1
HTTP User-Agent header	113	Go-http-client/1.1
HTTP User-Agent header	114	Go-http-client/1.1
HTTP User-Agent header	119	Go-http-client/1.1
HTTP User-Agent header	120	Go-http-client/1.1

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2412658365-3084825385-3340777666-1000\{09FC9EE7-8C8C-4399-9CEC-0646B9AF1684}	msedge.exe

NTFS ADS 6 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 125313.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 441555.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 59690.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 252517.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 597530.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 538005.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exe

pid	Process
5588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exepowershell.exemsedge.exetaskmgr.exeBitLockerToGo.exeopenwith.exepowershell.exepowershell.exe

pid	Process
1100	msedge.exe
1100	msedge.exe
3852	msedge.exe
3852	msedge.exe
3792	identity_helper.exe
3792	identity_helper.exe
6136	msedge.exe
6136	msedge.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
5872	powershell.exe
5872	powershell.exe
5872	powershell.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5920	BitLockerToGo.exe
5920	BitLockerToGo.exe
3560	openwith.exe
3560	openwith.exe
3560	openwith.exe
3560	openwith.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
6024	powershell.exe
6024	powershell.exe
6024	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

Processes:

msedge.exe

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WaveInstaller.exewmic.exetasklist.exepowershell.exepowershell.exeWaveInstaller.exewmic.exe

description	pid	Process
Token: SeDebugPrivilege	3648	WaveInstaller.exe
Token: SeIncreaseQuotaPrivilege	5716	wmic.exe
Token: SeSecurityPrivilege	5716	wmic.exe
Token: SeTakeOwnershipPrivilege	5716	wmic.exe
Token: SeLoadDriverPrivilege	5716	wmic.exe
Token: SeSystemProfilePrivilege	5716	wmic.exe
Token: SeSystemtimePrivilege	5716	wmic.exe
Token: SeProfSingleProcessPrivilege	5716	wmic.exe
Token: SeIncBasePriorityPrivilege	5716	wmic.exe
Token: SeCreatePagefilePrivilege	5716	wmic.exe
Token: SeBackupPrivilege	5716	wmic.exe
Token: SeRestorePrivilege	5716	wmic.exe
Token: SeShutdownPrivilege	5716	wmic.exe
Token: SeDebugPrivilege	5716	wmic.exe
Token: SeSystemEnvironmentPrivilege	5716	wmic.exe
Token: SeRemoteShutdownPrivilege	5716	wmic.exe
Token: SeUndockPrivilege	5716	wmic.exe
Token: SeManageVolumePrivilege	5716	wmic.exe
Token: 33	5716	wmic.exe
Token: 34	5716	wmic.exe
Token: 35	5716	wmic.exe
Token: 36	5716	wmic.exe
Token: SeIncreaseQuotaPrivilege	5716	wmic.exe
Token: SeSecurityPrivilege	5716	wmic.exe
Token: SeTakeOwnershipPrivilege	5716	wmic.exe
Token: SeLoadDriverPrivilege	5716	wmic.exe
Token: SeSystemProfilePrivilege	5716	wmic.exe
Token: SeSystemtimePrivilege	5716	wmic.exe
Token: SeProfSingleProcessPrivilege	5716	wmic.exe
Token: SeIncBasePriorityPrivilege	5716	wmic.exe
Token: SeCreatePagefilePrivilege	5716	wmic.exe
Token: SeBackupPrivilege	5716	wmic.exe
Token: SeRestorePrivilege	5716	wmic.exe
Token: SeShutdownPrivilege	5716	wmic.exe
Token: SeDebugPrivilege	5716	wmic.exe
Token: SeSystemEnvironmentPrivilege	5716	wmic.exe
Token: SeRemoteShutdownPrivilege	5716	wmic.exe
Token: SeUndockPrivilege	5716	wmic.exe
Token: SeManageVolumePrivilege	5716	wmic.exe
Token: 33	5716	wmic.exe
Token: 34	5716	wmic.exe
Token: 35	5716	wmic.exe
Token: 36	5716	wmic.exe
Token: SeDebugPrivilege	3632	tasklist.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	5872	powershell.exe
Token: SeDebugPrivilege	5976	WaveInstaller.exe
Token: SeIncreaseQuotaPrivilege	5968	wmic.exe
Token: SeSecurityPrivilege	5968	wmic.exe
Token: SeTakeOwnershipPrivilege	5968	wmic.exe
Token: SeLoadDriverPrivilege	5968	wmic.exe
Token: SeSystemProfilePrivilege	5968	wmic.exe
Token: SeSystemtimePrivilege	5968	wmic.exe
Token: SeProfSingleProcessPrivilege	5968	wmic.exe
Token: SeIncBasePriorityPrivilege	5968	wmic.exe
Token: SeCreatePagefilePrivilege	5968	wmic.exe
Token: SeBackupPrivilege	5968	wmic.exe
Token: SeRestorePrivilege	5968	wmic.exe
Token: SeShutdownPrivilege	5968	wmic.exe
Token: SeDebugPrivilege	5968	wmic.exe
Token: SeSystemEnvironmentPrivilege	5968	wmic.exe
Token: SeRemoteShutdownPrivilege	5968	wmic.exe
Token: SeUndockPrivilege	5968	wmic.exe
Token: SeManageVolumePrivilege	5968	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe
5828	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 3852 wrote to memory of 2916	3852	msedge.exe	87
PID 3852 wrote to memory of 2916	3852	msedge.exe	87
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 5112	3852	msedge.exe	88
PID 3852 wrote to memory of 1100	3852	msedge.exe	89
PID 3852 wrote to memory of 1100	3852	msedge.exe	89
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90
PID 3852 wrote to memory of 3796	3852	msedge.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2580
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://executorwave.pro/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffb6cbf46f8,0x7ffb6cbf4708,0x7ffb6cbf4718
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Modifies registry class
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14452814614633721794,18356672771694195579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:5180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1736

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
PID:3648
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:5716
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\ProgramData\driver1.exe
  C:\ProgramData\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3288
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 512
      4⤵
      Program crash
      PID:6140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 476
      4⤵
      Program crash
      PID:1664
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.exe /sc onstart /ru SYSTEM
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5588

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5976

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
PID:752

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
PID:3712

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
PID:4664

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5920 -ip 5920
1⤵
PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5920 -ip 5920
1⤵
PID:3776

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
- Maps connected drives based on registry
PID:2396
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5612
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  PID:5652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4168
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2944
- C:\ProgramData\driver1.exe
  C:\ProgramData\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5532
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 412
      4⤵
      Program crash
      PID:5468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 420
      4⤵
      Program crash
      PID:5488

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
PID:4460

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 996 -ip 996
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 996 -ip 996
1⤵
PID:4928

C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe"
1⤵
- Maps connected drives based on registry
PID:4304
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5648
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  PID:5952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\Downloads\WaveInstaller\WaveInstaller.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:752
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4256
- C:\ProgramData\driver1.exe
  C:\ProgramData\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1472
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 412
      4⤵
      Program crash
      PID:3328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 408
      4⤵
      Program crash
      PID:6108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3620 -ip 3620
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3620 -ip 3620
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery