raccoon | 9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F41A.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F41A.exe

Deletes itself 1 IoCs

pid	Process
3008	Process not Found

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk	disksyncer.exe

Loads dropped DLL 19 IoCs

pid	Process
1020	1EE6.exe
1020	1EE6.exe
4208	MsiExec.exe
4208	MsiExec.exe
4684	MsiExec.exe
4684	MsiExec.exe
4684	MsiExec.exe
4684	MsiExec.exe
4684	MsiExec.exe
4684	MsiExec.exe
1020	1EE6.exe
4488	disksyncer.exe
5000	SketchClient.exe
3292	4C70.exe
3292	4C70.exe
3292	4C70.exe
3292	4C70.exe
3292	4C70.exe
4488	disksyncer.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000600000001aba5-120.dat	themida
behavioral1/memory/3016-122-0x00000000001E0000-0x00000000001E1000-memory.dmp	themida

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	301.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	301.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	301.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\301.exe = "0"	301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	301.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	301.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	F41A.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	1EE6.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	1EE6.exe
File opened (read-only)	\??\N:	1EE6.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	1EE6.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	1EE6.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	1EE6.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	1EE6.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	1EE6.exe
File opened (read-only)	\??\V:	1EE6.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	1EE6.exe
File opened (read-only)	\??\M:	1EE6.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	1EE6.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	1EE6.exe
File opened (read-only)	\??\W:	1EE6.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	1EE6.exe
File opened (read-only)	\??\Y:	1EE6.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	1EE6.exe
File opened (read-only)	\??\K:	1EE6.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	1EE6.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	1EE6.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
3016	F41A.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe
2800	301.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 2412	2160	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe	70
PID 2800 set thread context of 3784	2800	301.exe	83

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Installer\33384.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3887.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4415.tmp	msiexec.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3588.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3ADA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CE0.tmp	msiexec.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\Installer\33384.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{00CE1E75-E04C-4F83-824D-20B2297C955F}	msiexec.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2800	WerFault.exe	74

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4192	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
4720	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	1EE6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	1EE6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	1EE6.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe
2412	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found
3008	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3008	Process not Found

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
620	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2412	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3008	Process not Found
Token: SeCreatePagefilePrivilege	3008	Process not Found
Token: SeShutdownPrivilege	3008	Process not Found
Token: SeCreatePagefilePrivilege	3008	Process not Found
Token: SeShutdownPrivilege	3008	Process not Found
Token: SeCreatePagefilePrivilege	3008	Process not Found
Token: SeShutdownPrivilege	3008	Process not Found
Token: SeCreatePagefilePrivilege	3008	Process not Found
Token: SeDebugPrivilege	2800	301.exe
Token: SeDebugPrivilege	416	AdvancedRun.exe
Token: SeImpersonatePrivilege	416	AdvancedRun.exe
Token: SeDebugPrivilege	2948	AdvancedRun.exe
Token: SeImpersonatePrivilege	2948	AdvancedRun.exe
Token: SeDebugPrivilege	3016	F41A.exe
Token: SeRestorePrivilege	2696	WerFault.exe
Token: SeBackupPrivilege	2696	WerFault.exe
Token: SeBackupPrivilege	2696	WerFault.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2696	WerFault.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeShutdownPrivilege	3008	Process not Found
Token: SeCreatePagefilePrivilege	3008	Process not Found
Token: SeShutdownPrivilege	3008	Process not Found
Token: SeCreatePagefilePrivilege	3008	Process not Found
Token: SeSecurityPrivilege	672	msiexec.exe
Token: SeCreateTokenPrivilege	1020	1EE6.exe
Token: SeAssignPrimaryTokenPrivilege	1020	1EE6.exe
Token: SeLockMemoryPrivilege	1020	1EE6.exe
Token: SeIncreaseQuotaPrivilege	1020	1EE6.exe
Token: SeMachineAccountPrivilege	1020	1EE6.exe
Token: SeTcbPrivilege	1020	1EE6.exe
Token: SeSecurityPrivilege	1020	1EE6.exe
Token: SeTakeOwnershipPrivilege	1020	1EE6.exe
Token: SeLoadDriverPrivilege	1020	1EE6.exe
Token: SeSystemProfilePrivilege	1020	1EE6.exe
Token: SeSystemtimePrivilege	1020	1EE6.exe
Token: SeProfSingleProcessPrivilege	1020	1EE6.exe
Token: SeIncBasePriorityPrivilege	1020	1EE6.exe
Token: SeCreatePagefilePrivilege	1020	1EE6.exe
Token: SeCreatePermanentPrivilege	1020	1EE6.exe
Token: SeBackupPrivilege	1020	1EE6.exe
Token: SeRestorePrivilege	1020	1EE6.exe
Token: SeShutdownPrivilege	1020	1EE6.exe
Token: SeDebugPrivilege	1020	1EE6.exe
Token: SeAuditPrivilege	1020	1EE6.exe
Token: SeSystemEnvironmentPrivilege	1020	1EE6.exe
Token: SeChangeNotifyPrivilege	1020	1EE6.exe
Token: SeRemoteShutdownPrivilege	1020	1EE6.exe
Token: SeUndockPrivilege	1020	1EE6.exe
Token: SeSyncAgentPrivilege	1020	1EE6.exe
Token: SeEnableDelegationPrivilege	1020	1EE6.exe
Token: SeManageVolumePrivilege	1020	1EE6.exe
Token: SeImpersonatePrivilege	1020	1EE6.exe
Token: SeCreateGlobalPrivilege	1020	1EE6.exe
Token: SeCreateTokenPrivilege	1020	1EE6.exe
Token: SeAssignPrimaryTokenPrivilege	1020	1EE6.exe
Token: SeLockMemoryPrivilege	1020	1EE6.exe
Token: SeIncreaseQuotaPrivilege	1020	1EE6.exe
Token: SeMachineAccountPrivilege	1020	1EE6.exe
Token: SeTcbPrivilege	1020	1EE6.exe
Token: SeSecurityPrivilege	1020	1EE6.exe
Token: SeTakeOwnershipPrivilege	1020	1EE6.exe
Token: SeLoadDriverPrivilege	1020	1EE6.exe
Token: SeSystemProfilePrivilege	1020	1EE6.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4424	msiexec.exe
4424	msiexec.exe
3704	4357.tmp
3008	Process not Found
3008	Process not Found

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3008	Process not Found
3008	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2412	2160	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe	70
PID 2160 wrote to memory of 2412	2160	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe	70
PID 2160 wrote to memory of 2412	2160	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe	70
PID 2160 wrote to memory of 2412	2160	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe	70
PID 2160 wrote to memory of 2412	2160	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe	70
PID 2160 wrote to memory of 2412	2160	9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe	70
PID 3008 wrote to memory of 3016	3008	Process not Found	71
PID 3008 wrote to memory of 3016	3008	Process not Found	71
PID 3008 wrote to memory of 3016	3008	Process not Found	71
PID 3008 wrote to memory of 2988	3008	Process not Found	73
PID 3008 wrote to memory of 2988	3008	Process not Found	73
PID 3008 wrote to memory of 2988	3008	Process not Found	73
PID 3008 wrote to memory of 2800	3008	Process not Found	74
PID 3008 wrote to memory of 2800	3008	Process not Found	74
PID 3008 wrote to memory of 2800	3008	Process not Found	74
PID 2800 wrote to memory of 416	2800	301.exe	75
PID 2800 wrote to memory of 416	2800	301.exe	75
PID 2800 wrote to memory of 416	2800	301.exe	75
PID 416 wrote to memory of 2948	416	AdvancedRun.exe	76
PID 416 wrote to memory of 2948	416	AdvancedRun.exe	76
PID 416 wrote to memory of 2948	416	AdvancedRun.exe	76
PID 2800 wrote to memory of 2532	2800	301.exe	79
PID 2800 wrote to memory of 2532	2800	301.exe	79
PID 2800 wrote to memory of 2532	2800	301.exe	79
PID 2800 wrote to memory of 1532	2800	301.exe	81
PID 2800 wrote to memory of 1532	2800	301.exe	81
PID 2800 wrote to memory of 1532	2800	301.exe	81
PID 2800 wrote to memory of 3804	2800	301.exe	82
PID 2800 wrote to memory of 3804	2800	301.exe	82
PID 2800 wrote to memory of 3804	2800	301.exe	82
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2800 wrote to memory of 3784	2800	301.exe	83
PID 2988 wrote to memory of 2948	2988	21.exe	87
PID 2988 wrote to memory of 2948	2988	21.exe	87
PID 2988 wrote to memory of 2948	2988	21.exe	87
PID 3008 wrote to memory of 1020	3008	Process not Found	89
PID 3008 wrote to memory of 1020	3008	Process not Found	89
PID 3008 wrote to memory of 1020	3008	Process not Found	89
PID 672 wrote to memory of 4208	672	msiexec.exe	91
PID 672 wrote to memory of 4208	672	msiexec.exe	91
PID 672 wrote to memory of 4208	672	msiexec.exe	91
PID 2948 wrote to memory of 4228	2948	powershell.exe	92
PID 2948 wrote to memory of 4228	2948	powershell.exe	92
PID 2948 wrote to memory of 4228	2948	powershell.exe	92
PID 4228 wrote to memory of 4340	4228	csc.exe	93
PID 4228 wrote to memory of 4340	4228	csc.exe	93
PID 4228 wrote to memory of 4340	4228	csc.exe	93
PID 1020 wrote to memory of 4424	1020	1EE6.exe	94
PID 1020 wrote to memory of 4424	1020	1EE6.exe	94
PID 1020 wrote to memory of 4424	1020	1EE6.exe	94
PID 672 wrote to memory of 4684	672	msiexec.exe	95
PID 672 wrote to memory of 4684	672	msiexec.exe	95
PID 672 wrote to memory of 4684	672	msiexec.exe	95
PID 2948 wrote to memory of 5048	2948	powershell.exe	96
PID 2948 wrote to memory of 5048	2948	powershell.exe	96
PID 2948 wrote to memory of 5048	2948	powershell.exe	96
PID 3008 wrote to memory of 4280	3008	Process not Found	101
PID 3008 wrote to memory of 4280	3008	Process not Found	101

C:\Users\Admin\AppData\Local\Temp\9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe
"C:\Users\Admin\AppData\Local\Temp\9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe
  "C:\Users\Admin\AppData\Local\Temp\9f3df6691f7495516404aa8fd567b4de99567fafc1e1292f0f4bbba55ff24d84.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2412

C:\Users\Admin\AppData\Local\Temp\F41A.exe
C:\Users\Admin\AppData\Local\Temp\F41A.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Users\Admin\AppData\Local\Temp\21.exe
C:\Users\Admin\AppData\Local\Temp\21.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0nla34tc\0nla34tc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CCE.tmp" "c:\Users\Admin\AppData\Local\Temp\0nla34tc\CSC7FFEAEDE1D25447EA55B209E5CBBD61B.TMP"
      4⤵
      PID:4340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:4720
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:4948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:5056
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:4924
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:3704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:1020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:4268
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:4472
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:4300

C:\Users\Admin\AppData\Local\Temp\301.exe
C:\Users\Admin\AppData\Local\Temp\301.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\75d20555-0c76-4772-a09c-ac3cd03cdbb3\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\75d20555-0c76-4772-a09c-ac3cd03cdbb3\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\75d20555-0c76-4772-a09c-ac3cd03cdbb3\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Users\Admin\AppData\Local\Temp\75d20555-0c76-4772-a09c-ac3cd03cdbb3\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\75d20555-0c76-4772-a09c-ac3cd03cdbb3\AdvancedRun.exe" /SpecialRun 4101d8 416
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\301.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\301.exe
  "C:\Users\Admin\AppData\Local\Temp\301.exe"
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\301.exe
  "C:\Users\Admin\AppData\Local\Temp\301.exe"
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Users\Admin\AppData\Local\Temp\301.exe
  "C:\Users\Admin\AppData\Local\Temp\301.exe"
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 2252
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2696

C:\Users\Admin\AppData\Local\Temp\1EE6.exe
C:\Users\Admin\AppData\Local\Temp\1EE6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1EE6.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632879085 " AI_EUIMSI=""
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:4424

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 40CBB266DAB32D76F8B6E1D3C43E827D C
  2⤵
  - Loads dropped DLL
  PID:4208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 844270750B78D58114C2D89F21939E4A
  2⤵
  - Loads dropped DLL
  PID:4684
- C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe
  "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  PID:4488

C:\Users\Admin\AppData\Local\Temp\is-SVM49.tmp\4357.tmp
"C:\Users\Admin\AppData\Local\Temp\is-SVM49.tmp\4357.tmp" /SL5="$201FC,4844586,831488,C:\Users\Admin\AppData\Local\Temp\4357.exe"
1⤵
- Executes dropped EXE
PID:4444
- C:\Users\Admin\AppData\Local\Temp\4357.exe
  "C:\Users\Admin\AppData\Local\Temp\4357.exe" /VERYSILENT
  2⤵
  - Executes dropped EXE
  PID:4644
- - C:\Users\Admin\AppData\Local\Temp\is-SGBQ9.tmp\4357.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-SGBQ9.tmp\4357.tmp" /SL5="$301FC,4844586,831488,C:\Users\Admin\AppData\Local\Temp\4357.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3704
  - - C:\Users\Admin\AppData\Roaming\SketchLib SDK Client\SketchClient.exe
      "C:\Users\Admin\AppData\Roaming\SketchLib SDK Client\SketchClient.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5000

C:\Users\Admin\AppData\Local\Temp\4357.exe
C:\Users\Admin\AppData\Local\Temp\4357.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Users\Admin\AppData\Local\Temp\4C70.exe
C:\Users\Admin\AppData\Local\Temp\4C70.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4C70.exe"
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery