gurcu | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmysldrv.exe

Phorphiex payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023581-1086.dat	family_phorphiex
behavioral1/files/0x00070000000235f8-1191.dat	family_phorphiex
behavioral1/files/0x000b000000023510-1602.dat	family_phorphiex
behavioral1/files/0x0008000000023667-1866.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023411-1319.dat	family_redline
behavioral1/memory/5412-1324-0x00000000003C0000-0x0000000000412000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 5304 created 3420	5304	nxmr.exe	56
PID 5304 created 3420	5304	nxmr.exe	56
PID 1344 created 3420	1344	wupgrdsv.exe	56
PID 1344 created 3420	1344	wupgrdsv.exe	56

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/1344-1223-0x00007FF7307C0000-0x00007FF730D36000-memory.dmp	xmrig
behavioral1/memory/2988-1267-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1280-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1286-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1292-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1326-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1367-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1374-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1376-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1377-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1378-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1379-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1381-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1383-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1522-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1591-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1604-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1628-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1635-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1647-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1648-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1649-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1650-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1662-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1664-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1677-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig
behavioral1/memory/2988-1684-0x00007FF7CDA70000-0x00007FF7CE25F000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe
3180	powershell.exe
1548	powershell.exe
3648	powershell.exe
1092	powershell.exe
872	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/6084-1302-0x00000000025C0000-0x0000000002626000-memory.dmp	net_reactor
behavioral1/memory/6084-1304-0x0000000004FE0000-0x0000000005044000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	sysmysldrv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	InfluencedNervous.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	gawdth.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	clamer.exe

Executes dropped EXE 54 IoCs

pid	Process
6024	4363463463464363463463463.exe
1044	o.exe
5188	twztl.exe
5220	pp.exe
5264	s.exe
3044	sysmablsvr.exe
5280	sysmablsvr.exe
5304	nxmr.exe
5344	gawdth.exe
208	pei.exe
2584	clamer.exe
408	lofsawd.exe
608	2834225728.exe
1344	wupgrdsv.exe
1520	sysmysldrv.exe
2792	755732054.exe
2440	574223268.exe
1612	1475529035.exe
4448	t2.exe
4436	219120246.exe
2064	keepvid-pro_full2578.exe
4652	aepeco.exe
6084	systems.exe
5412	06082025.exe
3276	newtpp.exe
1728	1.exe
5324	r.exe
5264	a.exe
5784	hellminer.exe
32	tpeinf.exe
5840	hellminer.exe
2020	kitty.exe
5984	t1.exe
5676	hellminer.exe
5228	3119914555.exe
4052	npp.exe
384	pi.exe
3840	svchost.exe
2680	sylsplvc.exe
1376	756025401.exe
4752	svchost.exe
4396	1563828097.exe
5044	1660318646.exe
3756	tdrpload.exe
4072	sahost.exe
3176	66af9bdbf0f60_Team.exe
844	InfluencedNervous.exe
2064	installer.exe
5972	m.exe
3644	installer.exe
6100	11.exe
5392	mservice64.exe
5996	tt.exe
1928	sysarddrvs.exe

Loads dropped DLL 64 IoCs

pid	Process
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5840	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe
5676	hellminer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmysldrv.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	o.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysmablsvr.exe"	s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmysldrv.exe"	2834225728.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe"	pi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\MicrosoftEdge\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	11.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
248	raw.githubusercontent.com
249	raw.githubusercontent.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4748	powercfg.exe
5888	powercfg.exe
6896	powercfg.exe
644	powercfg.exe
2200	powercfg.exe
2364	powercfg.exe
2568	powercfg.exe
5944	powercfg.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
6000	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 2988	1344	wupgrdsv.exe	174
PID 2064 set thread context of 1652	2064	keepvid-pro_full2578.exe	187

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AssuranceRequirements	InfluencedNervous.exe
File opened for modification	C:\Windows\ChuckVoltage	InfluencedNervous.exe
File created	C:\Windows\sysmablsvr.exe	s.exe
File created	C:\Windows\sylsplvc.exe	pi.exe
File opened for modification	C:\Windows\HeatedTimothy	InfluencedNervous.exe
File opened for modification	C:\Windows\AdsAsp	InfluencedNervous.exe
File opened for modification	C:\Windows\BrickFin	InfluencedNervous.exe
File opened for modification	C:\Windows\AirfareGambling	InfluencedNervous.exe
File opened for modification	C:\Windows\SeattleNuke	InfluencedNervous.exe
File opened for modification	C:\Windows\WinningNative	InfluencedNervous.exe
File created	C:\Windows\sysmablsvr.exe	o.exe
File opened for modification	C:\Windows\SingleOxford	InfluencedNervous.exe
File opened for modification	C:\Windows\MeshUpdating	InfluencedNervous.exe
File opened for modification	C:\Windows\ErikOccasionally	InfluencedNervous.exe
File opened for modification	C:\Windows\SeasShadow	InfluencedNervous.exe
File opened for modification	C:\Windows\sysarddrvs.exe	11.exe
File opened for modification	C:\Windows\sylsplvc.exe	pi.exe
File opened for modification	C:\Windows\FindingsFor	InfluencedNervous.exe
File opened for modification	C:\Windows\BenefitBackup	InfluencedNervous.exe
File opened for modification	C:\Windows\AtlasAdvantages	InfluencedNervous.exe
File opened for modification	C:\Windows\OverheadSolutions	InfluencedNervous.exe
File opened for modification	C:\Windows\BlondKatrina	InfluencedNervous.exe
File opened for modification	C:\Windows\NtOperations	InfluencedNervous.exe
File opened for modification	C:\Windows\PlayersSite	InfluencedNervous.exe
File opened for modification	C:\Windows\FieldAnalyses	InfluencedNervous.exe
File created	C:\Windows\sysarddrvs.exe	11.exe
File opened for modification	C:\Windows\sysmablsvr.exe	o.exe
File opened for modification	C:\Windows\MetBlake	InfluencedNervous.exe
File opened for modification	C:\Windows\SponsorDpi	InfluencedNervous.exe
File opened for modification	C:\Windows\DefinedDrill	InfluencedNervous.exe
File opened for modification	C:\Windows\WindowsAlberta	InfluencedNervous.exe
File opened for modification	C:\Windows\sysmysldrv.exe	2834225728.exe
File opened for modification	C:\Windows\NhlPhrases	InfluencedNervous.exe
File opened for modification	C:\Windows\NetExciting	InfluencedNervous.exe
File created	C:\Windows\Tasks\Test Task17.job	lofsawd.exe
File created	C:\Windows\sysmysldrv.exe	2834225728.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4576	sc.exe
4836	sc.exe
6636	sc.exe
6680	sc.exe
6996	sc.exe
3612	sc.exe
4044	sc.exe
6740	sc.exe
5684	sc.exe
6960	sc.exe
6156	sc.exe
3920	sc.exe
1968	sc.exe
3572	sc.exe
6208	sc.exe
3212	sc.exe
1428	sc.exe
3048	sc.exe
1868	sc.exe
5500	sc.exe
3356	sc.exe
1348	sc.exe
5132	sc.exe
5060	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000c00000002341e-1388.dat	pyinstaller
behavioral1/files/0x000800000002361c-1833.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1964	1728	WerFault.exe	191
3712	2020	WerFault.exe	203
4356	1300	WerFault.exe	259
3956	1300	WerFault.exe	259
3812	2736	WerFault.exe	291

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lofsawd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2834225728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3119914555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1563828097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	219120246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06082025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sylsplvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mservice64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	755732054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systems.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1660318646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	574223268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aepeco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmysldrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	756025401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpeinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfluencedNervous.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdrpload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twztl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1475529035.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	hellminer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	hellminer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	hellminer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	hellminer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	hellminer.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5256	timeout.exe
4056	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2636	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4752	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5512	taskmgr.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
1520	sysmysldrv.exe
2680	sylsplvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3660	7zG.exe
Token: 35	3660	7zG.exe
Token: SeSecurityPrivilege	3660	7zG.exe
Token: SeSecurityPrivilege	3660	7zG.exe
Token: SeRestorePrivilege	896	7zG.exe
Token: 35	896	7zG.exe
Token: SeSecurityPrivilege	896	7zG.exe
Token: SeSecurityPrivilege	896	7zG.exe
Token: SeDebugPrivilege	3784	firefox.exe
Token: SeDebugPrivilege	3784	firefox.exe
Token: SeDebugPrivilege	5512	taskmgr.exe
Token: SeSystemProfilePrivilege	5512	taskmgr.exe
Token: SeCreateGlobalPrivilege	5512	taskmgr.exe
Token: SeDebugPrivilege	6024	4363463463464363463463463.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeIncreaseQuotaPrivilege	2272	powershell.exe
Token: SeSecurityPrivilege	2272	powershell.exe
Token: SeTakeOwnershipPrivilege	2272	powershell.exe
Token: SeLoadDriverPrivilege	2272	powershell.exe
Token: SeSystemProfilePrivilege	2272	powershell.exe
Token: SeSystemtimePrivilege	2272	powershell.exe
Token: SeProfSingleProcessPrivilege	2272	powershell.exe
Token: SeIncBasePriorityPrivilege	2272	powershell.exe
Token: SeCreatePagefilePrivilege	2272	powershell.exe
Token: SeBackupPrivilege	2272	powershell.exe
Token: SeRestorePrivilege	2272	powershell.exe
Token: SeShutdownPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeSystemEnvironmentPrivilege	2272	powershell.exe
Token: SeRemoteShutdownPrivilege	2272	powershell.exe
Token: SeUndockPrivilege	2272	powershell.exe
Token: SeManageVolumePrivilege	2272	powershell.exe
Token: 33	2272	powershell.exe
Token: 34	2272	powershell.exe
Token: 35	2272	powershell.exe
Token: 36	2272	powershell.exe
Token: SeIncreaseQuotaPrivilege	2272	powershell.exe
Token: SeSecurityPrivilege	2272	powershell.exe
Token: SeTakeOwnershipPrivilege	2272	powershell.exe
Token: SeLoadDriverPrivilege	2272	powershell.exe
Token: SeSystemProfilePrivilege	2272	powershell.exe
Token: SeSystemtimePrivilege	2272	powershell.exe
Token: SeProfSingleProcessPrivilege	2272	powershell.exe
Token: SeIncBasePriorityPrivilege	2272	powershell.exe
Token: SeCreatePagefilePrivilege	2272	powershell.exe
Token: SeBackupPrivilege	2272	powershell.exe
Token: SeRestorePrivilege	2272	powershell.exe
Token: SeShutdownPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeSystemEnvironmentPrivilege	2272	powershell.exe
Token: SeRemoteShutdownPrivilege	2272	powershell.exe
Token: SeUndockPrivilege	2272	powershell.exe
Token: SeManageVolumePrivilege	2272	powershell.exe
Token: 33	2272	powershell.exe
Token: 34	2272	powershell.exe
Token: 35	2272	powershell.exe
Token: 36	2272	powershell.exe
Token: SeIncreaseQuotaPrivilege	2272	powershell.exe
Token: SeSecurityPrivilege	2272	powershell.exe
Token: SeTakeOwnershipPrivilege	2272	powershell.exe
Token: SeLoadDriverPrivilege	2272	powershell.exe
Token: SeSystemProfilePrivilege	2272	powershell.exe
Token: SeSystemtimePrivilege	2272	powershell.exe
Token: SeProfSingleProcessPrivilege	2272	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3660	7zG.exe
896	7zG.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
3784	firefox.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe
5512	taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
3784	firefox.exe
1044	o.exe
5188	twztl.exe
5220	pp.exe
5264	s.exe
5280	sysmablsvr.exe
5344	gawdth.exe
208	pei.exe
2584	clamer.exe
408	lofsawd.exe
608	2834225728.exe
2792	755732054.exe
2440	574223268.exe
4448	t2.exe
1652	BitLockerToGo.exe
6084	systems.exe
3276	newtpp.exe
1728	1.exe
5324	r.exe
5264	a.exe
32	tpeinf.exe
2020	kitty.exe
5984	t1.exe
5228	3119914555.exe
4052	npp.exe
384	pi.exe
1376	756025401.exe
3756	tdrpload.exe
4072	sahost.exe
3176	66af9bdbf0f60_Team.exe
844	InfluencedNervous.exe
5972	m.exe
6100	11.exe
5996	tt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3176 wrote to memory of 3784	3176	firefox.exe	120
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 4152	3784	firefox.exe	121
PID 3784 wrote to memory of 2692	3784	firefox.exe	122
PID 3784 wrote to memory of 2692	3784	firefox.exe	122
PID 3784 wrote to memory of 2692	3784	firefox.exe	122
PID 3784 wrote to memory of 2692	3784	firefox.exe	122
PID 3784 wrote to memory of 2692	3784	firefox.exe	122
PID 3784 wrote to memory of 2692	3784	firefox.exe	122
PID 3784 wrote to memory of 2692	3784	firefox.exe	122
PID 3784 wrote to memory of 2692	3784	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Windows\Explorer.exe
  C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloaders.zip
  2⤵
  PID:4868
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap21083:80:7zEvent24264
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3660
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap9736:216:7zEvent27095
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:896
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e13a556-4d68-44a6-a6b8-68f8ac483fcc} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" gpu
      4⤵
      PID:4152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2424 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1948a6a9-1e4b-4e39-a292-77da14751011} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" socket
      4⤵
      Checks processor information in registry
      PID:2692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3132 -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 2948 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee87bca0-0643-4b62-a11f-b8ad39bb1111} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:1696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -childID 2 -isForBrowser -prefsHandle 4260 -prefMapHandle 4256 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abad51b2-944b-4b19-a1bd-cb4ea3dc681c} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:2584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4600 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4816 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c1c687f-531b-4109-a92d-eb703a26a21e} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" utility
      4⤵
      Checks processor information in registry
      PID:2884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -childID 3 -isForBrowser -prefsHandle 5216 -prefMapHandle 5168 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e465e2b-3023-4f4b-a845-3d37eb9e7620} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:1636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 4 -isForBrowser -prefsHandle 5464 -prefMapHandle 5460 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c79be68-a9b8-4090-8a9e-a9182855cc74} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:1716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 5 -isForBrowser -prefsHandle 5572 -prefMapHandle 5580 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {284ff6c9-6a7c-4a33-aca9-c9160b3eaba3} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:1076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1444 -childID 6 -isForBrowser -prefsHandle 2956 -prefMapHandle 5060 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29818003-f67f-4568-bb41-6bd3476bdbd3} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:3392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6156 -childID 7 -isForBrowser -prefsHandle 6276 -prefMapHandle 6264 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b03df539-d304-4a29-91d9-ef7f4afeb4d2} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:32
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6424 -childID 8 -isForBrowser -prefsHandle 6500 -prefMapHandle 6496 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24b4ed03-7696-4016-834f-8415606da575} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:3408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3176 -childID 9 -isForBrowser -prefsHandle 6472 -prefMapHandle 6468 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bddb4320-762d-4516-914e-345803dcf5c1} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:1388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6788 -childID 10 -isForBrowser -prefsHandle 6628 -prefMapHandle 6624 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b88267e-30c9-4591-80d5-04f9c5b26977} 3784 "\\.\pipe\gecko-crash-server-pipe.3784" tab
      4⤵
      PID:1376
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5512
- C:\Users\Admin\Desktop\malware\4363463463464363463463463.exe
  "C:\Users\Admin\Desktop\malware\4363463463464363463463463.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6024
- - C:\Users\Admin\Desktop\malware\Files\o.exe
    "C:\Users\Admin\Desktop\malware\Files\o.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1044
  - - C:\Windows\sysmablsvr.exe
      C:\Windows\sysmablsvr.exe
      4⤵
      Executes dropped EXE
      PID:3044
- - C:\Users\Admin\Desktop\malware\Files\twztl.exe
    "C:\Users\Admin\Desktop\malware\Files\twztl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5188
- - C:\Users\Admin\Desktop\malware\Files\pp.exe
    "C:\Users\Admin\Desktop\malware\Files\pp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5220
- - C:\Users\Admin\Desktop\malware\Files\s.exe
    "C:\Users\Admin\Desktop\malware\Files\s.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5264
  - - C:\Users\Admin\sysmablsvr.exe
      C:\Users\Admin\sysmablsvr.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\755732054.exe
        
        C:\Users\Admin\AppData\Local\Temp\755732054.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\574223268.exe
        
        C:\Users\Admin\AppData\Local\Temp\574223268.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2440
- - C:\Users\Admin\Desktop\malware\Files\nxmr.exe
    "C:\Users\Admin\Desktop\malware\Files\nxmr.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    PID:5304
- - C:\Users\Admin\Desktop\malware\Files\gawdth.exe
    "C:\Users\Admin\Desktop\malware\Files\gawdth.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        
        clamer.exe -priverdD
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:408
- - C:\Users\Admin\Desktop\malware\Files\pei.exe
    "C:\Users\Admin\Desktop\malware\Files\pei.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\2834225728.exe
      C:\Users\Admin\AppData\Local\Temp\2834225728.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:608
    - - C:\Windows\sysmysldrv.exe
        
        C:\Windows\sysmysldrv.exe
        5⤵
        Modifies security service
        Windows security bypass
        Checks computer location settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:1520
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1548
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3048
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\1475529035.exe
        
        C:\Users\Admin\AppData\Local\Temp\1475529035.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\219120246.exe
        
        C:\Users\Admin\AppData\Local\Temp\219120246.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4436
- - C:\Users\Admin\Desktop\malware\Files\t2.exe
    "C:\Users\Admin\Desktop\malware\Files\t2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4448
- - C:\Users\Admin\Desktop\malware\Files\keepvid-pro_full2578.exe
    "C:\Users\Admin\Desktop\malware\Files\keepvid-pro_full2578.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2064
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1652
- - C:\Users\Admin\Desktop\malware\Files\systems.exe
    "C:\Users\Admin\Desktop\malware\Files\systems.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6084
- - C:\Users\Admin\Desktop\malware\Files\06082025.exe
    "C:\Users\Admin\Desktop\malware\Files\06082025.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5412
- - C:\Users\Admin\Desktop\malware\Files\newtpp.exe
    "C:\Users\Admin\Desktop\malware\Files\newtpp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3276
- - C:\Users\Admin\Desktop\malware\Files\1.exe
    "C:\Users\Admin\Desktop\malware\Files\1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 352
      4⤵
      Program crash
      PID:1964
- - C:\Users\Admin\Desktop\malware\Files\r.exe
    "C:\Users\Admin\Desktop\malware\Files\r.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5324
- - C:\Users\Admin\Desktop\malware\Files\a.exe
    "C:\Users\Admin\Desktop\malware\Files\a.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5264
- - C:\Users\Admin\Desktop\malware\Files\hellminer.exe
    "C:\Users\Admin\Desktop\malware\Files\hellminer.exe"
    3⤵
    - Executes dropped EXE
    PID:5784
  - - C:\Users\Admin\Desktop\malware\Files\hellminer.exe
      "C:\Users\Admin\Desktop\malware\Files\hellminer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:5840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c color
        5⤵
        
        PID:5528
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get Version
        5⤵
        
        PID:2012
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list
        5⤵
        
        PID:5684
    - - C:\Users\Admin\Desktop\malware\Files\hellminer.exe
        
        "C:\Users\Admin\Desktop\malware\Files\hellminer.exe" "--multiprocessing-fork" "parent_pid=5840" "pipe_handle=904"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:5868
- - C:\Users\Admin\Desktop\malware\Files\tpeinf.exe
    "C:\Users\Admin\Desktop\malware\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:32
  - - C:\Users\Admin\AppData\Local\Temp\3119914555.exe
      C:\Users\Admin\AppData\Local\Temp\3119914555.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5228
- - C:\Users\Admin\Desktop\malware\Files\kitty.exe
    "C:\Users\Admin\Desktop\malware\Files\kitty.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 488
      4⤵
      Program crash
      PID:3712
- - C:\Users\Admin\Desktop\malware\Files\t1.exe
    "C:\Users\Admin\Desktop\malware\Files\t1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5984
- - C:\Users\Admin\Desktop\malware\Files\npp.exe
    "C:\Users\Admin\Desktop\malware\Files\npp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\756025401.exe
      C:\Users\Admin\AppData\Local\Temp\756025401.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1376
- - C:\Users\Admin\Desktop\malware\Files\pi.exe
    "C:\Users\Admin\Desktop\malware\Files\pi.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:384
  - - C:\Windows\sylsplvc.exe
      C:\Windows\sylsplvc.exe
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\1563828097.exe
        
        C:\Users\Admin\AppData\Local\Temp\1563828097.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\1660318646.exe
        
        C:\Users\Admin\AppData\Local\Temp\1660318646.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5044
- - C:\Users\Admin\Desktop\malware\Files\svchost.exe
    "C:\Users\Admin\Desktop\malware\Files\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3840
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /create /tn svchost /tr "C:\ProgramData\MicrosoftEdge\svchost.exe" /st 04:49 /du 23:59 /sc daily /ri 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2636
  - - C:\ProgramData\MicrosoftEdge\svchost.exe
      "C:\ProgramData\MicrosoftEdge\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      PID:4752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8532.tmp.bat""
      4⤵
      PID:5476
    - - C:\Windows\system32\timeout.exe
        
        timeout 7
        5⤵
        Delays execution with timeout.exe
        
        PID:5256
- - C:\Users\Admin\Desktop\malware\Files\tdrpload.exe
    "C:\Users\Admin\Desktop\malware\Files\tdrpload.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3756
- - C:\Users\Admin\Desktop\malware\Files\sahost.exe
    "C:\Users\Admin\Desktop\malware\Files\sahost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4072
- - C:\Users\Admin\Desktop\malware\Files\66af9bdbf0f60_Team.exe
    "C:\Users\Admin\Desktop\malware\Files\66af9bdbf0f60_Team.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3176
- - C:\Users\Admin\Desktop\malware\Files\InfluencedNervous.exe
    "C:\Users\Admin\Desktop\malware\Files\InfluencedNervous.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:844
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k copy Fail Fail.cmd & Fail.cmd & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6000
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        
        PID:4980
- - C:\Users\Admin\Desktop\malware\Files\installer.exe
    "C:\Users\Admin\Desktop\malware\Files\installer.exe"
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Users\Admin\Desktop\malware\Files\installer.exe
      "C:\Users\Admin\Desktop\malware\Files\installer.exe"
      4⤵
      Executes dropped EXE
      PID:3644
- - C:\Users\Admin\Desktop\malware\Files\m.exe
    "C:\Users\Admin\Desktop\malware\Files\m.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5972
- - C:\Users\Admin\Desktop\malware\Files\11.exe
    "C:\Users\Admin\Desktop\malware\Files\11.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6100
  - - C:\Windows\sysarddrvs.exe
      C:\Windows\sysarddrvs.exe
      4⤵
      Executes dropped EXE
      PID:1928
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:4820
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        5⤵
        
        PID:2424
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:5500
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:3356
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1348
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:4836
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        6⤵
        Launches sc.exe
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\234334196.exe
        
        C:\Users\Admin\AppData\Local\Temp\234334196.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\2994129455.exe
        
        C:\Users\Admin\AppData\Local\Temp\2994129455.exe
        5⤵
        
        PID:5932
- - C:\Users\Admin\Desktop\malware\Files\mservice64.exe
    "C:\Users\Admin\Desktop\malware\Files\mservice64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5392
- - C:\Users\Admin\Desktop\malware\Files\tt.exe
    "C:\Users\Admin\Desktop\malware\Files\tt.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5996
- - C:\Users\Admin\Desktop\malware\Files\www.exe
    "C:\Users\Admin\Desktop\malware\Files\www.exe"
    3⤵
    PID:3716
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe "http://localhost:80/"
      4⤵
      PID:1636
- - C:\Users\Admin\Desktop\malware\Files\RedSystem.exe
    "C:\Users\Admin\Desktop\malware\Files\RedSystem.exe"
    3⤵
    PID:1300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 1312
      4⤵
      Program crash
      PID:4356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 976
      4⤵
      Program crash
      PID:3956
- - C:\Users\Admin\Desktop\malware\Files\autoupdate.exe
    "C:\Users\Admin\Desktop\malware\Files\autoupdate.exe"
    3⤵
    PID:4040
- - C:\Users\Admin\Desktop\malware\Files\kkkk.exe
    "C:\Users\Admin\Desktop\malware\Files\kkkk.exe"
    3⤵
    PID:3776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Developed Developed.cmd & Developed.cmd & exit
      4⤵
      PID:5444
- - C:\Users\Admin\Desktop\malware\Files\Identifications.exe
    "C:\Users\Admin\Desktop\malware\Files\Identifications.exe"
    3⤵
    PID:3952
- - C:\Users\Admin\Desktop\malware\Files\build_2024-07-24_23-16.exe
    "C:\Users\Admin\Desktop\malware\Files\build_2024-07-24_23-16.exe"
    3⤵
    PID:5068
- - C:\Users\Admin\Desktop\malware\Files\build_2024-07-27_00-41.exe
    "C:\Users\Admin\Desktop\malware\Files\build_2024-07-27_00-41.exe"
    3⤵
    PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\malware\Files\build_2024-07-27_00-41.exe" & rd /s /q "C:\ProgramData\JDBFIIEBGCAK" & exit
      4⤵
      PID:4340
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 2064
      4⤵
      Program crash
      PID:3812
- - C:\Users\Admin\Desktop\malware\Files\service.exe
    "C:\Users\Admin\Desktop\malware\Files\service.exe"
    3⤵
    PID:4276
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1292
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:1188
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:6208
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:6740
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:5684
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:6960
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:6156
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:6896
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:644
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:2200
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:2364
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:1784
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WindowsAutHost"
      4⤵
      Launches sc.exe
      PID:3212
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
      4⤵
      Launches sc.exe
      PID:1428
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:6680
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WindowsAutHost"
      4⤵
      Launches sc.exe
      PID:6636
- - C:\Users\Admin\Desktop\malware\Files\3544436.exe
    "C:\Users\Admin\Desktop\malware\Files\3544436.exe"
    3⤵
    PID:1836
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3840
- - C:\Users\Admin\Desktop\malware\Files\t.exe
    "C:\Users\Admin\Desktop\malware\Files\t.exe"
    3⤵
    PID:1348
- - C:\Users\Admin\Desktop\malware\Files\peinf.exe
    "C:\Users\Admin\Desktop\malware\Files\peinf.exe"
    3⤵
    PID:5828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
  2⤵
  PID:572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3180
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:2988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2064

C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1344

C:\ProgramData\ihlnk\aepeco.exe
C:\ProgramData\ihlnk\aepeco.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1728 -ip 1728
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2020 -ip 2020
1⤵
PID:868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost/
  2⤵
  PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa38a746f8,0x7ffa38a74708,0x7ffa38a74718
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2228692734834946246,12815528752090644105,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3456 /prefetch:2
    3⤵
    PID:5164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1300 -ip 1300
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1300 -ip 1300
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2736 -ip 2736
1⤵
PID:3204

C:\ProgramData\MicrosoftEdge\svchost.exe
C:\ProgramData\MicrosoftEdge\svchost.exe
1⤵
PID:7008

C:\ProgramData\WindowsServices\WindowsAutHost
C:\ProgramData\WindowsServices\WindowsAutHost
1⤵
PID:6240
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3108
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6856
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3920
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6996
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1968
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3612
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:5888
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4748
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5944
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2568
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4948
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3312
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery