badrabbit | 15a16fabdf75ea76c43d28dec7a1d4535fcde8835a4e8e15b338c08249cfad76

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

suricata: ET MALWARE Ponmocup C2 Post-infection Checkin
suricata: ET MALWARE Ponmocup C2 Post-infection Checkin
suricata
suricata: ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
suricata: ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
suricata

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	DB.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Hhowf = "C:\\Windows\\SysWOW64\\apilogenn.exe"	DB.EXE

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	apilogenn.exe

Executes dropped EXE 27 IoCs

pid	Process
1964	Øèôðîâùèê4.exe
1780	1.exe
2020	2.exe
1184	3.exe
1912	5.exe
1088	Öåðáåð.exe
1980	EAQwMEso.exe
976	DAUgoMQs.exe
1188	Øèôðîâùèê.exe
1532	Øèôðîâùèê4.exe
892	Øèôðîâùèê2.exe
1084	Øèôðîâùèê3.exe
1288	AV.EXE
772	AV2.EXE
2000	Øèôðîâùèê4.exe
824	DB.EXE
1452	EN.EXE
1936	SB.EXE
2064	4C8B.tmp
2120	Øèôðîâùèê4.exe
2888	Øèôðîâùèê4.exe
3016	Øèôðîâùèê4.exe
1272	Øèôðîâùèê4.exe
1152	EAQwMEso.exe
1688	apilogenn.exe
2772	Øèôðîâùèê4.exe
844	Øèôðîâùèê4.exe

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2720	netsh.exe
3012	netsh.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000001448b-202.dat	upx
behavioral1/files/0x000600000001448b-204.dat	upx
behavioral1/files/0x000600000001448b-206.dat	upx
behavioral1/memory/824-208-0x0000000001D00000-0x0000000001D93000-memory.dmp	upx
behavioral1/memory/824-211-0x0000000001D00000-0x0000000001D93000-memory.dmp	upx
behavioral1/memory/824-212-0x0000000001D00000-0x0000000001D93000-memory.dmp	upx
behavioral1/memory/892-214-0x0000000000BB0000-0x0000000000BF5000-memory.dmp	upx
behavioral1/memory/2024-223-0x00000000002F0000-0x0000000000329000-memory.dmp	upx
behavioral1/files/0x0006000000014499-225.dat	upx
behavioral1/files/0x0006000000014499-221.dat	upx
behavioral1/files/0x0006000000014499-220.dat	upx
behavioral1/memory/824-216-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1452-261-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/772-321-0x0000000000400000-0x00000000004C3000-memory.dmp	upx
behavioral1/memory/1488-324-0x0000000000400000-0x0000000000439000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DB.EXE

Loads dropped DLL 50 IoCs

pid	Process
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
1964	Øèôðîâùèê4.exe
1964	Øèôðîâùèê4.exe
1964	Øèôðîâùèê4.exe
1964	Øèôðîâùèê4.exe
1948	launcher.exe
1936	cmd.exe
1936	cmd.exe
1948	launcher.exe
1948	launcher.exe
1948	launcher.exe
892	Øèôðîâùèê2.exe
892	Øèôðîâùèê2.exe
892	Øèôðîâùèê2.exe
2024	cmd.exe
2024	cmd.exe
892	Øèôðîâùèê2.exe
892	Øèôðîâùèê2.exe
892	Øèôðîâùèê2.exe
892	Øèôðîâùèê2.exe
892	Øèôðîâùèê2.exe
892	Øèôðîâùèê2.exe
1760	cmd.exe
1760	cmd.exe
2524	cmd.exe
2524	cmd.exe
1980	EAQwMEso.exe
2956	cmd.exe
2956	cmd.exe
1980	EAQwMEso.exe
1980	EAQwMEso.exe
2360	cmd.exe
2360	cmd.exe
976	DAUgoMQs.exe
976	DAUgoMQs.exe
824	DB.EXE
824	DB.EXE
1980	EAQwMEso.exe
1488	cmd.exe
1488	cmd.exe
2964	cmd.exe
2964	cmd.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\EAQwMEso.exe = "C:\\Users\\Admin\\BUUgEAEw\\EAQwMEso.exe"	Øèôðîâùèê4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DAUgoMQs.exe = "C:\\ProgramData\\HMQgIwAg\\DAUgoMQs.exe"	Øèôðîâùèê4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\EAQwMEso.exe = "C:\\Users\\Admin\\BUUgEAEw\\EAQwMEso.exe"	EAQwMEso.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DAUgoMQs.exe = "C:\\ProgramData\\HMQgIwAg\\DAUgoMQs.exe"	DAUgoMQs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\EAQwMEso.exe = "C:\\Users\\Admin\\BUUgEAEw\\EAQwMEso.exe"	EAQwMEso.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DB.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\m:	Öåðáåð.exe
File opened (read-only)	\??\p:	Öåðáåð.exe
File opened (read-only)	\??\u:	Öåðáåð.exe
File opened (read-only)	\??\v:	Öåðáåð.exe
File opened (read-only)	\??\z:	Öåðáåð.exe
File opened (read-only)	\??\E:	5.exe
File opened (read-only)	\??\e:	Öåðáåð.exe
File opened (read-only)	\??\i:	Öåðáåð.exe
File opened (read-only)	\??\Q:	5.exe
File opened (read-only)	\??\F:	5.exe
File opened (read-only)	\??\N:	5.exe
File opened (read-only)	\??\H:	5.exe
File opened (read-only)	\??\K:	5.exe
File opened (read-only)	\??\U:	5.exe
File opened (read-only)	\??\g:	Öåðáåð.exe
File opened (read-only)	\??\s:	Öåðáåð.exe
File opened (read-only)	\??\o:	Öåðáåð.exe
File opened (read-only)	\??\r:	Öåðáåð.exe
File opened (read-only)	\??\M:	5.exe
File opened (read-only)	\??\f:	Öåðáåð.exe
File opened (read-only)	\??\n:	Öåðáåð.exe
File opened (read-only)	\??\J:	5.exe
File opened (read-only)	\??\L:	5.exe
File opened (read-only)	\??\Z:	5.exe
File opened (read-only)	\??\h:	Öåðáåð.exe
File opened (read-only)	\??\I:	5.exe
File opened (read-only)	\??\S:	5.exe
File opened (read-only)	\??\V:	5.exe
File opened (read-only)	\??\X:	5.exe
File opened (read-only)	\??\a:	Öåðáåð.exe
File opened (read-only)	\??\t:	Öåðáåð.exe
File opened (read-only)	\??\x:	Öåðáåð.exe
File opened (read-only)	\??\b:	Öåðáåð.exe
File opened (read-only)	\??\l:	Öåðáåð.exe
File opened (read-only)	\??\j:	Öåðáåð.exe
File opened (read-only)	\??\w:	Öåðáåð.exe
File opened (read-only)	\??\y:	Öåðáåð.exe
File opened (read-only)	\??\G:	5.exe
File opened (read-only)	\??\O:	5.exe
File opened (read-only)	\??\P:	5.exe
File opened (read-only)	\??\R:	5.exe
File opened (read-only)	\??\T:	5.exe
File opened (read-only)	\??\k:	Öåðáåð.exe
File opened (read-only)	\??\q:	Öåðáåð.exe
File opened (read-only)	\??\W:	5.exe
File opened (read-only)	\??\Y:	5.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5.exe
File opened for modification	\??\physicaldrive0	SB.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\apilogenn.exe	DB.EXE
File opened for modification	C:\Windows\SysWOW64\apilogenn.exe	DB.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\	Öåðáåð.exe
File opened for modification	\??\c:\program files (x86)\	Öåðáåð.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4C8B.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	Øèôðîâùèê.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1948	268	WerFault.exe	66
2660	1780	WerFault.exe	30

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1556	schtasks.exe
2196	schtasks.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command-Line Interface

T1059

pid	Process
2152	ipconfig.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2984	taskkill.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Modifies registry key 1 TTPs 24 IoCs

Modify Registry

pid	Process
1120	reg.exe
1124	reg.exe
2600	reg.exe
944	reg.exe
812	reg.exe
2956	reg.exe
2092	reg.exe
2172	reg.exe
2624	reg.exe
2136	reg.exe
872	reg.exe
2176	reg.exe
2876	reg.exe
2364	reg.exe
320	reg.exe
288	reg.exe
1228	reg.exe
2228	reg.exe
2588	reg.exe
1212	reg.exe
2408	reg.exe
1156	reg.exe
2932	reg.exe
2292	reg.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1964	Øèôðîâùèê4.exe
1964	Øèôðîâùèê4.exe
1536	rundll32.exe
1532	Øèôðîâùèê4.exe
1532	Øèôðîâùèê4.exe
1536	rundll32.exe
2000	Øèôðîâùèê4.exe
2000	Øèôðîâùèê4.exe
824	DB.EXE
824	DB.EXE
2064	4C8B.tmp
2064	4C8B.tmp
2064	4C8B.tmp
2064	4C8B.tmp
2064	4C8B.tmp
2120	Øèôðîâùèê4.exe
2120	Øèôðîâùèê4.exe
2020	2.exe
2888	Øèôðîâùèê4.exe
2888	Øèôðîâùèê4.exe
3016	Øèôðîâùèê4.exe
3016	Øèôðîâùèê4.exe
1272	Øèôðîâùèê4.exe
1272	Øèôðîâùèê4.exe
2984	taskkill.exe
2984	taskkill.exe
2772	Øèôðîâùèê4.exe
2772	Øèôðîâùèê4.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1536	rundll32.exe
Token: SeDebugPrivilege	1536	rundll32.exe
Token: SeTcbPrivilege	1536	rundll32.exe
Token: SeDebugPrivilege	824	DB.EXE
Token: SeDebugPrivilege	2064	4C8B.tmp
Token: SeShutdownPrivilege	1936	SB.EXE
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeShutdownPrivilege	1088	Öåðáåð.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2020	2.exe
2020	2.exe
2020	2.exe
1184	3.exe
1184	3.exe
1184	3.exe
1184	3.exe
1912	5.exe
1912	5.exe
1912	5.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
2020	2.exe
2020	2.exe
2020	2.exe
1184	3.exe
1184	3.exe
1184	3.exe
1184	3.exe
1912	5.exe
1912	5.exe
1912	5.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
268	AcroRd32.exe
268	AcroRd32.exe
1688	apilogenn.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1088	Öåðáåð.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1964	1948	launcher.exe	27
PID 1948 wrote to memory of 1964	1948	launcher.exe	27
PID 1948 wrote to memory of 1964	1948	launcher.exe	27
PID 1948 wrote to memory of 1964	1948	launcher.exe	27
PID 1948 wrote to memory of 1964	1948	launcher.exe	27
PID 1948 wrote to memory of 1964	1948	launcher.exe	27
PID 1948 wrote to memory of 1964	1948	launcher.exe	27
PID 1948 wrote to memory of 1996	1948	launcher.exe	28
PID 1948 wrote to memory of 1996	1948	launcher.exe	28
PID 1948 wrote to memory of 1996	1948	launcher.exe	28
PID 1948 wrote to memory of 1996	1948	launcher.exe	28
PID 1948 wrote to memory of 1996	1948	launcher.exe	28
PID 1948 wrote to memory of 1996	1948	launcher.exe	28
PID 1948 wrote to memory of 1996	1948	launcher.exe	28
PID 1948 wrote to memory of 1780	1948	launcher.exe	30
PID 1948 wrote to memory of 1780	1948	launcher.exe	30
PID 1948 wrote to memory of 1780	1948	launcher.exe	30
PID 1948 wrote to memory of 1780	1948	launcher.exe	30
PID 1948 wrote to memory of 1780	1948	launcher.exe	30
PID 1948 wrote to memory of 1780	1948	launcher.exe	30
PID 1948 wrote to memory of 1780	1948	launcher.exe	30
PID 1948 wrote to memory of 1160	1948	launcher.exe	31
PID 1948 wrote to memory of 1160	1948	launcher.exe	31
PID 1948 wrote to memory of 1160	1948	launcher.exe	31
PID 1948 wrote to memory of 1160	1948	launcher.exe	31
PID 1948 wrote to memory of 1160	1948	launcher.exe	31
PID 1948 wrote to memory of 1160	1948	launcher.exe	31
PID 1948 wrote to memory of 1160	1948	launcher.exe	31
PID 1948 wrote to memory of 2020	1948	launcher.exe	32
PID 1948 wrote to memory of 2020	1948	launcher.exe	32
PID 1948 wrote to memory of 2020	1948	launcher.exe	32
PID 1948 wrote to memory of 2020	1948	launcher.exe	32
PID 1948 wrote to memory of 2020	1948	launcher.exe	32
PID 1948 wrote to memory of 2020	1948	launcher.exe	32
PID 1948 wrote to memory of 2020	1948	launcher.exe	32
PID 1948 wrote to memory of 1184	1948	launcher.exe	33
PID 1948 wrote to memory of 1184	1948	launcher.exe	33
PID 1948 wrote to memory of 1184	1948	launcher.exe	33
PID 1948 wrote to memory of 1184	1948	launcher.exe	33
PID 1948 wrote to memory of 1184	1948	launcher.exe	33
PID 1948 wrote to memory of 1184	1948	launcher.exe	33
PID 1948 wrote to memory of 1184	1948	launcher.exe	33
PID 1948 wrote to memory of 1912	1948	launcher.exe	34
PID 1948 wrote to memory of 1912	1948	launcher.exe	34
PID 1948 wrote to memory of 1912	1948	launcher.exe	34
PID 1948 wrote to memory of 1912	1948	launcher.exe	34
PID 1948 wrote to memory of 1912	1948	launcher.exe	34
PID 1948 wrote to memory of 1912	1948	launcher.exe	34
PID 1948 wrote to memory of 1912	1948	launcher.exe	34
PID 1948 wrote to memory of 1088	1948	launcher.exe	35
PID 1948 wrote to memory of 1088	1948	launcher.exe	35
PID 1948 wrote to memory of 1088	1948	launcher.exe	35
PID 1948 wrote to memory of 1088	1948	launcher.exe	35
PID 1948 wrote to memory of 1088	1948	launcher.exe	35
PID 1948 wrote to memory of 1088	1948	launcher.exe	35
PID 1948 wrote to memory of 1088	1948	launcher.exe	35
PID 1964 wrote to memory of 1980	1964	Øèôðîâùèê4.exe	36
PID 1964 wrote to memory of 1980	1964	Øèôðîâùèê4.exe	36
PID 1964 wrote to memory of 1980	1964	Øèôðîâùèê4.exe	36
PID 1964 wrote to memory of 1980	1964	Øèôðîâùèê4.exe	36
PID 1964 wrote to memory of 1980	1964	Øèôðîâùèê4.exe	36
PID 1964 wrote to memory of 1980	1964	Øèôðîâùèê4.exe	36
PID 1964 wrote to memory of 1980	1964	Øèôðîâùèê4.exe	36
PID 1964 wrote to memory of 976	1964	Øèôðîâùèê4.exe	37

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\BUUgEAEw\EAQwMEso.exe
    "C:\Users\Admin\BUUgEAEw\EAQwMEso.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    PID:1980
- - C:\ProgramData\HMQgIwAg\DAUgoMQs.exe
    "C:\ProgramData\HMQgIwAg\DAUgoMQs.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    PID:976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /FI "USERNAME eq Admin" /F /IM EAQwMEso.exe
      4⤵
      Kills process with taskkill
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2984
  - - C:\Users\Admin\BUUgEAEw\EAQwMEso.exe
      "C:\Users\Admin\BUUgEAEw\EAQwMEso.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
    3⤵
    - Loads dropped DLL
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
      C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1532
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        5⤵
        Loads dropped DLL
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        7⤵
        Loads dropped DLL
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        9⤵
        Loads dropped DLL
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2888
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        11⤵
        Loads dropped DLL
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        13⤵
        Loads dropped DLL
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        15⤵
        Loads dropped DLL
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        17⤵
        Loads dropped DLL
        
        PID:2964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        17⤵
        Modifies registry key
        
        PID:812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        17⤵
        Modifies registry key
        
        PID:2292
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        17⤵
        Modifies registry key
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OEkYYIEU.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        17⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\XOoAEcEM.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        15⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        16⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        15⤵
        Modifies registry key
        
        PID:2876
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        15⤵
        Modifies registry key
        
        PID:2932
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        15⤵
        Modifies registry key
        
        PID:2364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        13⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2408
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        13⤵
        Modifies registry key
        
        PID:944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        13⤵
        UAC bypass
        Modifies registry key
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AWMwUEIA.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        13⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        14⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        11⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2136
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        11⤵
        UAC bypass
        Modifies registry key
        
        PID:1212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QMAAYQcA.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        11⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        12⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        11⤵
        Modifies registry key
        
        PID:872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        9⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        9⤵
        Modifies registry key
        
        PID:2600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        9⤵
        UAC bypass
        Modifies registry key
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NCYkQQog.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        9⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        10⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        7⤵
        Modifies registry key
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\mkEoEIgo.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        7⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        8⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:2228
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1120
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:1124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        UAC bypass
        Modifies registry key
        
        PID:1228
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LGQEckAY.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        5⤵
        
        PID:240
      - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        6⤵
        
        PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tcMQgYQU.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
    3⤵
    PID:1220
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:272
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:320
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:1156
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies registry key
    PID:288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\1.cmd" "
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  PID:1780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 644
    3⤵
    - Program crash
    PID:2660
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1.py
  2⤵
  - Modifies registry class
  PID:1160
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 604
      4⤵
      Program crash
      PID:1948
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\3.exe
  "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1184
- C:\Users\Admin\AppData\Local\Temp\5.exe
  "C:\Users\Admin\AppData\Local\Temp\5.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\Öåðáåð.exe
  "C:\Users\Admin\AppData\Local\Temp\Öåðáåð.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  PID:1088
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:2720
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:3012
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1188
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      PID:1248
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        
        PID:1120
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2486138383 && exit"
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2486138383 && exit"
        5⤵
        Creates scheduled task(s)
        
        PID:1556
  - - C:\Windows\4C8B.tmp
      "C:\Windows\4C8B.tmp" \\.\pipe\{521E1F38-8D41-49E8-9DD9-1AD931628049}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:02:00
      4⤵
      PID:1524
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:02:00
        5⤵
        Creates scheduled task(s)
        
        PID:2196
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê2.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\AV.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
    3⤵
    - Executes dropped EXE
    PID:1288
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 460
      4⤵
      PID:3016
- - C:\Users\Admin\AppData\Local\Temp\AV2.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
    3⤵
    - Executes dropped EXE
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\DB.EXE
    "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:824
  - - C:\Windows\SysWOW64\apilogenn.exe
      C:\Windows\SysWOW64\apilogenn.exe
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        5⤵
        Gathers network information
        
        PID:2152
  - - C:\Windows\SysWOW64\cmd.exe
      /c C:\Users\Admin\AppData\Local\Temp\~unins7980.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
      4⤵
      PID:2244
- - C:\Users\Admin\AppData\Local\Temp\EN.EXE
    "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
    3⤵
    - Executes dropped EXE
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\SB.EXE
    "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê3.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê3.exe"
  2⤵
  - Executes dropped EXE
  PID:1084

C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
1⤵
- Executes dropped EXE
PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

Persistence

Bootkit

T1067

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery