37b2146d5711734bca210f34b19e1b09b4ee03e14b2d0ce731a9a458c13818fb

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Server.exe

Drops startup file 7 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\62896c49bf88e588212d7d10932f1b59windows update.exe	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62896c49bf88e588212d7d10932f1b59Windows Update.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62896c49bf88e588212d7d10932f1b59Windows Update.exe	Server.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\62896c49bf88e588212d7d10932f1b59windows update.exe	taskmgr.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\microsoft corporation.exe	taskmgr.exe

Executes dropped EXE 8 IoCs

pid	Process
2680	StUpdate.exe
2724	StUpdate.exe
1680	tmp8DB0.tmp.exe
2688	tmpE518.tmp.exe
2948	StUpdate.exe
756	tmp2667.tmp.bat
4068	tmp8BE9.tmp.bat
3740	StUpdate.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	Server.exe
File opened for modification	C:\autorun.inf	Server.exe
File created	F:\autorun.inf	Server.exe
File opened for modification	F:\autorun.inf	Server.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2667.tmp.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8BE9.tmp.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE518.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8DB0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Server.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
632	msedge.exe
632	msedge.exe
1860	msedge.exe
1860	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2460	taskmgr.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe
2688	tmpE518.tmp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
840	Server.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	taskmgr.exe
Token: SeSystemProfilePrivilege	3180	taskmgr.exe
Token: SeCreateGlobalPrivilege	3180	taskmgr.exe
Token: SeDebugPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	3180	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3180	taskmgr.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	1128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1128	AUDIODG.EXE
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: SeDebugPrivilege	2460	taskmgr.exe
Token: SeSystemProfilePrivilege	2460	taskmgr.exe
Token: SeCreateGlobalPrivilege	2460	taskmgr.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	2460	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2460	taskmgr.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: SeDebugPrivilege	2688	tmpE518.tmp.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe
Token: 33	840	Server.exe
Token: SeIncBasePriorityPrivilege	840	Server.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
3180	taskmgr.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 660	840	Server.exe	86
PID 840 wrote to memory of 660	840	Server.exe	86
PID 840 wrote to memory of 660	840	Server.exe	86
PID 840 wrote to memory of 5076	840	Server.exe	94
PID 840 wrote to memory of 5076	840	Server.exe	94
PID 840 wrote to memory of 5076	840	Server.exe	94
PID 840 wrote to memory of 3228	840	Server.exe	95
PID 840 wrote to memory of 3228	840	Server.exe	95
PID 840 wrote to memory of 3228	840	Server.exe	95
PID 840 wrote to memory of 5040	840	Server.exe	96
PID 840 wrote to memory of 5040	840	Server.exe	96
PID 840 wrote to memory of 5040	840	Server.exe	96
PID 840 wrote to memory of 1860	840	Server.exe	107
PID 840 wrote to memory of 1860	840	Server.exe	107
PID 1860 wrote to memory of 228	1860	msedge.exe	108
PID 1860 wrote to memory of 228	1860	msedge.exe	108
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 3472	1860	msedge.exe	109
PID 1860 wrote to memory of 632	1860	msedge.exe	110
PID 1860 wrote to memory of 632	1860	msedge.exe	110
PID 1860 wrote to memory of 1624	1860	msedge.exe	111
PID 1860 wrote to memory of 1624	1860	msedge.exe	111
PID 1860 wrote to memory of 1624	1860	msedge.exe	111
PID 1860 wrote to memory of 1624	1860	msedge.exe	111
PID 1860 wrote to memory of 1624	1860	msedge.exe	111
PID 1860 wrote to memory of 1624	1860	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:660
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3228
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.hacker.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3a8d46f8,0x7ffb3a8d4708,0x7ffb3a8d4718
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15469093440842056858,3397629164665884286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:1492
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\tmp8DB0.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8DB0.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\tmpE518.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpE518.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\tmp2667.tmp.bat
  "C:\Users\Admin\AppData\Local\Temp\tmp2667.tmp.bat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:756
- C:\Users\Admin\AppData\Local\Temp\tmp8BE9.tmp.bat
  "C:\Users\Admin\AppData\Local\Temp\tmp8BE9.tmp.bat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB77E.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 mouse,disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C25.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1956
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -s -t 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C64.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C94.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2320
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 USER32.DLL,SwapMouseButton
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1CE3.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1DCE.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2280

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3180

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4b0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948

C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3915055 /state1:0x41c64e6d
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery