metasploit | acc68337ea679a47248a05b92f5e766f2a7899d023b455f13159e66afce27402

Windows Service

T1543.003

Processes:

sysvplervcs.exesysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe

Phorphiex family
phorphiex

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\s.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe	family_quasar
behavioral2/memory/5780-1179-0x0000000000460000-0x00000000004E4000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

nxmr.exewinupsecvmgr.exe

description	pid	process	target process
PID 4756 created 3524	4756	nxmr.exe	Explorer.EXE
PID 4756 created 3524	4756	nxmr.exe	Explorer.EXE
PID 6124 created 3524	6124	winupsecvmgr.exe	Explorer.EXE
PID 6124 created 3524	6124	winupsecvmgr.exe	Explorer.EXE
PID 6124 created 3524	6124	winupsecvmgr.exe	Explorer.EXE

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysvplervcs.exesysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/6124-407-0x00007FF77A0B0000-0x00007FF77A647000-memory.dmp	xmrig
behavioral2/memory/5848-433-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig
behavioral2/memory/5848-435-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig
behavioral2/memory/5848-438-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig
behavioral2/memory/5848-599-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2948 powershell.exe
2708 powershell.exe
5240 powershell.exe
2092 powershell.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

872 netsh.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
2948	powershell.exe
2708	powershell.exe
5240	powershell.exe
2092	powershell.exe

pid	process
872	netsh.exe

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/5588-169-0x00000000006A0000-0x00000000020A8000-memory.dmp	net_reactor
behavioral2/memory/5588-170-0x00000000006A0000-0x00000000020A8000-memory.dmp	net_reactor
behavioral2/memory/5588-173-0x00000000006A0000-0x00000000020A8000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Updater.exeservice.exebuild_2024-07-25_20-56.exesysvplervcs.exesysppvrdnvs.exeSteamDetector.exe4363463463464363463463463.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	build_2024-07-25_20-56.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sysvplervcs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sysppvrdnvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SteamDetector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe

Drops startup file 4 IoCs

Processes:

XClient.exeSteamDetector.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows32.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46422e05e6e5062fec6d0ab906669fb9.exe	SteamDetector.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46422e05e6e5062fec6d0ab906669fb9.exe	SteamDetector.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows32.lnk	XClient.exe

Executes dropped EXE 18 IoCs

Processes:

Updater.exejet.exetest.exeexplorer.exebuild_2024-07-25_20-56.exeservice.exeZinTask.exeXClient.exes.exetpeinf.exenewtpp.exeSteamDetector.exesysvplervcs.exesysppvrdnvs.exenxmr.exeSteamDetector.exewinupsecvmgr.exerat.exe

pid	process
3004	Updater.exe
3664	jet.exe
3536	test.exe
5588	explorer.exe
5672	build_2024-07-25_20-56.exe
6056	service.exe
5832	ZinTask.exe
2492	XClient.exe
6040	s.exe
5944	tpeinf.exe
4512	newtpp.exe
5148	SteamDetector.exe
2392	sysvplervcs.exe
4480	sysppvrdnvs.exe
4756	nxmr.exe
5744	SteamDetector.exe
6124	winupsecvmgr.exe
5808	rat.exe

Loads dropped DLL 2 IoCs

Processes:

jet.exe

pid process

3664 jet.exe
3664 jet.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

pid	process
3664	jet.exe
3664	jet.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysvplervcs.exesysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

Processes:

SteamDetector.exes.exetpeinf.exeXClient.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\46422e05e6e5062fec6d0ab906669fb9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SteamDetector.exe\" .."	SteamDetector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	tpeinf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows32.exe"	XClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\46422e05e6e5062fec6d0ab906669fb9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SteamDetector.exe\" .."	SteamDetector.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
129	raw.githubusercontent.com
130	raw.githubusercontent.com
187	discord.com
189	discord.com
192	bitbucket.org
196	bitbucket.org
8	bitbucket.org
9	bitbucket.org

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

115 ip-api.com

flow	ioc
115	ip-api.com

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

SteamDetector.exe

description	ioc	process
File created	C:\autorun.inf	SteamDetector.exe
File opened for modification	C:\autorun.inf	SteamDetector.exe
File created	D:\autorun.inf	SteamDetector.exe
File created	F:\autorun.inf	SteamDetector.exe
File opened for modification	F:\autorun.inf	SteamDetector.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

explorer.exe

pid process

5588 explorer.exe

pid	process
5588	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

winupsecvmgr.exe

description	pid	process	target process
PID 6124 set thread context of 5760	6124	winupsecvmgr.exe	conhost.exe
PID 6124 set thread context of 5848	6124	winupsecvmgr.exe	dwm.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI58082\python312.dll	upx
behavioral2/memory/1208-1163-0x00007FFF5A040000-0x00007FFF5A705000-memory.dmp	upx
behavioral2/memory/1208-1164-0x00007FFF7D5F0000-0x00007FFF7D615000-memory.dmp	upx
behavioral2/memory/1208-1165-0x00007FFF7EDD0000-0x00007FFF7EDDF000-memory.dmp	upx
behavioral2/memory/1208-1166-0x00007FFF7BDD0000-0x00007FFF7BDEA000-memory.dmp	upx
behavioral2/memory/1208-1169-0x00007FFF76720000-0x00007FFF7674D000-memory.dmp	upx
behavioral2/memory/1208-1177-0x00007FFF796B0000-0x00007FFF796C9000-memory.dmp	upx
behavioral2/memory/1208-1178-0x00007FFF7ED70000-0x00007FFF7ED7D000-memory.dmp	upx
behavioral2/memory/1208-1181-0x00007FFF758B0000-0x00007FFF7597D000-memory.dmp	upx
behavioral2/memory/1208-1183-0x00007FFF58A60000-0x00007FFF58F89000-memory.dmp	upx
behavioral2/memory/1208-1180-0x00007FFF764D0000-0x00007FFF76503000-memory.dmp	upx
behavioral2/memory/1208-1184-0x00007FFF5A040000-0x00007FFF5A705000-memory.dmp	upx
behavioral2/memory/1208-1185-0x00007FFF77CB0000-0x00007FFF77CC6000-memory.dmp	upx
behavioral2/memory/1208-1192-0x00007FFF669B0000-0x00007FFF66ACB000-memory.dmp	upx
behavioral2/memory/1208-1191-0x00007FFF763B0000-0x00007FFF763C4000-memory.dmp	upx
behavioral2/memory/1208-1194-0x00007FFF65E60000-0x00007FFF65F31000-memory.dmp	upx
behavioral2/memory/1208-1193-0x00007FFF76380000-0x00007FFF763A2000-memory.dmp	upx
behavioral2/memory/1208-1190-0x00007FFF7EDD0000-0x00007FFF7EDDF000-memory.dmp	upx
behavioral2/memory/1208-1189-0x00007FFF763D0000-0x00007FFF763E4000-memory.dmp	upx
behavioral2/memory/1208-1188-0x00007FFF7ED50000-0x00007FFF7ED5D000-memory.dmp	upx
behavioral2/memory/1208-1187-0x00007FFF763F0000-0x00007FFF76402000-memory.dmp	upx
behavioral2/memory/1208-1186-0x00007FFF7D5F0000-0x00007FFF7D615000-memory.dmp	upx
behavioral2/memory/1208-1196-0x00007FFF76230000-0x00007FFF76269000-memory.dmp	upx
behavioral2/memory/1208-1199-0x00007FFF764D0000-0x00007FFF76503000-memory.dmp	upx
behavioral2/memory/1208-1204-0x00007FFF758B0000-0x00007FFF7597D000-memory.dmp	upx
behavioral2/memory/1208-1203-0x00007FFF66950000-0x00007FFF669AD000-memory.dmp	upx
behavioral2/memory/1208-1202-0x00007FFF76210000-0x00007FFF76221000-memory.dmp	upx
behavioral2/memory/1208-1216-0x00007FFF77CB0000-0x00007FFF77CC6000-memory.dmp	upx
behavioral2/memory/1208-1215-0x00007FFF75FE0000-0x00007FFF76007000-memory.dmp	upx
behavioral2/memory/1208-1214-0x00007FFF764C0000-0x00007FFF764CB000-memory.dmp	upx
behavioral2/memory/1208-1213-0x00007FFF76710000-0x00007FFF7671D000-memory.dmp	upx
behavioral2/memory/1208-1212-0x00007FFF58A60000-0x00007FFF58F89000-memory.dmp	upx
behavioral2/memory/1208-1201-0x00007FFF76010000-0x00007FFF76052000-memory.dmp	upx
behavioral2/memory/1208-1195-0x00007FFF76270000-0x00007FFF7629C000-memory.dmp	upx
behavioral2/memory/1208-1243-0x00007FFF669B0000-0x00007FFF66ACB000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

Processes:

jet.exe

description	ioc	process
File opened for modification	\??\c:\program files\common files\microsoft shared\stationery\funletters\scenic\jet.htm	jet.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\stationery\funletters\scenic\jet.jpg	jet.exe

Drops file in Windows directory 4 IoCs

Processes:

s.exetpeinf.exe

description	ioc	process
File created	C:\Windows\sysvplervcs.exe	s.exe
File opened for modification	C:\Windows\sysvplervcs.exe	s.exe
File created	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	tpeinf.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2876 sc.exe
4584 sc.exe
3908 sc.exe
5624 sc.exe
2384 sc.exe
5564 sc.exe
5548 sc.exe
2168 sc.exe
5140 sc.exe
3136 sc.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

pid	process
2876	sc.exe
4584	sc.exe
3908	sc.exe
5624	sc.exe
2384	sc.exe
5564	sc.exe
5548	sc.exe
2168	sc.exe
5140	sc.exe
3136	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\rat.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\Files\rat.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\Files\rat.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\Files\rat.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1512	3536	WerFault.exe	test.exe
6016	5588	WerFault.exe	explorer.exe
208	5672	WerFault.exe	build_2024-07-25_20-56.exe
5804	5832	WerFault.exe	ZinTask.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

sc.exeservice.exetimeout.exeSteamDetector.exesc.exesc.exe4363463463464363463463463.exeZinTask.execmd.exesc.exeUpdater.exejet.exeexplorer.exebuild_2024-07-25_20-56.exepowershell.exeschtasks.exenewtpp.execmd.exesc.exesc.exesc.execmd.exetpeinf.execmd.exepowershell.exesc.exes.execmd.exesc.exeSteamDetector.exesc.exenetsh.execmd.exetest.exeschtasks.exesysvplervcs.exesysppvrdnvs.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamDetector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZinTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_2024-07-25_20-56.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpeinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamDetector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvplervcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build_2024-07-25_20-56.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build_2024-07-25_20-56.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build_2024-07-25_20-56.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5116 timeout.exe

pid	process
5116	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

3044 schtasks.exe
1224 schtasks.exe
6104 schtasks.exe
788 schtasks.exe

pid	process
3044	schtasks.exe
1224	schtasks.exe
6104	schtasks.exe
788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exebuild_2024-07-25_20-56.exepowershell.exepowershell.exenxmr.exepowershell.exeSteamDetector.exe

pid	process
1548	msedge.exe
1548	msedge.exe
668	msedge.exe
668	msedge.exe
2952	identity_helper.exe
2952	identity_helper.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5240	powershell.exe
5240	powershell.exe
5240	powershell.exe
2092	powershell.exe
2092	powershell.exe
2092	powershell.exe
4756	nxmr.exe
4756	nxmr.exe
2948	powershell.exe
2948	powershell.exe
2948	powershell.exe
4756	nxmr.exe
4756	nxmr.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SteamDetector.exe

pid process

5744 SteamDetector.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

668 msedge.exe
668 msedge.exe
668 msedge.exe
668 msedge.exe
668 msedge.exe
668 msedge.exe
668 msedge.exe
668 msedge.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

sysppvrdnvs.exe

pid process

4480 sysppvrdnvs.exe

pid	process
5744	SteamDetector.exe

pid	process
4480	sysppvrdnvs.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4363463463464363463463463.exeexplorer.exeXClient.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4876	4363463463464363463463463.exe
Token: SeDebugPrivilege	5588	explorer.exe
Token: SeDebugPrivilege	2492	XClient.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeIncreaseQuotaPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	2948	powershell.exe
Token: SeTakeOwnershipPrivilege	2948	powershell.exe
Token: SeLoadDriverPrivilege	2948	powershell.exe
Token: SeSystemProfilePrivilege	2948	powershell.exe
Token: SeSystemtimePrivilege	2948	powershell.exe
Token: SeProfSingleProcessPrivilege	2948	powershell.exe
Token: SeIncBasePriorityPrivilege	2948	powershell.exe
Token: SeCreatePagefilePrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2948	powershell.exe
Token: SeRestorePrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSystemEnvironmentPrivilege	2948	powershell.exe
Token: SeRemoteShutdownPrivilege	2948	powershell.exe
Token: SeUndockPrivilege	2948	powershell.exe
Token: SeManageVolumePrivilege	2948	powershell.exe
Token: 33	2948	powershell.exe
Token: 34	2948	powershell.exe
Token: 35	2948	powershell.exe
Token: 36	2948	powershell.exe
Token: SeIncreaseQuotaPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	2948	powershell.exe
Token: SeTakeOwnershipPrivilege	2948	powershell.exe
Token: SeLoadDriverPrivilege	2948	powershell.exe
Token: SeSystemProfilePrivilege	2948	powershell.exe
Token: SeSystemtimePrivilege	2948	powershell.exe
Token: SeProfSingleProcessPrivilege	2948	powershell.exe
Token: SeIncBasePriorityPrivilege	2948	powershell.exe
Token: SeCreatePagefilePrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2948	powershell.exe
Token: SeRestorePrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSystemEnvironmentPrivilege	2948	powershell.exe
Token: SeRemoteShutdownPrivilege	2948	powershell.exe
Token: SeUndockPrivilege	2948	powershell.exe
Token: SeManageVolumePrivilege	2948	powershell.exe
Token: 33	2948	powershell.exe
Token: 34	2948	powershell.exe
Token: 35	2948	powershell.exe
Token: 36	2948	powershell.exe
Token: SeIncreaseQuotaPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	2948	powershell.exe
Token: SeTakeOwnershipPrivilege	2948	powershell.exe
Token: SeLoadDriverPrivilege	2948	powershell.exe
Token: SeSystemProfilePrivilege	2948	powershell.exe
Token: SeSystemtimePrivilege	2948	powershell.exe
Token: SeProfSingleProcessPrivilege	2948	powershell.exe
Token: SeIncBasePriorityPrivilege	2948	powershell.exe
Token: SeCreatePagefilePrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2948	powershell.exe
Token: SeRestorePrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSystemEnvironmentPrivilege	2948	powershell.exe
Token: SeRemoteShutdownPrivilege	2948	powershell.exe
Token: SeUndockPrivilege	2948	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exedwm.exe

pid	process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe

Suspicious use of SendNotifyMessage 63 IoCs

Processes:

msedge.exedwm.exe

pid	process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

5588 explorer.exe

pid	process
5588	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exeUpdater.execmd.exejet.exemsedge.exe

description	pid	process	target process
PID 4876 wrote to memory of 3004	4876	4363463463464363463463463.exe	Updater.exe
PID 4876 wrote to memory of 3004	4876	4363463463464363463463463.exe	Updater.exe
PID 4876 wrote to memory of 3004	4876	4363463463464363463463463.exe	Updater.exe
PID 3004 wrote to memory of 4596	3004	Updater.exe	cmd.exe
PID 3004 wrote to memory of 4596	3004	Updater.exe	cmd.exe
PID 3004 wrote to memory of 4596	3004	Updater.exe	cmd.exe
PID 4596 wrote to memory of 3044	4596	cmd.exe	schtasks.exe
PID 4596 wrote to memory of 3044	4596	cmd.exe	schtasks.exe
PID 4596 wrote to memory of 3044	4596	cmd.exe	schtasks.exe
PID 4876 wrote to memory of 3664	4876	4363463463464363463463463.exe	jet.exe
PID 4876 wrote to memory of 3664	4876	4363463463464363463463463.exe	jet.exe
PID 4876 wrote to memory of 3664	4876	4363463463464363463463463.exe	jet.exe
PID 4876 wrote to memory of 3536	4876	4363463463464363463463463.exe	test.exe
PID 4876 wrote to memory of 3536	4876	4363463463464363463463463.exe	test.exe
PID 4876 wrote to memory of 3536	4876	4363463463464363463463463.exe	test.exe
PID 3664 wrote to memory of 668	3664	jet.exe	msedge.exe
PID 3664 wrote to memory of 668	3664	jet.exe	msedge.exe
PID 668 wrote to memory of 4100	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 4100	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 2248	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 1548	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 1548	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 4392	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 4392	668	msedge.exe	msedge.exe
PID 668 wrote to memory of 4392	668	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Files\Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Updater.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Files\jet.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.funletters.net/readme.htm
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff656646f8,0x7fff65664708,0x7fff65664718
        5⤵
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        5⤵
        
        PID:2248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
        5⤵
        
        PID:4392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:2604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
        5⤵
        
        PID:3336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
        5⤵
        
        PID:3672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
        5⤵
        
        PID:4164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:5256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
        5⤵
        
        PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Files\test.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 244
      4⤵
      Program crash
      PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Files\explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 1736
      4⤵
      Program crash
      PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-25_20-56.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-25_20-56.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5672
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-25_20-56.exe" & rd /s /q "C:\ProgramData\KFIJJJEBGCFB" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:5140
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 1944
      4⤵
      Program crash
      PID:208
- - C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 232
      4⤵
      Program crash
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Files\s.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6040
  - - C:\Windows\sysvplervcs.exe
      C:\Windows\sysvplervcs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:2392
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5240
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2876
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4584
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3908
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5564
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5944
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      PID:4480
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5624
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2168
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5140
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3136
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Files\SteamDetector.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\SteamDetector.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5148
  - - C:\Users\Admin\AppData\Roaming\SteamDetector.exe
      "C:\Users\Admin\AppData\Roaming\SteamDetector.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      PID:5744
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\SteamDetector.exe" "SteamDetector.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:872
- - C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Files\rat.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"
    3⤵
    - Executes dropped EXE
    PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Files\rat.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"
      4⤵
      PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Files\a.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe"
    3⤵
    PID:5780
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6104
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      PID:2092
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:788
- - C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe"
    3⤵
    PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"
    3⤵
    PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Files\fuag.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\fuag.exe"
    3⤵
    PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2708
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:5760
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3536 -ip 3536
1⤵
PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5588 -ip 5588
1⤵
PID:5996

C:\Users\Admin\AppData\Roaming\service.exe
C:\Users\Admin\AppData\Roaming\service.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5672 -ip 5672
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5832 -ip 5832
1⤵
PID:5772

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery