remcos | 8959481382543edd72ccf80ebde2249ea0fc79c44a52a95fd1be6b19135174b3

pid	Process
4484	msedge.exe
3488	msedge.exe
1328	msedge.exe
3524	msedge.exe
4584	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	VWQBUYHIZFVJWPXC.PIF
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cscript.exe

Executes dropped EXE 3 IoCs

pid	Process
3960	VWQBUYHIZFVJWPXC.PIF
4820	VWQBUYHIZFVJWPXC.PIF
1828	ZXTMLFGZEPTYZVSYPKTO.p1f

Loads dropped DLL 1 IoCs

pid	Process
892	werfault.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	VWQBUYHIZFVJWPXC.PIF
Key enumerated	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	VWQBUYHIZFVJWPXC.PIF

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3488	certutil.exe
4936	certutil.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4204	cscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3960	VWQBUYHIZFVJWPXC.PIF
3960	VWQBUYHIZFVJWPXC.PIF
4820	VWQBUYHIZFVJWPXC.PIF
4820	VWQBUYHIZFVJWPXC.PIF

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3960 set thread context of 892	3960	VWQBUYHIZFVJWPXC.PIF	98

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\werfault.exe	VWQBUYHIZFVJWPXC.PIF
File opened for modification	C:\Program Files\Google\Chrome\Application\werfault.exe	VWQBUYHIZFVJWPXC.PIF

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3568	cmd.exe
3448	cmd.exe
3700	cmd.exe
1580	cmd.exe
2144	cmd.exe
2372	cmd.exe
2052	cmd.exe
756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VWQBUYHIZFVJWPXC.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VWQBUYHIZFVJWPXC.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3960	VWQBUYHIZFVJWPXC.PIF
3960	VWQBUYHIZFVJWPXC.PIF

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1828	ZXTMLFGZEPTYZVSYPKTO.p1f

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3960	VWQBUYHIZFVJWPXC.PIF
4484	msedge.exe
4484	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3960	VWQBUYHIZFVJWPXC.PIF

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3960	4056	wscript.exe	85
PID 3960 wrote to memory of 2052	3960	VWQBUYHIZFVJWPXC.PIF	87
PID 2052 wrote to memory of 2784	2052	cmd.exe	88
PID 3960 wrote to memory of 756	3960	VWQBUYHIZFVJWPXC.PIF	89
PID 756 wrote to memory of 3568	756	cmd.exe	90
PID 3568 wrote to memory of 752	3568	cmd.exe	91
PID 2980 wrote to memory of 4820	2980	WScript.exe	94
PID 4820 wrote to memory of 3448	4820	VWQBUYHIZFVJWPXC.PIF	96
PID 3448 wrote to memory of 4932	3448	cmd.exe	97
PID 3960 wrote to memory of 892	3960	VWQBUYHIZFVJWPXC.PIF	98
PID 3960 wrote to memory of 3700	3960	VWQBUYHIZFVJWPXC.PIF	100
PID 3700 wrote to memory of 1580	3700	cmd.exe	102
PID 3700 wrote to memory of 4204	3700	cmd.exe	103
PID 4204 wrote to memory of 2144	4204	cscript.exe	104
PID 2144 wrote to memory of 3488	2144	cmd.exe	106
PID 2144 wrote to memory of 4936	2144	cmd.exe	107
PID 2144 wrote to memory of 1828	2144	cmd.exe	108
PID 1828 wrote to memory of 2372	1828	ZXTMLFGZEPTYZVSYPKTO.p1f	110
PID 2372 wrote to memory of 1928	2372	cmd.exe	111
PID 4484 wrote to memory of 4744	4484	msedge.exe	123
PID 4484 wrote to memory of 3936	4484	msedge.exe	124
PID 4484 wrote to memory of 2780	4484	msedge.exe	125
PID 4484 wrote to memory of 2780	4484	msedge.exe	125
PID 4484 wrote to memory of 3868	4484	msedge.exe	126
PID 4484 wrote to memory of 2780	4484	msedge.exe	125
PID 4484 wrote to memory of 3868	4484	msedge.exe	126
PID 4484 wrote to memory of 1328	4484	msedge.exe	127
PID 4484 wrote to memory of 1328	4484	msedge.exe	127
PID 4484 wrote to memory of 1328	4484	msedge.exe	127
PID 4484 wrote to memory of 3488	4484	msedge.exe	128
PID 4484 wrote to memory of 3488	4484	msedge.exe	128
PID 4484 wrote to memory of 3488	4484	msedge.exe	128
PID 4484 wrote to memory of 4584	4484	msedge.exe	129
PID 4484 wrote to memory of 4584	4484	msedge.exe	129
PID 4484 wrote to memory of 4584	4484	msedge.exe	129
PID 4484 wrote to memory of 3524	4484	msedge.exe	130
PID 4484 wrote to memory of 3524	4484	msedge.exe	130
PID 4484 wrote to memory of 3524	4484	msedge.exe	130
PID 4484 wrote to memory of 2264	4484	msedge.exe	133
PID 4484 wrote to memory of 2264	4484	msedge.exe	133
PID 4484 wrote to memory of 4532	4484	msedge.exe	134
PID 4484 wrote to memory of 4532	4484	msedge.exe	134
PID 4484 wrote to memory of 2172	4484	msedge.exe	135
PID 4484 wrote to memory of 2172	4484	msedge.exe	135
PID 4484 wrote to memory of 3140	4484	msedge.exe	136
PID 4484 wrote to memory of 3140	4484	msedge.exe	136
PID 4484 wrote to memory of 1276	4484	msedge.exe	138

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ZXTMLFGZEPTYZVSYPKTO.p1f
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ZXTMLFGZEPTYZVSYPKTO.p1f

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	VWQBUYHIZFVJWPXC.PIF

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Amiantit_RFQ_Documents\DRAWINGS.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.PIF
  "C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.PIF" C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.ttf
  2⤵
  - Suricata alert: REMCOS RAT Malware Inbound C2 Communication
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "VWQBUYHIZFVJWPXC" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "VWQBUYHIZFVJWPXC"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cmd /c schtasks /create /sc minute /mo 15 /tn "VWQBUYHIZFVJWPXC" /tr "C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.url"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c schtasks /create /sc minute /mo 15 /tn "VWQBUYHIZFVJWPXC" /tr "C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.url"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 15 /tn "VWQBUYHIZFVJWPXC" /tr "C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.url"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:752
- - C:\Program Files\Google\Chrome\Application\werfault.exe
    "C:\Program Files\Google\Chrome\Application\werfault.exe"
    3⤵
    - Loads dropped DLL
    PID:892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JS-L64_CMD_F.cmd" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cd
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1580
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo "C:\Users\Admin\AppData\Local\Temp\~run.vbs"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\JS-L64_CMD_F.cmd" h1dd3n
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Windows\SysWOW64\certutil.exe
        
        certutil -f -decode "C:\Users\Admin\Docume~1\ZXTMLFGZEPTYZVSYPKTO.p1f" "C:\Users\Admin\Docume~1\ZXTMLFGZEPTYZVSYPKTO.p1f.tmp"
        6⤵
        Manipulates Digital Signatures
        Deobfuscate/Decode Files or Information
        System Location Discovery: System Language Discovery
        
        PID:3488
      - C:\Windows\SysWOW64\certutil.exe
        
        certutil -f -decode "C:\Users\Admin\Docume~1\KWQRBHVIXYONEXIJANXE.g1f" "C:\Users\Admin\Docume~1\KWQRBHVIXYONEXIJANXE.g1f.tmp"
        6⤵
        Deobfuscate/Decode Files or Information
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Users\Admin\Docume~1\ZXTMLFGZEPTYZVSYPKTO.p1f
        
        "C:\Users\Admin\Docume~1\ZXTMLFGZEPTYZVSYPKTO.p1f" "C:\Users\Admin\Docume~1\KWQRBHVIXYONEXIJANXE.g1f"
        6⤵
        Suricata alert: REMCOS RAT Malware Inbound C2 Communication
        Suricata alert: REMCOS RAT Malware Outbound C2 Communication
        UAC bypass
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /query /tn "ZXTMLFGZEPTYZVSYPKTO" 2>nul
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "ZXTMLFGZEPTYZVSYPKTO"
        8⤵
        
        PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --profile-directory="Default" --remote-debugging-port=9222 --headless
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x310,0x7ffc984dc188,0x7ffc984dc194,0x7ffc984dc1a0
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
      4⤵
      System Time Discovery
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2436,i,17376595350033272736,13009810384351455276,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
      4⤵
      PID:1276

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\DRAWINGS.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.PIF
  "C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.PIF" C:\Users\Admin\Documents\VWQBUYHIZFVJWPXC.ttf
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "VWQBUYHIZFVJWPXC" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "VWQBUYHIZFVJWPXC"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery