arkei | 672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ins.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ins.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1_1.exe

Deletes itself 1 IoCs

pid	Process
3028	Process not Found

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Wine	ins.exe

Loads dropped DLL 3 IoCs

pid	Process
1788	ins.exe
1788	ins.exe
1788	ins.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000700000001ac09-277.dat	themida
behavioral1/files/0x000700000001ac09-285.dat	themida

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	4B84.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	4B84.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	4B84.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	4B84.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\4B84.exe = "0"	4B84.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4B84.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	4B84.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	4B84.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	4B84.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4B84.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ins.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1_1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
1788	ins.exe
1208	1_1.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe
364	4B84.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 380	1680	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe	69
PID 416 set thread context of 68	416	247F.exe	75
PID 364 set thread context of 1212	364	4B84.exe	106
PID 3420 set thread context of 4540	3420	4FFA.exe	112

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3780	2496	WerFault.exe	77
1864	1192	WerFault.exe	76
3156	2496	WerFault.exe	77
4164	364	WerFault.exe	85
4748	1788	WerFault.exe	103

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3620	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4316	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
380	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe
380	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found
3028	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	Process not Found

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
380	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeDebugPrivilege	1384	17CB.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeRestorePrivilege	3780	WerFault.exe
Token: SeBackupPrivilege	3780	WerFault.exe
Token: SeDebugPrivilege	3780	WerFault.exe
Token: SeDebugPrivilege	848	3E43.exe
Token: SeDebugPrivilege	364	4B84.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	68	247F.exe
Token: SeDebugPrivilege	1732	csc.exe
Token: SeImpersonatePrivilege	1732	csc.exe
Token: SeDebugPrivilege	4048	AdvancedRun.exe
Token: SeImpersonatePrivilege	4048	AdvancedRun.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeDebugPrivilege	1864	WerFault.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeDebugPrivilege	2496	352A.exe
Token: SeDebugPrivilege	3156	WerFault.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeDebugPrivilege	4164	WerFault.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeDebugPrivilege	1208	1_1.exe
Token: SeDebugPrivilege	4748	WerFault.exe
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found
Token: SeCreatePagefilePrivilege	3028	Process not Found
Token: SeShutdownPrivilege	3028	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3028	Process not Found
3028	Process not Found

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3028	Process not Found
3028	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 380	1680	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe	69
PID 1680 wrote to memory of 380	1680	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe	69
PID 1680 wrote to memory of 380	1680	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe	69
PID 1680 wrote to memory of 380	1680	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe	69
PID 1680 wrote to memory of 380	1680	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe	69
PID 1680 wrote to memory of 380	1680	672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe	69
PID 3028 wrote to memory of 3168	3028	Process not Found	70
PID 3028 wrote to memory of 3168	3028	Process not Found	70
PID 3028 wrote to memory of 3168	3028	Process not Found	70
PID 3028 wrote to memory of 1384	3028	Process not Found	71
PID 3028 wrote to memory of 1384	3028	Process not Found	71
PID 3028 wrote to memory of 1384	3028	Process not Found	71
PID 3028 wrote to memory of 620	3028	Process not Found	72
PID 3028 wrote to memory of 620	3028	Process not Found	72
PID 3028 wrote to memory of 620	3028	Process not Found	72
PID 3028 wrote to memory of 416	3028	Process not Found	73
PID 3028 wrote to memory of 416	3028	Process not Found	73
PID 3028 wrote to memory of 416	3028	Process not Found	73
PID 416 wrote to memory of 68	416	247F.exe	75
PID 416 wrote to memory of 68	416	247F.exe	75
PID 416 wrote to memory of 68	416	247F.exe	75
PID 3028 wrote to memory of 1192	3028	Process not Found	76
PID 3028 wrote to memory of 1192	3028	Process not Found	76
PID 3028 wrote to memory of 1192	3028	Process not Found	76
PID 416 wrote to memory of 68	416	247F.exe	75
PID 416 wrote to memory of 68	416	247F.exe	75
PID 416 wrote to memory of 68	416	247F.exe	75
PID 416 wrote to memory of 68	416	247F.exe	75
PID 416 wrote to memory of 68	416	247F.exe	75
PID 3028 wrote to memory of 2496	3028	Process not Found	77
PID 3028 wrote to memory of 2496	3028	Process not Found	77
PID 3028 wrote to memory of 2496	3028	Process not Found	77
PID 3028 wrote to memory of 848	3028	Process not Found	81
PID 3028 wrote to memory of 848	3028	Process not Found	81
PID 3028 wrote to memory of 848	3028	Process not Found	81
PID 3028 wrote to memory of 1212	3028	Process not Found	106
PID 3028 wrote to memory of 1212	3028	Process not Found	106
PID 3028 wrote to memory of 1212	3028	Process not Found	106
PID 620 wrote to memory of 3048	620	20B5.exe	83
PID 620 wrote to memory of 3048	620	20B5.exe	83
PID 620 wrote to memory of 3048	620	20B5.exe	83
PID 3028 wrote to memory of 364	3028	Process not Found	85
PID 3028 wrote to memory of 364	3028	Process not Found	85
PID 3028 wrote to memory of 364	3028	Process not Found	85
PID 1212 wrote to memory of 3864	1212	4B84.exe	88
PID 1212 wrote to memory of 3864	1212	4B84.exe	88
PID 1212 wrote to memory of 3864	1212	4B84.exe	88
PID 3028 wrote to memory of 3420	3028	Process not Found	89
PID 3028 wrote to memory of 3420	3028	Process not Found	89
PID 3028 wrote to memory of 3420	3028	Process not Found	89
PID 364 wrote to memory of 1732	364	4B84.exe	104
PID 364 wrote to memory of 1732	364	4B84.exe	104
PID 364 wrote to memory of 1732	364	4B84.exe	104
PID 1732 wrote to memory of 4048	1732	csc.exe	91
PID 1732 wrote to memory of 4048	1732	csc.exe	91
PID 1732 wrote to memory of 4048	1732	csc.exe	91
PID 3864 wrote to memory of 4000	3864	sqtvvs.exe	93
PID 3864 wrote to memory of 4000	3864	sqtvvs.exe	93
PID 3864 wrote to memory of 4000	3864	sqtvvs.exe	93
PID 3864 wrote to memory of 3620	3864	sqtvvs.exe	95
PID 3864 wrote to memory of 3620	3864	sqtvvs.exe	95
PID 3864 wrote to memory of 3620	3864	sqtvvs.exe	95
PID 4000 wrote to memory of 3516	4000	cmd.exe	98
PID 4000 wrote to memory of 3516	4000	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe
"C:\Users\Admin\AppData\Local\Temp\672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe
  "C:\Users\Admin\AppData\Local\Temp\672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:380

C:\Users\Admin\AppData\Local\Temp\DE6.exe
C:\Users\Admin\AppData\Local\Temp\DE6.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Users\Admin\AppData\Local\Temp\17CB.exe
C:\Users\Admin\AppData\Local\Temp\17CB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Users\Admin\AppData\Local\Temp\20B5.exe
C:\Users\Admin\AppData\Local\Temp\20B5.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vzjhxhyx\vzjhxhyx.cmdline"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES679F.tmp" "c:\Users\Admin\AppData\Local\Temp\vzjhxhyx\CSCA60F9A95F2644848932B6C4B6EF81FB4.TMP"
      4⤵
      PID:4228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:4316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:4716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:5036
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:4604
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:5088
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:4128
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:1136
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:4256

C:\Users\Admin\AppData\Local\Temp\247F.exe
C:\Users\Admin\AppData\Local\Temp\247F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\247F.exe
  C:\Users\Admin\AppData\Local\Temp\247F.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:68

C:\Users\Admin\AppData\Local\Temp\2EB1.exe
C:\Users\Admin\AppData\Local\Temp\2EB1.exe
1⤵
- Executes dropped EXE
PID:1192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 928
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1864

C:\Users\Admin\AppData\Local\Temp\352A.exe
C:\Users\Admin\AppData\Local\Temp\352A.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 676
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1212
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3156

C:\Users\Admin\AppData\Local\Temp\3E43.exe
C:\Users\Admin\AppData\Local\Temp\3E43.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Users\Admin\AppData\Local\Temp\46EF.exe
C:\Users\Admin\AppData\Local\Temp\46EF.exe
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
  "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
      4⤵
      PID:3516
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:3620

C:\Users\Admin\AppData\Local\Temp\4B84.exe
C:\Users\Admin\AppData\Local\Temp\4B84.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\db56c3fe-c279-437e-885f-188719f147dd\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\db56c3fe-c279-437e-885f-188719f147dd\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\db56c3fe-c279-437e-885f-188719f147dd\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\db56c3fe-c279-437e-885f-188719f147dd\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\db56c3fe-c279-437e-885f-188719f147dd\AdvancedRun.exe" /SpecialRun 4101d8 1732
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4B84.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Users\Admin\AppData\Local\Temp\4B84.exe
  "C:\Users\Admin\AppData\Local\Temp\4B84.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 2244
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4164

C:\Users\Admin\AppData\Local\Temp\4FFA.exe
C:\Users\Admin\AppData\Local\Temp\4FFA.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4540

C:\Users\Admin\AppData\Local\Temp\5C01.exe
C:\Users\Admin\AppData\Local\Temp\5C01.exe
1⤵
- Executes dropped EXE
PID:2784
- C:\Users\Admin\AppData\Local\Temp\1_1.exe
  "C:\Users\Admin\AppData\Local\Temp\1_1.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\ins.exe
  "C:\Users\Admin\AppData\Local\Temp\ins.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 1356
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:4748

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
1⤵
- Executes dropped EXE
PID:496

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
1⤵
- Executes dropped EXE
PID:4700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery