rms | 036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
13/02/2022, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Size 7.0MB
Sample220213-s8g2wsdchq
SHA256 036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e
MD5 14c8186ba166544a4eab8b39d725f248
SHA1 98606f40a74de5ae8a79f62abce7dce889204f23
SHA512 25e9922581cb2a5806efb2fe74e61dc89992c07675af6d0a967d5c33a7fc6de4fb166ccc648d680bfd5539d355e2ea5e25b503a764da0856db7386669645074b
MD5 SHA1 SHA512

Score

10^/10

rms evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 9 IoCs

pid	Process
2152	tashost.exe
3468	tashost.exe
3184	tashost.exe
2428	tashost.exe
4044	teskenghos.exe
1900	teskenghos.exe
3568	sys.exe
3608	run.exe
4464	teskenghos.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001e73f-150.dat	upx
behavioral2/files/0x000500000001e73f-151.dat	upx

Allows Network login with blank passwords 1 TTPs 1 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

T1076

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\limitblankpassworduse = "0"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\regedit.reg	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files\tashost.exe	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files\regedit.reg	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File created	C:\Program Files\Common Files\teskenghos.exe	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File created	C:\Program Files\Common Files\vp8encoder.dll	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files\teskenghos.exe	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File created	C:\Program Files\Common Files\tashost.exe	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File created	C:\Program Files\Common Files\vp8decoder.dll	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files\settings.ini	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files\sys.exe	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File created	C:\Program Files\Common Files\settings.ini	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File created	C:\Program Files\Common Files\sys.exe	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files\vp8encoder.dll	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
File opened for modification	C:\Program Files\Common Files\vp8decoder.dll	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Runs .reg file with regedit 2 IoCs

pid	Process
3348	regedit.exe
536	regedit.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
2152	tashost.exe
2152	tashost.exe
2152	tashost.exe
2152	tashost.exe
2152	tashost.exe
2152	tashost.exe
3468	tashost.exe
3468	tashost.exe
3184	tashost.exe
3184	tashost.exe
2428	tashost.exe
2428	tashost.exe
2428	tashost.exe
2428	tashost.exe
2428	tashost.exe
2428	tashost.exe
4044	teskenghos.exe
4044	teskenghos.exe
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
4464	teskenghos.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Token: SeIncBasePriorityPrivilege	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Token: SeShutdownPrivilege	1364	svchost.exe
Token: SeCreatePagefilePrivilege	1364	svchost.exe
Token: SeShutdownPrivilege	1364	svchost.exe
Token: SeCreatePagefilePrivilege	1364	svchost.exe
Token: SeShutdownPrivilege	1364	svchost.exe
Token: SeCreatePagefilePrivilege	1364	svchost.exe
Token: SeDebugPrivilege	2152	tashost.exe
Token: SeDebugPrivilege	3184	tashost.exe
Token: SeTakeOwnershipPrivilege	2428	tashost.exe
Token: SeTcbPrivilege	2428	tashost.exe
Token: SeTcbPrivilege	2428	tashost.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe
Token: SeBackupPrivilege	4432	TiWorker.exe
Token: SeRestorePrivilege	4432	TiWorker.exe
Token: SeSecurityPrivilege	4432	TiWorker.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2152	tashost.exe
3468	tashost.exe
3184	tashost.exe
2428	tashost.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3348	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	82
PID 1716 wrote to memory of 3348	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	82
PID 1716 wrote to memory of 3348	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	82
PID 1716 wrote to memory of 2152	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	87
PID 1716 wrote to memory of 2152	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	87
PID 1716 wrote to memory of 2152	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	87
PID 1716 wrote to memory of 3468	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	88
PID 1716 wrote to memory of 3468	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	88
PID 1716 wrote to memory of 3468	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	88
PID 1716 wrote to memory of 536	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	89
PID 1716 wrote to memory of 536	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	89
PID 1716 wrote to memory of 536	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	89
PID 1716 wrote to memory of 3184	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	90
PID 1716 wrote to memory of 3184	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	90
PID 1716 wrote to memory of 3184	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	90
PID 2428 wrote to memory of 4044	2428	tashost.exe	93
PID 2428 wrote to memory of 4044	2428	tashost.exe	93
PID 2428 wrote to memory of 4044	2428	tashost.exe	93
PID 2428 wrote to memory of 1900	2428	tashost.exe	92
PID 2428 wrote to memory of 1900	2428	tashost.exe	92
PID 2428 wrote to memory of 1900	2428	tashost.exe	92
PID 1716 wrote to memory of 3568	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	95
PID 1716 wrote to memory of 3568	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	95
PID 1716 wrote to memory of 3568	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	95
PID 3568 wrote to memory of 2324	3568	sys.exe	96
PID 3568 wrote to memory of 2324	3568	sys.exe	96
PID 3568 wrote to memory of 2324	3568	sys.exe	96
PID 3568 wrote to memory of 3608	3568	sys.exe	98
PID 3568 wrote to memory of 3608	3568	sys.exe	98
PID 3568 wrote to memory of 3608	3568	sys.exe	98
PID 1716 wrote to memory of 3468	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	99
PID 1716 wrote to memory of 3468	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	99
PID 1716 wrote to memory of 3468	1716	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe	99
PID 2324 wrote to memory of 2576	2324	cmd.exe	101
PID 2324 wrote to memory of 2576	2324	cmd.exe	101
PID 2324 wrote to memory of 2576	2324	cmd.exe	101
PID 2324 wrote to memory of 2296	2324	cmd.exe	102
PID 2324 wrote to memory of 2296	2324	cmd.exe	102
PID 2324 wrote to memory of 2296	2324	cmd.exe	102
PID 2324 wrote to memory of 2984	2324	cmd.exe	103
PID 2324 wrote to memory of 2984	2324	cmd.exe	103
PID 2324 wrote to memory of 2984	2324	cmd.exe	103
PID 2324 wrote to memory of 3700	2324	cmd.exe	104
PID 2324 wrote to memory of 3700	2324	cmd.exe	104
PID 2324 wrote to memory of 3700	2324	cmd.exe	104
PID 2324 wrote to memory of 1820	2324	cmd.exe	105
PID 2324 wrote to memory of 1820	2324	cmd.exe	105
PID 2324 wrote to memory of 1820	2324	cmd.exe	105
PID 4044 wrote to memory of 4464	4044	teskenghos.exe	112
PID 4044 wrote to memory of 4464	4044	teskenghos.exe	112
PID 4044 wrote to memory of 4464	4044	teskenghos.exe	112

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe

C:\Users\Admin\AppData\Local\Temp\036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe
"C:\Users\Admin\AppData\Local\Temp\036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1716
- C:\Windows\SysWOW64\regedit.exe
  regedit /s "C:\Program Files\Common Files\regedit.reg"
  2⤵
  - Runs .reg file with regedit
  PID:3348
- C:\Program Files\Common Files\tashost.exe
  "C:\Program Files\Common Files\tashost.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2152
- C:\Program Files\Common Files\tashost.exe
  "C:\Program Files\Common Files\tashost.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3468
- C:\Windows\SysWOW64\regedit.exe
  regedit /s "C:\Program Files\Common Files\regedit.reg"
  2⤵
  - Runs .reg file with regedit
  PID:536
- C:\Program Files\Common Files\tashost.exe
  "C:\Program Files\Common Files\tashost.exe" /start
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3184
- C:\Program Files\Common Files\sys.exe
  "C:\Program Files\Common Files\sys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Services\run.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v limitblankpassworduse /t REG_DWORD /d 0 /f
      4⤵
      Allows Network login with blank passwords
      PID:3700
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
      4⤵
      PID:1820
- - C:\Users\Admin\AppData\Roaming\Services\run.exe
    C:\Users\Admin\AppData\Roaming\Services\run.exe
    3⤵
    - Executes dropped EXE
    PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\036cc6856d0f6b0d7253eced59ac2bde2719cd4e8167ff3ba8c399c75c373c8e.exe"
  2⤵
  PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Program Files\Common Files\tashost.exe
"C:\Program Files\Common Files\tashost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files\Common Files\teskenghos.exe
  "C:\Program Files\Common Files\teskenghos.exe" /tray
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Program Files\Common Files\teskenghos.exe
  "C:\Program Files\Common Files\teskenghos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Program Files\Common Files\teskenghos.exe
    "C:\Program Files\Common Files\teskenghos.exe" /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:4464

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-137-0x000001D521530000-0x000001D521540000-memory.dmp

Download

memory/1364-139-0x000001D524280000-0x000001D524284000-memory.dmp

Download

memory/1364-138-0x000001D521590000-0x000001D5215A0000-memory.dmp

Download

memory/1716-133-0x0000000000400000-0x0000000000DE7000-memory.dmp

Download

memory/1716-161-0x0000000000400000-0x0000000000DE7000-memory.dmp

Download

memory/1900-167-0x00000000026B0000-0x00000000026B1000-memory.dmp

Download

memory/2428-165-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3568-152-0x0000000000400000-0x0000000000933562-memory.dmp

Download

memory/3568-163-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/3568-160-0x0000000000DA0000-0x0000000000DA3000-memory.dmp

Download

memory/3568-159-0x00000000026A0000-0x00000000029C6000-memory.dmp

Download

memory/3568-158-0x0000000000401000-0x0000000000742000-memory.dmp

Download

memory/3568-153-0x0000000000400000-0x0000000000933562-memory.dmp

Download

memory/3608-162-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/4044-164-0x0000000000A42000-0x0000000000A43000-memory.dmp

Download

memory/4044-166-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download