remcos | 4ba50be2c056423d1788cc6f2e7e1444e069684c14a302d1486725bc736d30c3

pid	Process
5044	msedge.exe
1008	Chrome.exe
820	Chrome.exe
1868	Chrome.exe
5008	msedge.exe
460	msedge.exe
2084	Chrome.exe
2516	msedge.exe
3832	msedge.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	dkyQuick_alpha.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 2208	1176	atkexComSvc.exe	97
PID 1136 set thread context of 4500	1136	dkyQuick_alpha.exe	105
PID 1136 set thread context of 1476	1136	dkyQuick_alpha.exe	107
PID 1136 set thread context of 4556	1136	dkyQuick_alpha.exe	108

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Chrome.exe
File created	C:\Windows\Installer\e57b4e8.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5B3.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b4ea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b4e8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5F69263C-3699-4DA1-9800-2313D297788F}	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
2168	atkexComSvc.exe
1176	atkexComSvc.exe
4500	dkyQuick_alpha.exe
1476	dkyQuick_alpha.exe
4556	dkyQuick_alpha.exe

Loads dropped DLL 7 IoCs

pid	Process
2168	atkexComSvc.exe
2168	atkexComSvc.exe
2168	atkexComSvc.exe
1176	atkexComSvc.exe
1176	atkexComSvc.exe
1176	atkexComSvc.exe
1136	dkyQuick_alpha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4444	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dkyQuick_alpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dkyQuick_alpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atkexComSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atkexComSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dkyQuick_alpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dkyQuick_alpha.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fbf239697f82b3040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fbf239690000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fbf23969000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfbf23969000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fbf2396900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
116	msiexec.exe
116	msiexec.exe
2168	atkexComSvc.exe
1176	atkexComSvc.exe
1176	atkexComSvc.exe
2208	cmd.exe
2208	cmd.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
4500	dkyQuick_alpha.exe
4500	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
4556	dkyQuick_alpha.exe
4556	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
4500	dkyQuick_alpha.exe
4500	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1008	Chrome.exe
1008	Chrome.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1176	atkexComSvc.exe
2208	cmd.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe
1136	dkyQuick_alpha.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	116	msiexec.exe
Token: SeCreateTokenPrivilege	4444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4444	msiexec.exe
Token: SeLockMemoryPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeMachineAccountPrivilege	4444	msiexec.exe
Token: SeTcbPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	4444	msiexec.exe
Token: SeTakeOwnershipPrivilege	4444	msiexec.exe
Token: SeLoadDriverPrivilege	4444	msiexec.exe
Token: SeSystemProfilePrivilege	4444	msiexec.exe
Token: SeSystemtimePrivilege	4444	msiexec.exe
Token: SeProfSingleProcessPrivilege	4444	msiexec.exe
Token: SeIncBasePriorityPrivilege	4444	msiexec.exe
Token: SeCreatePagefilePrivilege	4444	msiexec.exe
Token: SeCreatePermanentPrivilege	4444	msiexec.exe
Token: SeBackupPrivilege	4444	msiexec.exe
Token: SeRestorePrivilege	4444	msiexec.exe
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeDebugPrivilege	4444	msiexec.exe
Token: SeAuditPrivilege	4444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4444	msiexec.exe
Token: SeChangeNotifyPrivilege	4444	msiexec.exe
Token: SeRemoteShutdownPrivilege	4444	msiexec.exe
Token: SeUndockPrivilege	4444	msiexec.exe
Token: SeSyncAgentPrivilege	4444	msiexec.exe
Token: SeEnableDelegationPrivilege	4444	msiexec.exe
Token: SeManageVolumePrivilege	4444	msiexec.exe
Token: SeImpersonatePrivilege	4444	msiexec.exe
Token: SeCreateGlobalPrivilege	4444	msiexec.exe
Token: SeBackupPrivilege	4748	vssvc.exe
Token: SeRestorePrivilege	4748	vssvc.exe
Token: SeAuditPrivilege	4748	vssvc.exe
Token: SeBackupPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4444	msiexec.exe
4444	msiexec.exe
1008	Chrome.exe
2516	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1136	dkyQuick_alpha.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2824	116	msiexec.exe	92
PID 116 wrote to memory of 2824	116	msiexec.exe	92
PID 116 wrote to memory of 2168	116	msiexec.exe	94
PID 116 wrote to memory of 2168	116	msiexec.exe	94
PID 116 wrote to memory of 2168	116	msiexec.exe	94
PID 2168 wrote to memory of 1176	2168	atkexComSvc.exe	96
PID 2168 wrote to memory of 1176	2168	atkexComSvc.exe	96
PID 2168 wrote to memory of 1176	2168	atkexComSvc.exe	96
PID 1176 wrote to memory of 2208	1176	atkexComSvc.exe	97
PID 1176 wrote to memory of 2208	1176	atkexComSvc.exe	97
PID 1176 wrote to memory of 2208	1176	atkexComSvc.exe	97
PID 1176 wrote to memory of 2208	1176	atkexComSvc.exe	97
PID 2208 wrote to memory of 1136	2208	cmd.exe	103
PID 2208 wrote to memory of 1136	2208	cmd.exe	103
PID 2208 wrote to memory of 1136	2208	cmd.exe	103
PID 2208 wrote to memory of 1136	2208	cmd.exe	103
PID 2208 wrote to memory of 1136	2208	cmd.exe	103
PID 2208 wrote to memory of 1136	2208	cmd.exe	103
PID 1136 wrote to memory of 1008	1136	dkyQuick_alpha.exe	104
PID 1136 wrote to memory of 1008	1136	dkyQuick_alpha.exe	104
PID 1136 wrote to memory of 4500	1136	dkyQuick_alpha.exe	105
PID 1136 wrote to memory of 4500	1136	dkyQuick_alpha.exe	105
PID 1136 wrote to memory of 4500	1136	dkyQuick_alpha.exe	105
PID 1008 wrote to memory of 5060	1008	Chrome.exe	106
PID 1008 wrote to memory of 5060	1008	Chrome.exe	106
PID 1136 wrote to memory of 4500	1136	dkyQuick_alpha.exe	105
PID 1136 wrote to memory of 1476	1136	dkyQuick_alpha.exe	107
PID 1136 wrote to memory of 1476	1136	dkyQuick_alpha.exe	107
PID 1136 wrote to memory of 1476	1136	dkyQuick_alpha.exe	107
PID 1136 wrote to memory of 1476	1136	dkyQuick_alpha.exe	107
PID 1136 wrote to memory of 4556	1136	dkyQuick_alpha.exe	108
PID 1136 wrote to memory of 4556	1136	dkyQuick_alpha.exe	108
PID 1136 wrote to memory of 4556	1136	dkyQuick_alpha.exe	108
PID 1136 wrote to memory of 4556	1136	dkyQuick_alpha.exe	108
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109
PID 1008 wrote to memory of 1556	1008	Chrome.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PCESTHTB.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4444

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
  2⤵
  PID:2824
- C:\Users\Admin\AppData\Local\Aardvark\atkexComSvc.exe
  "C:\Users\Admin\AppData\Local\Aardvark\atkexComSvc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\ProgramData\AOJ_Explore_alpha\atkexComSvc.exe
    C:\ProgramData\AOJ_Explore_alpha\atkexComSvc.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe
        
        C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe
        5⤵
        Suspicious use of SetThreadContext
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1136
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ffab2bacc40,0x7ffab2bacc4c,0x7ffab2bacc58
        7⤵
        
        PID:5060
        
        C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,18085430705161252755,4313162038271278984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1940 /prefetch:2
        7⤵
        
        PID:1556
        
        C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,18085430705161252755,4313162038271278984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2184 /prefetch:3
        7⤵
        
        PID:2064
        
        C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,18085430705161252755,4313162038271278984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2428 /prefetch:8
        7⤵
        
        PID:1424
        
        C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,18085430705161252755,4313162038271278984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3196 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:2084
        
        C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,18085430705161252755,4313162038271278984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3256 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:820
        
        C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,18085430705161252755,4313162038271278984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4552 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe
        
        C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe /stext "C:\Users\Admin\AppData\Local\Temp\mtbikbytnfaskfodr"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe
        
        C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe /stext "C:\Users\Admin\AppData\Local\Temp\xngbltjvjnsfntchabdrw"
        6⤵
        Accesses Microsoft Outlook accounts
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe
        
        C:\Users\Admin\AppData\Local\Temp\dkyQuick_alpha.exe /stext "C:\Users\Admin\AppData\Local\Temp\hqmtmmtpxwkkxaytkmpthanb"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffab27f46f8,0x7ffab27f4708,0x7ffab27f4718
        7⤵
        
        PID:1476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7571234984048037786,4820809906883991133,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
        7⤵
        
        PID:2300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7571234984048037786,4820809906883991133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
        7⤵
        
        PID:1876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7571234984048037786,4820809906883991133,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
        7⤵
        
        PID:2388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,7571234984048037786,4820809906883991133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,7571234984048037786,4820809906883991133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,7571234984048037786,4820809906883991133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2180,7571234984048037786,4820809906883991133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Modify Authentication Process

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Authentication Process

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery