badrabbit | 15a16fabdf75ea76c43d28dec7a1d4535fcde8835a4e8e15b338c08249cfad76

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

suricata: ET MALWARE Ponmocup C2 Post-infection Checkin
suricata: ET MALWARE Ponmocup C2 Post-infection Checkin
suricata
suricata: ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
suricata: ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
suricata

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	DB.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Pkyymqq = "C:\\Windows\\SysWOW64\\MP43DECDO.exe"	DB.EXE

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	MP43DECDO.exe

Executes dropped EXE 22 IoCs

pid	Process
4720	Øèôðîâùèê4.exe
728	1.exe
1656	beIEQoYA.exe
4452	ouAswEcQ.exe
1272	Øèôðîâùèê4.exe
1936	2.exe
5084	3.exe
2660	5.exe
1184	Öåðáåð.exe
4652	Øèôðîâùèê.exe
4580	Øèôðîâùèê2.exe
2908	Øèôðîâùèê3.exe
4780	Øèôðîâùèê4.exe
2300	AV.EXE
4592	AV2.EXE
1364	DB.EXE
1692	EN.EXE
1736	SB.EXE
224	Øèôðîâùèê4.exe
4760	MP43DECDO.exe
4308	Øèôðîâùèê4.exe
912	47D6.tmp

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1916	netsh.exe
2208	netsh.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022ed4-241.dat	upx
behavioral2/files/0x0006000000022ed4-240.dat	upx
behavioral2/memory/1364-236-0x0000000000510000-0x00000000005A3000-memory.dmp	upx
behavioral2/files/0x0006000000022ed3-234.dat	upx
behavioral2/files/0x0006000000022ed3-233.dat	upx
behavioral2/memory/1364-247-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/1692-260-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1364-248-0x0000000000510000-0x00000000005A3000-memory.dmp	upx
behavioral2/memory/1364-246-0x0000000000510000-0x00000000005A3000-memory.dmp	upx
behavioral2/memory/4592-279-0x0000000000400000-0x00000000004C3000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DB.EXE

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	EN.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Øèôðîâùèê2.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	rundll32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5.exe"	5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beIEQoYA.exe = "C:\\Users\\Admin\\CKUIgcIw\\beIEQoYA.exe"	Øèôðîâùèê4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ouAswEcQ.exe = "C:\\ProgramData\\MSUEIUQc\\ouAswEcQ.exe"	Øèôðîâùèê4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beIEQoYA.exe = "C:\\Users\\Admin\\CKUIgcIw\\beIEQoYA.exe"	beIEQoYA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ouAswEcQ.exe = "C:\\ProgramData\\MSUEIUQc\\ouAswEcQ.exe"	ouAswEcQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DB.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\p:	Öåðáåð.exe
File opened (read-only)	\??\t:	Öåðáåð.exe
File opened (read-only)	\??\w:	Öåðáåð.exe
File opened (read-only)	\??\J:	5.exe
File opened (read-only)	\??\O:	5.exe
File opened (read-only)	\??\e:	Öåðáåð.exe
File opened (read-only)	\??\f:	Öåðáåð.exe
File opened (read-only)	\??\V:	5.exe
File opened (read-only)	\??\x:	Öåðáåð.exe
File opened (read-only)	\??\K:	5.exe
File opened (read-only)	\??\G:	5.exe
File opened (read-only)	\??\I:	5.exe
File opened (read-only)	\??\R:	5.exe
File opened (read-only)	\??\Z:	5.exe
File opened (read-only)	\??\a:	Öåðáåð.exe
File opened (read-only)	\??\z:	Öåðáåð.exe
File opened (read-only)	\??\M:	5.exe
File opened (read-only)	\??\N:	5.exe
File opened (read-only)	\??\P:	5.exe
File opened (read-only)	\??\U:	5.exe
File opened (read-only)	\??\g:	Öåðáåð.exe
File opened (read-only)	\??\m:	Öåðáåð.exe
File opened (read-only)	\??\q:	Öåðáåð.exe
File opened (read-only)	\??\u:	Öåðáåð.exe
File opened (read-only)	\??\H:	5.exe
File opened (read-only)	\??\T:	5.exe
File opened (read-only)	\??\k:	Öåðáåð.exe
File opened (read-only)	\??\n:	Öåðáåð.exe
File opened (read-only)	\??\i:	Öåðáåð.exe
File opened (read-only)	\??\o:	Öåðáåð.exe
File opened (read-only)	\??\y:	Öåðáåð.exe
File opened (read-only)	\??\E:	5.exe
File opened (read-only)	\??\L:	5.exe
File opened (read-only)	\??\Q:	5.exe
File opened (read-only)	\??\b:	Öåðáåð.exe
File opened (read-only)	\??\h:	Öåðáåð.exe
File opened (read-only)	\??\X:	5.exe
File opened (read-only)	\??\F:	5.exe
File opened (read-only)	\??\W:	5.exe
File opened (read-only)	\??\Y:	5.exe
File opened (read-only)	\??\r:	Öåðáåð.exe
File opened (read-only)	\??\v:	Öåðáåð.exe
File opened (read-only)	\??\s:	Öåðáåð.exe
File opened (read-only)	\??\S:	5.exe
File opened (read-only)	\??\j:	Öåðáåð.exe
File opened (read-only)	\??\l:	Öåðáåð.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5.exe
File opened for modification	\??\physicaldrive0	SB.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MP43DECDO.exe	DB.EXE
File opened for modification	C:\Windows\SysWOW64\MP43DECDO.exe	DB.EXE

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	Øèôðîâùèê.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\47D6.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4652	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 15 IoCs

Modify Registry

pid	Process
1448	reg.exe
4668	reg.exe
852	reg.exe
3996	reg.exe
2724	reg.exe
2508	reg.exe
1912	reg.exe
3304	reg.exe
4440	reg.exe
4928	reg.exe
4852	reg.exe
2932	reg.exe
660	reg.exe
4604	reg.exe
672	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D	AV.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D\Blob = 03000000010000001400000030530a0c86edb1cd5a2a5fe37ef3bf28e69be16d2000000001000000b3020000308202af308202180209009168978ee53f5964300d06092a864886f70d010105050030819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d301e170d3131303931383131313834395a170d3132303931373131313834395a30819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cac8419346518527133fdefd7982ac3919f1d6e2f815ecab0b5d219ccf843885645cfd9c35cae2eff8e7506e690b52c587a59c8d667cb671454030bd370fa334b18afb5ea4f4f819a36685a705a8543f320af913ca680a1d32a402db6d3e42d93228e44ba230fda524d490ddc35b922f23d36d95417136ac50afa567e21359350203010001300d06092a864886f70d0101050500038181003c6a7f43ca2cee1caafee88b04777032a4c9d7794222537e3ebe57953198281bdbe0d3a58f7d3eb358f361848f30ad88a364cd0ae3376e6239dedb01497d52d3dd55e78e49375373419ad7e5e2e036f713bf4d96a552f2aa26b35b66d7a83fb2a9b6e317d162d8342f09ccc71b2a1c7d9474ca7872bfa4acd623d61c4491d740	AV.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4720	Øèôðîâùèê4.exe
4720	Øèôðîâùèê4.exe
4720	Øèôðîâùèê4.exe
4720	Øèôðîâùèê4.exe
1272	Øèôðîâùèê4.exe
1272	Øèôðîâùèê4.exe
1272	Øèôðîâùèê4.exe
1272	Øèôðîâùèê4.exe
4780	Øèôðîâùèê4.exe
4780	Øèôðîâùèê4.exe
4780	Øèôðîâùèê4.exe
4780	Øèôðîâùèê4.exe
1696	rundll32.exe
1696	rundll32.exe
1696	rundll32.exe
1696	rundll32.exe
1364	DB.EXE
1364	DB.EXE
1364	DB.EXE
1364	DB.EXE
224	Øèôðîâùèê4.exe
224	Øèôðîâùèê4.exe
224	Øèôðîâùèê4.exe
224	Øèôðîâùèê4.exe
4308	Øèôðîâùèê4.exe
4308	Øèôðîâùèê4.exe
4308	Øèôðîâùèê4.exe
4308	Øèôðîâùèê4.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1696	rundll32.exe
Token: SeDebugPrivilege	1696	rundll32.exe
Token: SeTcbPrivilege	1696	rundll32.exe
Token: SeDebugPrivilege	1364	DB.EXE
Token: SeShutdownPrivilege	1736	SB.EXE
Token: SeIncBasePriorityPrivilege	1692	EN.EXE
Token: SeShutdownPrivilege	1184	Öåðáåð.exe
Token: SeCreatePagefilePrivilege	1184	Öåðáåð.exe
Token: SeDebugPrivilege	912	47D6.tmp

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1936	2.exe
1936	2.exe
1936	2.exe
5084	3.exe
5084	3.exe
5084	3.exe
5084	3.exe
2660	5.exe
2660	5.exe
2660	5.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1936	2.exe
1936	2.exe
1936	2.exe
5084	3.exe
5084	3.exe
5084	3.exe
5084	3.exe
2660	5.exe
2660	5.exe
2660	5.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1636	OpenWith.exe
2660	5.exe
2660	5.exe
4760	MP43DECDO.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4720	2576	launcher.exe	81
PID 2576 wrote to memory of 4720	2576	launcher.exe	81
PID 2576 wrote to memory of 4720	2576	launcher.exe	81
PID 2576 wrote to memory of 4496	2576	launcher.exe	82
PID 2576 wrote to memory of 4496	2576	launcher.exe	82
PID 2576 wrote to memory of 4496	2576	launcher.exe	82
PID 2576 wrote to memory of 728	2576	launcher.exe	84
PID 2576 wrote to memory of 728	2576	launcher.exe	84
PID 2576 wrote to memory of 728	2576	launcher.exe	84
PID 4720 wrote to memory of 1656	4720	Øèôðîâùèê4.exe	85
PID 4720 wrote to memory of 1656	4720	Øèôðîâùèê4.exe	85
PID 4720 wrote to memory of 1656	4720	Øèôðîâùèê4.exe	85
PID 4720 wrote to memory of 4452	4720	Øèôðîâùèê4.exe	87
PID 4720 wrote to memory of 4452	4720	Øèôðîâùèê4.exe	87
PID 4720 wrote to memory of 4452	4720	Øèôðîâùèê4.exe	87
PID 4720 wrote to memory of 4348	4720	Øèôðîâùèê4.exe	88
PID 4720 wrote to memory of 4348	4720	Øèôðîâùèê4.exe	88
PID 4720 wrote to memory of 4348	4720	Øèôðîâùèê4.exe	88
PID 4720 wrote to memory of 1448	4720	Øèôðîâùèê4.exe	90
PID 4720 wrote to memory of 1448	4720	Øèôðîâùèê4.exe	90
PID 4720 wrote to memory of 1448	4720	Øèôðîâùèê4.exe	90
PID 4720 wrote to memory of 852	4720	Øèôðîâùèê4.exe	93
PID 4720 wrote to memory of 852	4720	Øèôðîâùèê4.exe	93
PID 4720 wrote to memory of 852	4720	Øèôðîâùèê4.exe	93
PID 4720 wrote to memory of 4668	4720	Øèôðîâùèê4.exe	92
PID 4720 wrote to memory of 4668	4720	Øèôðîâùèê4.exe	92
PID 4720 wrote to memory of 4668	4720	Øèôðîâùèê4.exe	92
PID 4720 wrote to memory of 912	4720	Øèôðîâùèê4.exe	96
PID 4720 wrote to memory of 912	4720	Øèôðîâùèê4.exe	96
PID 4720 wrote to memory of 912	4720	Øèôðîâùèê4.exe	96
PID 4348 wrote to memory of 1272	4348	cmd.exe	98
PID 4348 wrote to memory of 1272	4348	cmd.exe	98
PID 4348 wrote to memory of 1272	4348	cmd.exe	98
PID 912 wrote to memory of 224	912	cmd.exe	133
PID 912 wrote to memory of 224	912	cmd.exe	133
PID 912 wrote to memory of 224	912	cmd.exe	133
PID 1272 wrote to memory of 936	1272	Øèôðîâùèê4.exe	100
PID 1272 wrote to memory of 936	1272	Øèôðîâùèê4.exe	100
PID 1272 wrote to memory of 936	1272	Øèôðîâùèê4.exe	100
PID 2576 wrote to memory of 1936	2576	launcher.exe	102
PID 2576 wrote to memory of 1936	2576	launcher.exe	102
PID 2576 wrote to memory of 1936	2576	launcher.exe	102
PID 1272 wrote to memory of 1912	1272	Øèôðîâùèê4.exe	104
PID 1272 wrote to memory of 1912	1272	Øèôðîâùèê4.exe	104
PID 1272 wrote to memory of 1912	1272	Øèôðîâùèê4.exe	104
PID 1272 wrote to memory of 3996	1272	Øèôðîâùèê4.exe	105
PID 1272 wrote to memory of 3996	1272	Øèôðîâùèê4.exe	105
PID 1272 wrote to memory of 3996	1272	Øèôðîâùèê4.exe	105
PID 2576 wrote to memory of 5084	2576	launcher.exe	111
PID 2576 wrote to memory of 5084	2576	launcher.exe	111
PID 2576 wrote to memory of 5084	2576	launcher.exe	111
PID 1272 wrote to memory of 4928	1272	Øèôðîâùèê4.exe	107
PID 1272 wrote to memory of 4928	1272	Øèôðîâùèê4.exe	107
PID 1272 wrote to memory of 4928	1272	Øèôðîâùèê4.exe	107
PID 1272 wrote to memory of 3696	1272	Øèôðîâùèê4.exe	108
PID 1272 wrote to memory of 3696	1272	Øèôðîâùèê4.exe	108
PID 1272 wrote to memory of 3696	1272	Øèôðîâùèê4.exe	108
PID 2576 wrote to memory of 2660	2576	launcher.exe	112
PID 2576 wrote to memory of 2660	2576	launcher.exe	112
PID 2576 wrote to memory of 2660	2576	launcher.exe	112
PID 2576 wrote to memory of 1184	2576	launcher.exe	117
PID 2576 wrote to memory of 1184	2576	launcher.exe	117
PID 2576 wrote to memory of 1184	2576	launcher.exe	117
PID 2576 wrote to memory of 4652	2576	launcher.exe	114

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Users\Admin\CKUIgcIw\beIEQoYA.exe
    "C:\Users\Admin\CKUIgcIw\beIEQoYA.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1656
- - C:\ProgramData\MSUEIUQc\ouAswEcQ.exe
    "C:\ProgramData\MSUEIUQc\ouAswEcQ.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
      C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        5⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1912
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:3996
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        UAC bypass
        Modifies registry key
        
        PID:4928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EAkEsAgM.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        5⤵
        
        PID:3696
      - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        6⤵
        
        PID:2932
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies registry key
    PID:1448
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:4668
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWsEQQAg.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1.cmd" "
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\3.exe
  "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5084
- C:\Users\Admin\AppData\Local\Temp\5.exe
  "C:\Users\Admin\AppData\Local\Temp\5.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4652
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1861168703 && exit"
      4⤵
      PID:1960
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1861168703 && exit"
        5⤵
        Creates scheduled task(s)
        
        PID:4652
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:02:00
      4⤵
      PID:532
  - - C:\Windows\47D6.tmp
      "C:\Windows\47D6.tmp" \\.\pipe\{3AD67310-CB74-4DC7-B2BF-06F1CE53AD0F}
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:912
- C:\Users\Admin\AppData\Local\Temp\Öåðáåð.exe
  "C:\Users\Admin\AppData\Local\Temp\Öåðáåð.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:1916
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:2208
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê2.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê2.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\AV.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\DB.EXE
    "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
  - - C:\Windows\SysWOW64\MP43DECDO.exe
      C:\Windows\SysWOW64\MP43DECDO.exe
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4760
  - - C:\Windows\SysWOW64\cmd.exe
      /c C:\Users\Admin\AppData\Local\Temp\~unins1437.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
      4⤵
      PID:4020
- - C:\Users\Admin\AppData\Local\Temp\EN.EXE
    "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul
      4⤵
      PID:488
- - C:\Users\Admin\AppData\Local\Temp\AV2.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
    3⤵
    - Executes dropped EXE
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\SB.EXE
    "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê3.exe
  "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê3.exe"
  2⤵
  - Executes dropped EXE
  PID:2908

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
1⤵
PID:1980
- C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
  C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
    3⤵
    PID:784
  - - C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe
      C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4308
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4"
        5⤵
        
        PID:552
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:4604
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:672
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4440
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eoswcUAo.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
        5⤵
        
        PID:1112
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:4852
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:2932
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQQIsMQs.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
    3⤵
    PID:452

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2724

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- UAC bypass
- Modifies registry key
PID:3304

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Delete /F /TN rhaegal
1⤵
PID:4628
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /F /TN rhaegal
  2⤵
  PID:3996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SiAIIkQc.bat" "C:\Users\Admin\AppData\Local\Temp\Øèôðîâùèê4.exe""
1⤵
PID:1464
- C:\Windows\SysWOW64\cscript.exe
  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
  2⤵
  PID:1172

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4592 -ip 4592
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Bootkit

T1067

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery