exelastealer | 6c5104caef3c226c96c8a3a5450fa6bd5c771c0b75a3f7e2fe1ab0d21e977761

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3772	netsh.exe
2944	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NalDrv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NalDrv.sys"	HMIh9.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	EclipseOG.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2860	cmd.exe
5084	powershell.exe

Deletes itself 1 IoCs

pid	Process
632	NexusFN.exe

Executes dropped EXE 3 IoCs

pid	Process
1812	NexusFN.exe
632	NexusFN.exe
4340	HMIh9.exe

Loads dropped DLL 33 IoCs

pid	Process
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
632	NexusFN.exe
5156	vc_redist.x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
76	discord.com
77	discord.com
78	discord.com
96	discord.com
4	pastebin.com
6	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
67	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

pid	Process
4892	cmd.exe
1112	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery

T1057

pid	Process
4800	tasklist.exe
2180	tasklist.exe
5112	tasklist.exe
4700	tasklist.exe
880	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2172	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
4484	EclipseOG.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4484	EclipseOG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023ce3-102.dat	upx
behavioral1/memory/632-105-0x00007FFE2D2F0000-0x00007FFE2D8D8000-memory.dmp	upx
behavioral1/files/0x0007000000023c8d-160.dat	upx
behavioral1/memory/632-163-0x00007FFE3D490000-0x00007FFE3D4A9000-memory.dmp	upx
behavioral1/memory/632-162-0x00007FFE43B00000-0x00007FFE43B0F000-memory.dmp	upx
behavioral1/memory/632-167-0x00007FFE2EAA0000-0x00007FFE2EAC3000-memory.dmp	upx
behavioral1/memory/632-166-0x00007FFE2F510000-0x00007FFE2F53D000-memory.dmp	upx
behavioral1/memory/632-169-0x00007FFE2E0D0000-0x00007FFE2E0FE000-memory.dmp	upx
behavioral1/memory/632-168-0x00007FFE2D170000-0x00007FFE2D2E3000-memory.dmp	upx
behavioral1/memory/632-171-0x00007FFE2CD30000-0x00007FFE2CDE8000-memory.dmp	upx
behavioral1/memory/632-170-0x00007FFE2CDF0000-0x00007FFE2D165000-memory.dmp	upx
behavioral1/memory/632-172-0x00007FFE2D2F0000-0x00007FFE2D8D8000-memory.dmp	upx
behavioral1/memory/632-177-0x00007FFE3D490000-0x00007FFE3D4A9000-memory.dmp	upx
behavioral1/memory/632-180-0x00007FFE2CBC0000-0x00007FFE2CBE2000-memory.dmp	upx
behavioral1/memory/632-179-0x00007FFE2CBF0000-0x00007FFE2CC07000-memory.dmp	upx
behavioral1/memory/632-178-0x00007FFE2CC10000-0x00007FFE2CD2C000-memory.dmp	upx
behavioral1/memory/632-176-0x00007FFE2E0B0000-0x00007FFE2E0C4000-memory.dmp	upx
behavioral1/memory/632-175-0x00007FFE34E40000-0x00007FFE34E54000-memory.dmp	upx
behavioral1/memory/632-174-0x00007FFE39FE0000-0x00007FFE39FF2000-memory.dmp	upx
behavioral1/memory/632-173-0x00007FFE3A4A0000-0x00007FFE3A4B5000-memory.dmp	upx
behavioral1/memory/632-165-0x00007FFE3CDC0000-0x00007FFE3CDD9000-memory.dmp	upx
behavioral1/memory/632-164-0x00007FFE3EC50000-0x00007FFE3EC5D000-memory.dmp	upx
behavioral1/memory/632-161-0x00007FFE3A000000-0x00007FFE3A024000-memory.dmp	upx
behavioral1/files/0x0007000000023c8c-159.dat	upx
behavioral1/files/0x0007000000023c8b-158.dat	upx
behavioral1/files/0x0007000000023ce7-157.dat	upx
behavioral1/files/0x0007000000023ce5-156.dat	upx
behavioral1/files/0x0007000000023ce4-155.dat	upx
behavioral1/files/0x0007000000023ce1-154.dat	upx
behavioral1/files/0x0007000000023cde-153.dat	upx
behavioral1/files/0x0007000000023cdc-152.dat	upx
behavioral1/files/0x0007000000023cdd-113.dat	upx
behavioral1/files/0x0007000000023c8e-111.dat	upx
behavioral1/memory/632-185-0x00007FFE2EAA0000-0x00007FFE2EAC3000-memory.dmp	upx
behavioral1/memory/632-184-0x00007FFE2CB10000-0x00007FFE2CB21000-memory.dmp	upx
behavioral1/memory/632-190-0x00007FFE2CD30000-0x00007FFE2CDE8000-memory.dmp	upx
behavioral1/memory/632-189-0x00007FFE2E0D0000-0x00007FFE2E0FE000-memory.dmp	upx
behavioral1/memory/632-188-0x00007FFE2CAF0000-0x00007FFE2CB0E000-memory.dmp	upx
behavioral1/memory/632-191-0x00007FFE2C350000-0x00007FFE2CAEA000-memory.dmp	upx
behavioral1/memory/632-192-0x00007FFE2C310000-0x00007FFE2C347000-memory.dmp	upx
behavioral1/memory/632-187-0x00007FFE3E570000-0x00007FFE3E57A000-memory.dmp	upx
behavioral1/memory/632-186-0x00007FFE2CDF0000-0x00007FFE2D165000-memory.dmp	upx
behavioral1/memory/632-183-0x00007FFE2CB30000-0x00007FFE2CB7D000-memory.dmp	upx
behavioral1/memory/632-182-0x00007FFE2CB80000-0x00007FFE2CB99000-memory.dmp	upx
behavioral1/memory/632-181-0x00007FFE2CBA0000-0x00007FFE2CBB6000-memory.dmp	upx
behavioral1/memory/632-197-0x00007FFE2CBF0000-0x00007FFE2CC07000-memory.dmp	upx
behavioral1/memory/632-200-0x00007FFE2CB30000-0x00007FFE2CB7D000-memory.dmp	upx
behavioral1/memory/632-199-0x00007FFE2CBA0000-0x00007FFE2CBB6000-memory.dmp	upx
behavioral1/memory/632-203-0x00007FFE3A000000-0x00007FFE3A024000-memory.dmp	upx
behavioral1/memory/632-227-0x00007FFE2C350000-0x00007FFE2CAEA000-memory.dmp	upx
behavioral1/memory/632-212-0x00007FFE2CDF0000-0x00007FFE2D165000-memory.dmp	upx
behavioral1/memory/632-215-0x00007FFE39FE0000-0x00007FFE39FF2000-memory.dmp	upx
behavioral1/memory/632-214-0x00007FFE3A4A0000-0x00007FFE3A4B5000-memory.dmp	upx
behavioral1/memory/632-202-0x00007FFE2D2F0000-0x00007FFE2D8D8000-memory.dmp	upx
behavioral1/memory/632-254-0x00007FFE2D2F0000-0x00007FFE2D8D8000-memory.dmp	upx
behavioral1/memory/632-350-0x00007FFE46980000-0x00007FFE4698D000-memory.dmp	upx
behavioral1/memory/632-406-0x00007FFE46980000-0x00007FFE4698D000-memory.dmp	upx
behavioral1/memory/632-619-0x00007FFE3CDC0000-0x00007FFE3CDD9000-memory.dmp	upx
behavioral1/memory/632-621-0x00007FFE2EAA0000-0x00007FFE2EAC3000-memory.dmp	upx
behavioral1/memory/632-632-0x00007FFE2CBC0000-0x00007FFE2CBE2000-memory.dmp	upx
behavioral1/memory/632-631-0x00007FFE2CC10000-0x00007FFE2CD2C000-memory.dmp	upx
behavioral1/memory/632-630-0x00007FFE2CDF0000-0x00007FFE2D165000-memory.dmp	upx
behavioral1/memory/632-629-0x00007FFE2E0B0000-0x00007FFE2E0C4000-memory.dmp	upx
behavioral1/memory/632-628-0x00007FFE34E40000-0x00007FFE34E54000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\security\database\NexusFN.exe	EclipseOG.exe
File created	C:\Windows\SoftwareDistribution\Download\HMIh9.sys	EclipseOG.exe
File created	C:\Windows\SoftwareDistribution\Download\HMIh9.exe	EclipseOG.exe
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1752	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000023c88-11.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
904	cmd.exe
920	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
848	cmd.exe
4736	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

System Network Connections Discovery

T1049

pid	Process
5104	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3532	WMIC.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
1324	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
396	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
2980	ipconfig.exe
5104	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
2828	systeminfo.exe

Kills process with taskkill 10 IoCs

pid	Process
1464	taskkill.exe
4284	taskkill.exe
4732	taskkill.exe
3628	taskkill.exe
2584	taskkill.exe
3648	taskkill.exe
4904	taskkill.exe
4528	taskkill.exe
4480	taskkill.exe
1900	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "232"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskmgr.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4252	taskmgr.exe
4252	taskmgr.exe
4484	EclipseOG.exe
4484	EclipseOG.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
4748	msedge.exe
4748	msedge.exe
5100	msedge.exe
5100	msedge.exe
1372	identity_helper.exe
1372	identity_helper.exe
5916	msedge.exe
5916	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4340	HMIh9.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2584	WMIC.exe
Token: SeSecurityPrivilege	2584	WMIC.exe
Token: SeTakeOwnershipPrivilege	2584	WMIC.exe
Token: SeLoadDriverPrivilege	2584	WMIC.exe
Token: SeSystemProfilePrivilege	2584	WMIC.exe
Token: SeSystemtimePrivilege	2584	WMIC.exe
Token: SeProfSingleProcessPrivilege	2584	WMIC.exe
Token: SeIncBasePriorityPrivilege	2584	WMIC.exe
Token: SeCreatePagefilePrivilege	2584	WMIC.exe
Token: SeBackupPrivilege	2584	WMIC.exe
Token: SeRestorePrivilege	2584	WMIC.exe
Token: SeShutdownPrivilege	2584	WMIC.exe
Token: SeDebugPrivilege	2584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2584	WMIC.exe
Token: SeRemoteShutdownPrivilege	2584	WMIC.exe
Token: SeUndockPrivilege	2584	WMIC.exe
Token: SeManageVolumePrivilege	2584	WMIC.exe
Token: 33	2584	WMIC.exe
Token: 34	2584	WMIC.exe
Token: 35	2584	WMIC.exe
Token: 36	2584	WMIC.exe
Token: SeDebugPrivilege	4800	tasklist.exe
Token: SeIncreaseQuotaPrivilege	396	WMIC.exe
Token: SeSecurityPrivilege	396	WMIC.exe
Token: SeTakeOwnershipPrivilege	396	WMIC.exe
Token: SeLoadDriverPrivilege	396	WMIC.exe
Token: SeSystemProfilePrivilege	396	WMIC.exe
Token: SeSystemtimePrivilege	396	WMIC.exe
Token: SeProfSingleProcessPrivilege	396	WMIC.exe
Token: SeIncBasePriorityPrivilege	396	WMIC.exe
Token: SeCreatePagefilePrivilege	396	WMIC.exe
Token: SeBackupPrivilege	396	WMIC.exe
Token: SeRestorePrivilege	396	WMIC.exe
Token: SeShutdownPrivilege	396	WMIC.exe
Token: SeDebugPrivilege	396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	396	WMIC.exe
Token: SeRemoteShutdownPrivilege	396	WMIC.exe
Token: SeUndockPrivilege	396	WMIC.exe
Token: SeManageVolumePrivilege	396	WMIC.exe
Token: 33	396	WMIC.exe
Token: 34	396	WMIC.exe
Token: 35	396	WMIC.exe
Token: 36	396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2584	WMIC.exe
Token: SeSecurityPrivilege	2584	WMIC.exe
Token: SeTakeOwnershipPrivilege	2584	WMIC.exe
Token: SeLoadDriverPrivilege	2584	WMIC.exe
Token: SeSystemProfilePrivilege	2584	WMIC.exe
Token: SeSystemtimePrivilege	2584	WMIC.exe
Token: SeProfSingleProcessPrivilege	2584	WMIC.exe
Token: SeIncBasePriorityPrivilege	2584	WMIC.exe
Token: SeCreatePagefilePrivilege	2584	WMIC.exe
Token: SeBackupPrivilege	2584	WMIC.exe
Token: SeRestorePrivilege	2584	WMIC.exe
Token: SeShutdownPrivilege	2584	WMIC.exe
Token: SeDebugPrivilege	2584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2584	WMIC.exe
Token: SeRemoteShutdownPrivilege	2584	WMIC.exe
Token: SeUndockPrivilege	2584	WMIC.exe
Token: SeManageVolumePrivilege	2584	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5732	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 452	4484	EclipseOG.exe	96
PID 4484 wrote to memory of 452	4484	EclipseOG.exe	96
PID 4484 wrote to memory of 4688	4484	EclipseOG.exe	97
PID 4484 wrote to memory of 4688	4484	EclipseOG.exe	97
PID 4688 wrote to memory of 3260	4688	cmd.exe	98
PID 4688 wrote to memory of 3260	4688	cmd.exe	98
PID 4688 wrote to memory of 408	4688	cmd.exe	99
PID 4688 wrote to memory of 408	4688	cmd.exe	99
PID 4688 wrote to memory of 4804	4688	cmd.exe	100
PID 4688 wrote to memory of 4804	4688	cmd.exe	100
PID 4484 wrote to memory of 904	4484	EclipseOG.exe	104
PID 4484 wrote to memory of 904	4484	EclipseOG.exe	104
PID 904 wrote to memory of 4480	904	cmd.exe	105
PID 904 wrote to memory of 4480	904	cmd.exe	105
PID 4484 wrote to memory of 920	4484	EclipseOG.exe	106
PID 4484 wrote to memory of 920	4484	EclipseOG.exe	106
PID 920 wrote to memory of 3628	920	cmd.exe	107
PID 920 wrote to memory of 3628	920	cmd.exe	107
PID 4484 wrote to memory of 4080	4484	EclipseOG.exe	108
PID 4484 wrote to memory of 4080	4484	EclipseOG.exe	108
PID 4080 wrote to memory of 1900	4080	cmd.exe	109
PID 4080 wrote to memory of 1900	4080	cmd.exe	109
PID 4484 wrote to memory of 4364	4484	EclipseOG.exe	110
PID 4484 wrote to memory of 4364	4484	EclipseOG.exe	110
PID 4364 wrote to memory of 3648	4364	cmd.exe	111
PID 4364 wrote to memory of 3648	4364	cmd.exe	111
PID 4484 wrote to memory of 3532	4484	EclipseOG.exe	112
PID 4484 wrote to memory of 3532	4484	EclipseOG.exe	112
PID 3532 wrote to memory of 2584	3532	cmd.exe	113
PID 3532 wrote to memory of 2584	3532	cmd.exe	113
PID 4484 wrote to memory of 3900	4484	EclipseOG.exe	114
PID 4484 wrote to memory of 3900	4484	EclipseOG.exe	114
PID 3900 wrote to memory of 4904	3900	cmd.exe	115
PID 3900 wrote to memory of 4904	3900	cmd.exe	115
PID 4484 wrote to memory of 1860	4484	EclipseOG.exe	117
PID 4484 wrote to memory of 1860	4484	EclipseOG.exe	117
PID 4484 wrote to memory of 3996	4484	EclipseOG.exe	119
PID 4484 wrote to memory of 3996	4484	EclipseOG.exe	119
PID 3996 wrote to memory of 1812	3996	cmd.exe	120
PID 3996 wrote to memory of 1812	3996	cmd.exe	120
PID 4484 wrote to memory of 2560	4484	EclipseOG.exe	121
PID 4484 wrote to memory of 2560	4484	EclipseOG.exe	121
PID 1812 wrote to memory of 632	1812	NexusFN.exe	122
PID 1812 wrote to memory of 632	1812	NexusFN.exe	122
PID 632 wrote to memory of 4756	632	NexusFN.exe	123
PID 632 wrote to memory of 4756	632	NexusFN.exe	123
PID 632 wrote to memory of 4496	632	NexusFN.exe	125
PID 632 wrote to memory of 4496	632	NexusFN.exe	125
PID 632 wrote to memory of 2396	632	NexusFN.exe	126
PID 632 wrote to memory of 2396	632	NexusFN.exe	126
PID 632 wrote to memory of 4752	632	NexusFN.exe	127
PID 632 wrote to memory of 4752	632	NexusFN.exe	127
PID 632 wrote to memory of 4700	632	NexusFN.exe	128
PID 632 wrote to memory of 4700	632	NexusFN.exe	128
PID 4700 wrote to memory of 4800	4700	cmd.exe	133
PID 4700 wrote to memory of 4800	4700	cmd.exe	133
PID 2396 wrote to memory of 2584	2396	cmd.exe	134
PID 2396 wrote to memory of 2584	2396	cmd.exe	134
PID 4496 wrote to memory of 396	4496	cmd.exe	135
PID 4496 wrote to memory of 396	4496	cmd.exe	135
PID 632 wrote to memory of 1124	632	NexusFN.exe	136
PID 632 wrote to memory of 1124	632	NexusFN.exe	136
PID 1124 wrote to memory of 628	1124	cmd.exe	138
PID 1124 wrote to memory of 628	1124	cmd.exe	138

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

pid	Process
4452	attrib.exe

C:\Users\Admin\AppData\Local\Temp\EclipseOG.exe
"C:\Users\Admin\AppData\Local\Temp\EclipseOG.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\EclipseOG.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\EclipseOG.exe" MD5
    3⤵
    PID:3260
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:408
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM FortniteClient-Win64-Shipping_EAC_EOS.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM FortniteClient-Win64-Shipping.exe > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM EpicGamesLauncher.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM NexusFN.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NexusFN.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM Retrac Launcher.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Retrac Launcher.exe
    3⤵
    - Kills process with taskkill
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM EZFN Launcher.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM EZFN Launcher.exe
    3⤵
    - Kills process with taskkill
    PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\Windows\security\database\NexusFN.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\security\database\NexusFN.exe
    C:\Windows\security\database\NexusFN.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\security\database\NexusFN.exe
      C:\Windows\security\database\NexusFN.exe
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4496
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "gdb --version"
        5⤵
        
        PID:4752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4700
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1124
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        6⤵
        
        PID:628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3820
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:4624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:2232
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM "taskmgr.exe""
        5⤵
        
        PID:4136
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "taskmgr.exe"
        6⤵
        Kills process with taskkill
        
        PID:1464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2172
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        6⤵
        Views/modifies file attributes
        
        PID:4452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
        5⤵
        
        PID:4352
      - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
        6⤵
        Adds Run key to start application
        
        PID:3268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:1116
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:3096
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:880
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:5016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:2948
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:4800
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:4184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:1648
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:4700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:2860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:5084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        5⤵
        Network Service Discovery
        
        PID:4892
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4624
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:2828
      - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        6⤵
        
        PID:4348
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        6⤵
        Collects information from the system
        
        PID:3532
      - C:\Windows\system32\net.exe
        
        net user
        6⤵
        
        PID:228
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        
        PID:2236
      - C:\Windows\system32\query.exe
        
        query user
        6⤵
        
        PID:4528
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        7⤵
        
        PID:412
      - C:\Windows\system32\net.exe
        
        net localgroup
        6⤵
        
        PID:892
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        
        PID:4732
      - C:\Windows\system32\net.exe
        
        net localgroup administrators
        6⤵
        
        PID:2808
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        
        PID:1816
      - C:\Windows\system32\net.exe
        
        net user guest
        6⤵
        
        PID:2824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        7⤵
        
        PID:5100
      - C:\Windows\system32\net.exe
        
        net user administrator
        6⤵
        
        PID:376
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        7⤵
        
        PID:2988
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        6⤵
        
        PID:4708
      - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        6⤵
        Enumerates processes with tasklist
        
        PID:880
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:2980
      - C:\Windows\system32\ROUTE.EXE
        
        route print
        6⤵
        
        PID:3888
      - C:\Windows\system32\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        
        PID:1112
      - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:5104
      - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        6⤵
        Launches sc.exe
        
        PID:1752
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3772
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:848
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:1596
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3892
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Windows\security\database\NexusFN.exe 2> nul
  2⤵
  PID:1092
- C:\Windows\SoftwareDistribution\Download\HMIh9.exe
  "C:\Windows\SoftwareDistribution\Download\HMIh9.exe" -map C:\Windows\SoftwareDistribution\Download\HMIh9.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session ID not provided, this is required. && timeout /t 5"
  2⤵
  PID:4920
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session ID not provided, this is required. && timeout /t 5"
    3⤵
    PID:3440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1324

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3268

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4864

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2428

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4544
- C:\Windows\system32\taskkill.exe
  taskkill /f /servicehost
  2⤵
  - Kills process with taskkill
  PID:4528
- C:\Windows\system32\taskkill.exe
  taskkill /f servicehost
  2⤵
  - Kills process with taskkill
  PID:4284
- C:\Windows\system32\taskkill.exe
  taskkill servicehost
  2⤵
  - Kills process with taskkill
  PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe2d8e46f8,0x7ffe2d8e4708,0x7ffe2d8e4718
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,5796525628346190047,2360509076851821428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x51c
1⤵
PID:5972

C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6124
- C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" -burn.unelevated BurnPipe.{8A8884F8-394A-4532-A119-B077A4EE4C01} {AF508AE9-A14C-4FFF-8E69-53FE87B9BE35} 6124
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5156

C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5780

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3ff7055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

System Information Discovery