xworm | hxxps://github[.]com/fxaustountermed/WaveInstaller/archive/refs/heads/main[.]zip

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WaveInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WaveUpdater.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WaveUpdater.lnk	XClient.exe

Executes dropped EXE 7 IoCs

pid	Process
380	WaveInstaller.exe
2456	WaveInstaller.exe
4420	WaveCrack.exe
5404	WavePatcher.exe
5596	XClient.exe
3252	WavePatcher.exe
4400	gptwlkqtlame.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Loads dropped DLL 63 IoCs

pid	Process
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3252-223-0x00007FF95C4B0000-0x00007FF95C91E000-memory.dmp	upx
behavioral1/files/0x0007000000023712-220.dat	upx
behavioral1/memory/3252-235-0x00007FF974800000-0x00007FF97480F000-memory.dmp	upx
behavioral1/memory/3252-234-0x00007FF95F360000-0x00007FF95F384000-memory.dmp	upx
behavioral1/files/0x0007000000023707-233.dat	upx
behavioral1/files/0x00070000000236cb-238.dat	upx
behavioral1/files/0x0007000000023710-242.dat	upx
behavioral1/memory/3252-244-0x00007FF95F2F0000-0x00007FF95F324000-memory.dmp	upx
behavioral1/files/0x0007000000023715-248.dat	upx
behavioral1/memory/3252-259-0x00007FF95F2A0000-0x00007FF95F2CE000-memory.dmp	upx
behavioral1/memory/3252-262-0x00007FF95F110000-0x00007FF95F1CC000-memory.dmp	upx
behavioral1/files/0x0007000000023713-261.dat	upx
behavioral1/memory/3252-258-0x00007FF9740A0000-0x00007FF9740AD000-memory.dmp	upx
behavioral1/memory/3252-257-0x00007FF95C4B0000-0x00007FF95C91E000-memory.dmp	upx
behavioral1/files/0x0007000000023714-254.dat	upx
behavioral1/files/0x00070000000236ce-252.dat	upx
behavioral1/memory/3252-251-0x00007FF9747B0000-0x00007FF9747BD000-memory.dmp	upx
behavioral1/memory/3252-250-0x00007FF95F2D0000-0x00007FF95F2E9000-memory.dmp	upx
behavioral1/files/0x00070000000236cf-246.dat	upx
behavioral1/memory/3252-241-0x00007FF95F330000-0x00007FF95F35D000-memory.dmp	upx
behavioral1/memory/3252-240-0x00007FF965BA0000-0x00007FF965BB9000-memory.dmp	upx
behavioral1/files/0x00070000000236c5-237.dat	upx
behavioral1/files/0x00070000000236c7-231.dat	upx
behavioral1/files/0x0007000000023719-265.dat	upx
behavioral1/memory/3252-263-0x00007FF95F360000-0x00007FF95F384000-memory.dmp	upx
behavioral1/memory/3252-268-0x00007FF95F270000-0x00007FF95F29B000-memory.dmp	upx
behavioral1/files/0x00070000000236c8-270.dat	upx
behavioral1/files/0x000700000002370f-275.dat	upx
behavioral1/memory/3252-284-0x00007FF95F2A0000-0x00007FF95F2CE000-memory.dmp	upx
behavioral1/files/0x0007000000023706-287.dat	upx
behavioral1/memory/3252-292-0x00007FF95C130000-0x00007FF95C4A5000-memory.dmp	upx
behavioral1/memory/3252-285-0x00007FF95F000000-0x00007FF95F0B8000-memory.dmp	upx
behavioral1/files/0x0007000000023708-283.dat	upx
behavioral1/memory/3252-281-0x00007FF95F0C0000-0x00007FF95F0EE000-memory.dmp	upx
behavioral1/files/0x00070000000236d1-279.dat	upx
behavioral1/memory/3252-277-0x00007FF95F0F0000-0x00007FF95F10C000-memory.dmp	upx
behavioral1/memory/3252-274-0x00007FF9738F0000-0x00007FF9738FA000-memory.dmp	upx
behavioral1/memory/3252-273-0x00007FF95F220000-0x00007FF95F262000-memory.dmp	upx
behavioral1/files/0x00070000000236d2-272.dat	upx
behavioral1/files/0x00070000000236c4-308.dat	upx
behavioral1/memory/3252-313-0x00007FF95E1B0000-0x00007FF95E1C4000-memory.dmp	upx
behavioral1/memory/3252-312-0x00007FF95E1D0000-0x00007FF95E29F000-memory.dmp	upx
behavioral1/memory/3252-311-0x00007FF95F110000-0x00007FF95F1CC000-memory.dmp	upx
behavioral1/files/0x00070000000236ca-310.dat	upx
behavioral1/files/0x0007000000023702-314.dat	upx
behavioral1/memory/3252-318-0x00007FF95CFF0000-0x00007FF95D108000-memory.dmp	upx
behavioral1/memory/3252-317-0x00007FF95E100000-0x00007FF95E126000-memory.dmp	upx
behavioral1/memory/3252-319-0x00007FF95DFC0000-0x00007FF95DFDF000-memory.dmp	upx
behavioral1/memory/3252-320-0x00007FF95BC70000-0x00007FF95BDE1000-memory.dmp	upx
behavioral1/memory/3252-316-0x00007FF973450000-0x00007FF97345B000-memory.dmp	upx
behavioral1/memory/3252-321-0x00007FF95F0F0000-0x00007FF95F10C000-memory.dmp	upx
behavioral1/memory/3252-322-0x00007FF95F000000-0x00007FF95F0B8000-memory.dmp	upx
behavioral1/memory/3252-334-0x00007FF971980000-0x00007FF97198B000-memory.dmp	upx
behavioral1/memory/3252-333-0x00007FF95F0C0000-0x00007FF95F0EE000-memory.dmp	upx
behavioral1/memory/3252-343-0x00007FF95D770000-0x00007FF95D782000-memory.dmp	upx
behavioral1/memory/3252-348-0x00007FF95D220000-0x00007FF95D234000-memory.dmp	upx
behavioral1/memory/3252-350-0x00007FF95CBC0000-0x00007FF95CBE2000-memory.dmp	upx
behavioral1/memory/3252-357-0x00007FF95B280000-0x00007FF95B29E000-memory.dmp	upx
behavioral1/memory/3252-356-0x00007FF95CB80000-0x00007FF95CB91000-memory.dmp	upx
behavioral1/memory/3252-355-0x00007FF95D7E0000-0x00007FF95D818000-memory.dmp	upx
behavioral1/memory/3252-361-0x00007FF95B1F0000-0x00007FF95B219000-memory.dmp	upx
behavioral1/memory/3252-358-0x00007FF95B220000-0x00007FF95B27D000-memory.dmp	upx
behavioral1/memory/3252-354-0x00007FF95CBA0000-0x00007FF95CBB9000-memory.dmp	upx
behavioral1/memory/3252-353-0x00007FF95BC20000-0x00007FF95BC6C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaveUpdater = "C:\\ProgramData\\WaveUpdater.exe"	XClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
117	discord.com
118	discord.com
119	raw.githubusercontent.com
120	raw.githubusercontent.com
152	discord.com
158	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
142	ipapi.co
143	ipapi.co
145	ipapi.co
147	ipapi.co

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6020	powercfg.exe
6064	powercfg.exe
5400	powercfg.exe
2392	powercfg.exe
5560	powercfg.exe
5516	powercfg.exe
5512	powercfg.exe
3324	powercfg.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4420 set thread context of 5528	4420	WaveCrack.exe	158
PID 4400 set thread context of 5544	4400	gptwlkqtlame.exe	172
PID 4400 set thread context of 5208	4400	gptwlkqtlame.exe	177

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\WaveInstaller.exe	msedge.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5772	sc.exe
5644	sc.exe
5628	sc.exe
5488	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000023687-37.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5172	cmd.exe
7084	netsh.exe
5400	cmd.exe
536	netsh.exe
6896	cmd.exe
6964	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5912	reg.exe
5972	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6008	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5596	XClient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5204	taskmgr.exe
5204	taskmgr.exe
5596	XClient.exe
5596	XClient.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
3252	WavePatcher.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
4420	WaveCrack.exe
4420	WaveCrack.exe
4420	WaveCrack.exe
4420	WaveCrack.exe
4420	WaveCrack.exe
4420	WaveCrack.exe
5528	dialer.exe
5528	dialer.exe
5204	taskmgr.exe
5204	taskmgr.exe
4420	WaveCrack.exe
5528	dialer.exe
5528	dialer.exe
4420	WaveCrack.exe
4420	WaveCrack.exe
5596	XClient.exe
5596	XClient.exe
5596	XClient.exe
5596	XClient.exe
4400	gptwlkqtlame.exe
4400	gptwlkqtlame.exe
4400	gptwlkqtlame.exe
4400	gptwlkqtlame.exe
4400	gptwlkqtlame.exe
5544	dialer.exe
5544	dialer.exe
4400	gptwlkqtlame.exe
5204	taskmgr.exe
5204	taskmgr.exe
772	wmiprvse.exe
772	wmiprvse.exe
772	wmiprvse.exe
772	wmiprvse.exe
772	wmiprvse.exe
772	wmiprvse.exe
5528	dialer.exe
5528	dialer.exe
5528	dialer.exe
5528	dialer.exe
772	wmiprvse.exe
772	wmiprvse.exe
5528	dialer.exe
5528	dialer.exe
5528	dialer.exe
5528	dialer.exe
5528	dialer.exe
5528	dialer.exe
5204	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2172	7zG.exe
Token: 35	2172	7zG.exe
Token: SeSecurityPrivilege	2172	7zG.exe
Token: SeSecurityPrivilege	2172	7zG.exe
Token: SeDebugPrivilege	2456	WaveInstaller.exe
Token: SeDebugPrivilege	5596	XClient.exe
Token: SeDebugPrivilege	5204	taskmgr.exe
Token: SeSystemProfilePrivilege	5204	taskmgr.exe
Token: SeCreateGlobalPrivilege	5204	taskmgr.exe
Token: SeDebugPrivilege	3252	WavePatcher.exe
Token: SeIncreaseQuotaPrivilege	5400	WMIC.exe
Token: SeSecurityPrivilege	5400	WMIC.exe
Token: SeTakeOwnershipPrivilege	5400	WMIC.exe
Token: SeLoadDriverPrivilege	5400	WMIC.exe
Token: SeSystemProfilePrivilege	5400	WMIC.exe
Token: SeSystemtimePrivilege	5400	WMIC.exe
Token: SeProfSingleProcessPrivilege	5400	WMIC.exe
Token: SeIncBasePriorityPrivilege	5400	WMIC.exe
Token: SeCreatePagefilePrivilege	5400	WMIC.exe
Token: SeBackupPrivilege	5400	WMIC.exe
Token: SeRestorePrivilege	5400	WMIC.exe
Token: SeShutdownPrivilege	5400	WMIC.exe
Token: SeDebugPrivilege	5400	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5400	WMIC.exe
Token: SeRemoteShutdownPrivilege	5400	WMIC.exe
Token: SeUndockPrivilege	5400	WMIC.exe
Token: SeManageVolumePrivilege	5400	WMIC.exe
Token: 33	5400	WMIC.exe
Token: 34	5400	WMIC.exe
Token: 35	5400	WMIC.exe
Token: 36	5400	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5400	WMIC.exe
Token: SeSecurityPrivilege	5400	WMIC.exe
Token: SeTakeOwnershipPrivilege	5400	WMIC.exe
Token: SeLoadDriverPrivilege	5400	WMIC.exe
Token: SeSystemProfilePrivilege	5400	WMIC.exe
Token: SeSystemtimePrivilege	5400	WMIC.exe
Token: SeProfSingleProcessPrivilege	5400	WMIC.exe
Token: SeIncBasePriorityPrivilege	5400	WMIC.exe
Token: SeCreatePagefilePrivilege	5400	WMIC.exe
Token: SeBackupPrivilege	5400	WMIC.exe
Token: SeRestorePrivilege	5400	WMIC.exe
Token: SeShutdownPrivilege	5400	WMIC.exe
Token: SeDebugPrivilege	5400	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5400	WMIC.exe
Token: SeRemoteShutdownPrivilege	5400	WMIC.exe
Token: SeUndockPrivilege	5400	WMIC.exe
Token: SeManageVolumePrivilege	5400	WMIC.exe
Token: 33	5400	WMIC.exe
Token: 34	5400	WMIC.exe
Token: 35	5400	WMIC.exe
Token: 36	5400	WMIC.exe
Token: SeDebugPrivilege	5528	dialer.exe
Token: SeShutdownPrivilege	5560	powercfg.exe
Token: SeCreatePagefilePrivilege	5560	powercfg.exe
Token: SeShutdownPrivilege	3324	powercfg.exe
Token: SeCreatePagefilePrivilege	3324	powercfg.exe
Token: SeShutdownPrivilege	5512	powercfg.exe
Token: SeCreatePagefilePrivilege	5512	powercfg.exe
Token: SeShutdownPrivilege	5516	powercfg.exe
Token: SeCreatePagefilePrivilege	5516	powercfg.exe
Token: SeDebugPrivilege	5544	dialer.exe
Token: SeShutdownPrivilege	2392	powercfg.exe
Token: SeCreatePagefilePrivilege	2392	powercfg.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2172	7zG.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe
5204	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5596	XClient.exe
6728	Conhost.exe
6796	Conhost.exe
5588	Conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2504	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 2456	380	WaveInstaller.exe	127
PID 380 wrote to memory of 2456	380	WaveInstaller.exe	127
PID 380 wrote to memory of 2456	380	WaveInstaller.exe	127
PID 380 wrote to memory of 4420	380	WaveInstaller.exe	128
PID 380 wrote to memory of 4420	380	WaveInstaller.exe	128
PID 380 wrote to memory of 5404	380	WaveInstaller.exe	132
PID 380 wrote to memory of 5404	380	WaveInstaller.exe	132
PID 380 wrote to memory of 5596	380	WaveInstaller.exe	133
PID 380 wrote to memory of 5596	380	WaveInstaller.exe	133
PID 5404 wrote to memory of 3252	5404	WavePatcher.exe	134
PID 5404 wrote to memory of 3252	5404	WavePatcher.exe	134
PID 3252 wrote to memory of 5644	3252	WavePatcher.exe	136
PID 3252 wrote to memory of 5644	3252	WavePatcher.exe	136
PID 5596 wrote to memory of 6008	5596	XClient.exe	138
PID 5596 wrote to memory of 6008	5596	XClient.exe	138
PID 3252 wrote to memory of 5784	3252	WavePatcher.exe	141
PID 3252 wrote to memory of 5784	3252	WavePatcher.exe	141
PID 5784 wrote to memory of 5972	5784	cmd.exe	143
PID 5784 wrote to memory of 5972	5784	cmd.exe	143
PID 3252 wrote to memory of 5828	3252	WavePatcher.exe	166
PID 3252 wrote to memory of 5828	3252	WavePatcher.exe	166
PID 5828 wrote to memory of 5912	5828	cmd.exe	146
PID 5828 wrote to memory of 5912	5828	cmd.exe	146
PID 3252 wrote to memory of 1180	3252	WavePatcher.exe	147
PID 3252 wrote to memory of 1180	3252	WavePatcher.exe	147
PID 1180 wrote to memory of 5400	1180	cmd.exe	190
PID 1180 wrote to memory of 5400	1180	cmd.exe	190
PID 4420 wrote to memory of 5528	4420	WaveCrack.exe	158
PID 4420 wrote to memory of 5528	4420	WaveCrack.exe	158
PID 4420 wrote to memory of 5528	4420	WaveCrack.exe	158
PID 4420 wrote to memory of 5528	4420	WaveCrack.exe	158
PID 4420 wrote to memory of 5528	4420	WaveCrack.exe	158
PID 4420 wrote to memory of 5528	4420	WaveCrack.exe	158
PID 4420 wrote to memory of 5528	4420	WaveCrack.exe	158
PID 5528 wrote to memory of 608	5528	dialer.exe	5
PID 5528 wrote to memory of 680	5528	dialer.exe	7
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 5528 wrote to memory of 952	5528	dialer.exe	12
PID 5528 wrote to memory of 1020	5528	dialer.exe	13
PID 5528 wrote to memory of 508	5528	dialer.exe	14
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 5528 wrote to memory of 856	5528	dialer.exe	15
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 5528 wrote to memory of 1040	5528	dialer.exe	16
PID 5528 wrote to memory of 1060	5528	dialer.exe	17
PID 5528 wrote to memory of 1188	5528	dialer.exe	19
PID 5528 wrote to memory of 1216	5528	dialer.exe	20
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 5528 wrote to memory of 1264	5528	dialer.exe	21
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 4400 wrote to memory of 5544	4400	gptwlkqtlame.exe	172
PID 4400 wrote to memory of 5544	4400	gptwlkqtlame.exe	172
PID 4400 wrote to memory of 5544	4400	gptwlkqtlame.exe	172
PID 4400 wrote to memory of 5544	4400	gptwlkqtlame.exe	172
PID 4400 wrote to memory of 5544	4400	gptwlkqtlame.exe	172
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 4400 wrote to memory of 5544	4400	gptwlkqtlame.exe	172
PID 680 wrote to memory of 2536	680	lsass.exe	45
PID 4400 wrote to memory of 5544	4400	gptwlkqtlame.exe	172
PID 680 wrote to memory of 2536	680	lsass.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1188
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3076
- C:\ProgramData\WaveUpdater.exe
  C:\ProgramData\WaveUpdater.exe
  2⤵
  PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1492
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x518 0x51c
  2⤵
  PID:552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1936

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Suspicious use of UnmapMainImage
PID:2504

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3340

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/fxaustountermed/WaveInstaller/archive/refs/heads/main.zip
  2⤵
  PID:4416
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\WaveInstaller-main\WaveInstaller-main\" -an -ai#7zMap15714:164:7zEvent25857
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2172
- C:\Users\Admin\Downloads\WaveInstaller-main\WaveInstaller-main\WaveInstaller.exe
  "C:\Users\Admin\Downloads\WaveInstaller-main\WaveInstaller-main\WaveInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\ProgramData\WaveInstaller.exe
    "C:\ProgramData\WaveInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- - C:\ProgramData\WaveCrack.exe
    "C:\ProgramData\WaveCrack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:5560
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:5512
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:5516
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:3324
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5528
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WindowsUpdate"
      4⤵
      Launches sc.exe
      PID:5628
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WindowsUpdate" binpath= "C:\ProgramData\ndfjsdloamfk\gptwlkqtlame.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5644
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:5488
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WindowsUpdate"
      4⤵
      Launches sc.exe
      PID:5772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5828
- - C:\ProgramData\WavePatcher.exe
    "C:\ProgramData\WavePatcher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\ProgramData\WavePatcher.exe
      "C:\ProgramData\WavePatcher.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5784
      - C:\Windows\system32\reg.exe
        
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
        6⤵
        Modifies registry key
        
        PID:5972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5828
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1180
      - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        5⤵
        
        PID:6712
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6728
      - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        6⤵
        
        PID:6820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        5⤵
        
        PID:6592
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6552
      - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        6⤵
        
        PID:3084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6896
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6796
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5172
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5588
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5400
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5776
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:536
- - C:\ProgramData\XClient.exe
    "C:\ProgramData\XClient.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WaveUpdater" /tr "C:\ProgramData\WaveUpdater.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6008
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3520

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3712

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4636

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4592

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2204

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff95e63d198,0x7ff95e63d1a4,0x7ff95e63d1b0
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1980,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=1304,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3756,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5404,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5448,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5476,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=5016,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5980,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=5192,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6292,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6960,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6860,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6944,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6156,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Drops file in Program Files directory
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6108,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=7156,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
  2⤵
  PID:4752

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3624

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:772

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4116

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:936

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:3228

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5224

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5340

C:\ProgramData\ndfjsdloamfk\gptwlkqtlame.exe
C:\ProgramData\ndfjsdloamfk\gptwlkqtlame.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:6064
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6020
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5400
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5544
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery