hxxp://mega[.]nz/file/u6ByUZIB#-ix0ApvS6FkQqJ4I4lnwuHDH2KWxTp6MSlm4V28q79k

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	NewLauncher-2.0.9-windows-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	NewLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	NewLauncher.exe

Executes dropped EXE 11 IoCs

pid	Process
4492	NewLauncher-2.0.9-windows-x64.exe
3820	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
2420	AntimalwareServiceExecutable.exe
5796	xdwdWindowsDefender.exe
5892	xdwdExplorer.exe
6124	xdwdExplorer.exe
3876	NewLauncher.exe
6996	NewLauncher.exe
6824	NewLauncher.exe
6272	NewLauncher.exe

Loads dropped DLL 54 IoCs

pid	Process
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
5292	Process not Found
5476	Process not Found
5468	Process not Found
5544	Process not Found
4308	NewLauncher-2.0.9-windows-x64.exe
5668	Process not Found
5716	Process not Found
5624	Process not Found
5796	xdwdWindowsDefender.exe
5892	xdwdExplorer.exe
5996	Process not Found
6124	xdwdExplorer.exe
4308	NewLauncher-2.0.9-windows-x64.exe
6096	Process not Found
5404	Process not Found
5432	Process not Found
5276	Process not Found
6284	Process not Found
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
5644	Conhost.exe
5708	Process not Found
6092	Process not Found
5880	Process not Found
5288	Process not Found
2560	Process not Found
808	Process not Found
3876	NewLauncher.exe
4736	Process not Found
3876	NewLauncher.exe
3876	NewLauncher.exe
6824	NewLauncher.exe
6996	NewLauncher.exe
6996	NewLauncher.exe
6996	NewLauncher.exe
6996	NewLauncher.exe
6996	NewLauncher.exe
6996	NewLauncher.exe
6272	NewLauncher.exe
6272	NewLauncher.exe
5748	Process not Found
5916	Process not Found
5180	Process not Found
3052	Process not Found
6536	Process not Found
6816	Process not Found

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntimalwareServiceExecutable = "C:\\Windows\\System32/xdwdExplorer.exe"	AntimalwareServiceExecutable.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
194	raw.githubusercontent.com
197	raw.githubusercontent.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\xdwdExplorer.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	xdwdExplorer.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	xdwdExplorer.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	xdwdWindowsDefender.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	xdwdExplorer.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	xdwdExplorer.exe
File created	C:\Windows\System32\xdwdWindowsDefender.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	xdwdWindowsDefender.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32	xdwdExplorer.exe
File opened for modification	C:\Windows\System32	AntimalwareServiceExecutable.exe
File created	C:\Windows\xdwd.dll	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32	xdwdWindowsDefender.exe
File opened for modification	C:\Windows\System32	xdwdExplorer.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1216	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5380	CMD.exe
3928	CMD.exe
6140	CMD.exe
3152	CMD.exe
6004	CMD.exe
5876	CMD.exe
5252	CMD.exe
5948	CMD.exe
5400	CMD.exe
3776	CMD.exe
6528	CMD.exe
5280	CMD.exe
5632	CMD.exe
1480	CMD.exe
5780	CMD.exe
5852	CMD.exe
7048	CMD.exe
3020	CMD.exe
5176	CMD.exe
5844	CMD.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NewLauncher-2.0.9-windows-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4268	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NewLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NewLauncher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302995907618204"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{67E5DEEF-8927-4303-8F97-F406B51B7783}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NewLauncher-2.0.9-windows-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NewLauncher-2.0.9-windows-x64.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5336	schtasks.exe
5256	schtasks.exe
5204	schtasks.exe
5208	schtasks.exe
5644	schtasks.exe
1196	schtasks.exe
5236	schtasks.exe
4360	schtasks.exe
1720	schtasks.exe
5268	schtasks.exe
5944	schtasks.exe
6044	schtasks.exe
3764	schtasks.exe
5460	schtasks.exe
2516	schtasks.exe
6204	schtasks.exe
3804	schtasks.exe
5568	schtasks.exe
6588	schtasks.exe
5152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3412	powershell.exe
3412	powershell.exe
3412	powershell.exe
1216	powershell.exe
1216	powershell.exe
1216	powershell.exe
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
4308	NewLauncher-2.0.9-windows-x64.exe
4308	NewLauncher-2.0.9-windows-x64.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
5700	powershell.exe
5700	powershell.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
5700	powershell.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
2420	AntimalwareServiceExecutable.exe
5796	xdwdWindowsDefender.exe
5796	xdwdWindowsDefender.exe
6124	xdwdExplorer.exe
6124	xdwdExplorer.exe
5892	xdwdExplorer.exe
5892	xdwdExplorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	2420	AntimalwareServiceExecutable.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	5796	xdwdWindowsDefender.exe
Token: SeDebugPrivilege	5700	powershell.exe
Token: SeDebugPrivilege	5892	xdwdExplorer.exe
Token: SeDebugPrivilege	6124	xdwdExplorer.exe
Token: SeIncreaseQuotaPrivilege	5700	powershell.exe
Token: SeSecurityPrivilege	5700	powershell.exe
Token: SeTakeOwnershipPrivilege	5700	powershell.exe
Token: SeLoadDriverPrivilege	5700	powershell.exe
Token: SeSystemProfilePrivilege	5700	powershell.exe
Token: SeSystemtimePrivilege	5700	powershell.exe
Token: SeProfSingleProcessPrivilege	5700	powershell.exe
Token: SeIncBasePriorityPrivilege	5700	powershell.exe
Token: SeCreatePagefilePrivilege	5700	powershell.exe
Token: SeBackupPrivilege	5700	powershell.exe
Token: SeRestorePrivilege	5700	powershell.exe
Token: SeShutdownPrivilege	5700	powershell.exe
Token: SeDebugPrivilege	5700	powershell.exe
Token: SeSystemEnvironmentPrivilege	5700	powershell.exe
Token: SeRemoteShutdownPrivilege	5700	powershell.exe
Token: SeUndockPrivilege	5700	powershell.exe
Token: SeManageVolumePrivilege	5700	powershell.exe
Token: 33	5700	powershell.exe
Token: 34	5700	powershell.exe
Token: 35	5700	powershell.exe
Token: 36	5700	powershell.exe
Token: SeSecurityPrivilege	4308	NewLauncher-2.0.9-windows-x64.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe
Token: SeShutdownPrivilege	3876	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3876	NewLauncher.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
4308	NewLauncher-2.0.9-windows-x64.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3332	msedge.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe
3876	NewLauncher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2040	3332	msedge.exe	87
PID 3332 wrote to memory of 4268	3332	msedge.exe	88
PID 3332 wrote to memory of 1624	3332	msedge.exe	90
PID 3332 wrote to memory of 1624	3332	msedge.exe	90
PID 3332 wrote to memory of 4524	3332	msedge.exe	89
PID 3332 wrote to memory of 4524	3332	msedge.exe	89
PID 3332 wrote to memory of 4524	3332	msedge.exe	89
PID 3332 wrote to memory of 3324	3332	msedge.exe	91
PID 3332 wrote to memory of 3324	3332	msedge.exe	91
PID 3332 wrote to memory of 3324	3332	msedge.exe	91
PID 3332 wrote to memory of 1844	3332	msedge.exe	92
PID 3332 wrote to memory of 1844	3332	msedge.exe	92
PID 3332 wrote to memory of 1844	3332	msedge.exe	92
PID 3332 wrote to memory of 3940	3332	msedge.exe	94
PID 3332 wrote to memory of 3940	3332	msedge.exe	94
PID 3332 wrote to memory of 3940	3332	msedge.exe	94
PID 3332 wrote to memory of 3388	3332	msedge.exe	95
PID 3332 wrote to memory of 3388	3332	msedge.exe	95
PID 3332 wrote to memory of 3388	3332	msedge.exe	95
PID 3332 wrote to memory of 2272	3332	msedge.exe	98
PID 3332 wrote to memory of 2272	3332	msedge.exe	98
PID 3332 wrote to memory of 2272	3332	msedge.exe	98
PID 3332 wrote to memory of 4212	3332	msedge.exe	101
PID 3332 wrote to memory of 3776	3332	msedge.exe	102
PID 3332 wrote to memory of 4212	3332	msedge.exe	101
PID 3332 wrote to memory of 3776	3332	msedge.exe	102
PID 3332 wrote to memory of 1692	3332	msedge.exe	104
PID 3332 wrote to memory of 2888	3332	msedge.exe	105
PID 3332 wrote to memory of 2888	3332	msedge.exe	105
PID 3332 wrote to memory of 2812	3332	msedge.exe	108
PID 3332 wrote to memory of 2812	3332	msedge.exe	108
PID 3332 wrote to memory of 3544	3332	msedge.exe	109
PID 3332 wrote to memory of 3304	3332	msedge.exe	110
PID 3332 wrote to memory of 936	3332	msedge.exe	111
PID 3332 wrote to memory of 1756	3332	msedge.exe	112
PID 3332 wrote to memory of 1756	3332	msedge.exe	112
PID 3332 wrote to memory of 2412	3332	msedge.exe	113
PID 3332 wrote to memory of 2412	3332	msedge.exe	113
PID 3332 wrote to memory of 2412	3332	msedge.exe	113
PID 3332 wrote to memory of 4976	3332	msedge.exe	114
PID 3332 wrote to memory of 760	3332	msedge.exe	115
PID 3332 wrote to memory of 760	3332	msedge.exe	115
PID 3332 wrote to memory of 4492	3332	msedge.exe	116
PID 3332 wrote to memory of 3820	3332	msedge.exe	118
PID 4492 wrote to memory of 4308	4492	NewLauncher-2.0.9-windows-x64.exe	119
PID 4492 wrote to memory of 3412	4492	NewLauncher-2.0.9-windows-x64.exe	120
PID 4492 wrote to memory of 2420	4492	NewLauncher-2.0.9-windows-x64.exe	122
PID 3332 wrote to memory of 4688	3332	msedge.exe	123
PID 3332 wrote to memory of 4688	3332	msedge.exe	123
PID 4308 wrote to memory of 1216	4308	NewLauncher-2.0.9-windows-x64.exe	127
PID 4308 wrote to memory of 2776	4308	NewLauncher-2.0.9-windows-x64.exe	130
PID 2420 wrote to memory of 3020	2420	AntimalwareServiceExecutable.exe	132
PID 3020 wrote to memory of 5152	3020	CMD.exe	134
PID 2420 wrote to memory of 5176	2420	AntimalwareServiceExecutable.exe	135
PID 2420 wrote to memory of 5280	2420	AntimalwareServiceExecutable.exe	137
PID 5176 wrote to memory of 5336	5176	CMD.exe	139
PID 5280 wrote to memory of 5460	5280	CMD.exe	140
PID 2420 wrote to memory of 5632	2420	AntimalwareServiceExecutable.exe	145
PID 4308 wrote to memory of 5700	4308	NewLauncher-2.0.9-windows-x64.exe	147
PID 5632 wrote to memory of 6044	5632	CMD.exe	152
PID 2420 wrote to memory of 6004	2420	AntimalwareServiceExecutable.exe	154
PID 6004 wrote to memory of 5256	6004	CMD.exe	157
PID 2420 wrote to memory of 1480	2420	AntimalwareServiceExecutable.exe	159
PID 1480 wrote to memory of 5644	1480	CMD.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mega.nz/file/u6ByUZIB#-ix0ApvS6FkQqJ4I4lnwuHDH2KWxTp6MSlm4V28q79k
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3334160530829845519,15079386069141118993,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,4123517692764791871,8826350939083934703,262144 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,17624887286682827037,15448426384657961686,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17607732746008882924,760138771369071972,2097152 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9663986400192107006,15993592555018438209,2097152 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,5947842803326172700,15384658472827500299,2097152 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12345794887344123060,3409347428260470066,2097152 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3592,i,8945248930479921293,702396496654829601,2097152 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,8747485613040238780,18367694027361210202,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7121055773775645813,14475341839293679051,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6366279601312381656,10106080446831417489,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6366279601312381656,10106080446831417489,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,14629172569586236779,12400051250957869689,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4669621266649379883,18088028689289808710,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11254164483916406857,15281645813956338764,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,13338706495509872091,5185387790905964278,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,2446095261474123827,7684046702333029346,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10854853506962610867,1460440318119236135,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6620,i,5820691855882265567,17225909884058260287,2097152 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,12140246100669748168,16355386142351732001,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,8421251861755659816,8300240621419638611,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:760
- C:\Users\Admin\Downloads\NewLauncher-2.0.9-windows-x64.exe
  "C:\Users\Admin\Downloads\NewLauncher-2.0.9-windows-x64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2776
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\Desktop\NewLauncher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AntimalwareServiceExecutable.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\AntimalwareServiceExecutable.exe
    "C:\Users\Admin\AppData\Local\Temp\AntimalwareServiceExecutable.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "ExplorerHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "ExplorerHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5152
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5176
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5336
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "ProcessorCoreHost" /tr "C:\Windows\System32\xdwdExplorer.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5280
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "ProcessorCoreHost" /tr "C:\Windows\System32\xdwdExplorer.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5460
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5632
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6044
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6004
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5256
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5644
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5844
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Loads dropped DLL
        
        PID:5644
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1196
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:3928
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6204
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:6140
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5208
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5400
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5944
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:7048
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3804
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:3776
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5568
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:6528
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6588
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:3152
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3764
- C:\Users\Admin\Downloads\NewLauncher-2.0.9-windows-x64.exe
  "C:\Users\Admin\Downloads\NewLauncher-2.0.9-windows-x64.exe"
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,13578237372129636134,11414727187371234452,524288 --field-trial-handle=2408,i,2770977250299658816,1127014394716297323,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3096

C:\Windows\System32\xdwdWindowsDefender.exe
C:\Windows\System32\xdwdWindowsDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5796
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1720

C:\Windows\System32\xdwdExplorer.exe
C:\Windows\System32/xdwdExplorer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5892
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4360
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5204

C:\Windows\System32\xdwdExplorer.exe
C:\Windows\System32\xdwdExplorer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6124
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2516
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5268

C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe
"C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3876
- C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,2302701594768728336,10695542405619724888,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,15979764188890703260,14527332348919146501,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6996
- C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --field-trial-handle=1888,i,2302701594768728336,10695542405619724888,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,15979764188890703260,14527332348919146501,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6824
- C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\Desktop\NewLauncher\NewLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --app-path="C:\Users\Admin\Desktop\NewLauncher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1888,i,2302701594768728336,10695542405619724888,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,15979764188890703260,14527332348919146501,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery