sality | 811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	Image Converter.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Image Converter.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Image Converter.exe

Executes dropped EXE 3 IoCs

pid	Process
4156	m.exe
3100	Image Converter.exe
3828	RCIC.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3100-138-0x0000000002360000-0x00000000033EE000-memory.dmp	upx
behavioral2/memory/3100-140-0x0000000002360000-0x00000000033EE000-memory.dmp	upx
behavioral2/memory/3100-177-0x0000000002360000-0x00000000033EE000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Image Converter.exe

Loads dropped DLL 1 IoCs

pid	Process
3828	RCIC.exe

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Image Converter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	Image Converter.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Image Converter.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Image Converter.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	m.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	m.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	Image Converter.exe
File opened (read-only)	\??\O:	Image Converter.exe
File opened (read-only)	\??\S:	Image Converter.exe
File opened (read-only)	\??\W:	Image Converter.exe
File opened (read-only)	\??\X:	Image Converter.exe
File opened (read-only)	\??\E:	Image Converter.exe
File opened (read-only)	\??\G:	Image Converter.exe
File opened (read-only)	\??\R:	Image Converter.exe
File opened (read-only)	\??\U:	Image Converter.exe
File opened (read-only)	\??\Y:	Image Converter.exe
File opened (read-only)	\??\F:	Image Converter.exe
File opened (read-only)	\??\J:	Image Converter.exe
File opened (read-only)	\??\N:	Image Converter.exe
File opened (read-only)	\??\Z:	Image Converter.exe
File opened (read-only)	\??\I:	Image Converter.exe
File opened (read-only)	\??\K:	Image Converter.exe
File opened (read-only)	\??\P:	Image Converter.exe
File opened (read-only)	\??\Q:	Image Converter.exe
File opened (read-only)	\??\T:	Image Converter.exe
File opened (read-only)	\??\V:	Image Converter.exe
File opened (read-only)	\??\H:	Image Converter.exe
File opened (read-only)	\??\M:	Image Converter.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	Image Converter.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	Image Converter.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	Image Converter.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	Image Converter.exe
File opened for modification	C:\Windows\assembly	m.exe
File created	C:\Windows\assembly\Desktop.ini	m.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	m.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe
3100	Image Converter.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe
Token: SeDebugPrivilege	3100	Image Converter.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 4156	1028	811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe	84
PID 1028 wrote to memory of 4156	1028	811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe	84
PID 1028 wrote to memory of 4156	1028	811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe	84
PID 1028 wrote to memory of 3100	1028	811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe	86
PID 1028 wrote to memory of 3100	1028	811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe	86
PID 1028 wrote to memory of 3100	1028	811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe	86
PID 3100 wrote to memory of 776	3100	Image Converter.exe	8
PID 3100 wrote to memory of 768	3100	Image Converter.exe	80
PID 3100 wrote to memory of 1020	3100	Image Converter.exe	11
PID 3100 wrote to memory of 2452	3100	Image Converter.exe	59
PID 3100 wrote to memory of 2468	3100	Image Converter.exe	58
PID 3100 wrote to memory of 2768	3100	Image Converter.exe	51
PID 3100 wrote to memory of 2720	3100	Image Converter.exe	49
PID 3100 wrote to memory of 3012	3100	Image Converter.exe	48
PID 3100 wrote to memory of 3252	3100	Image Converter.exe	47
PID 3100 wrote to memory of 3344	3100	Image Converter.exe	46
PID 3100 wrote to memory of 3412	3100	Image Converter.exe	45
PID 3100 wrote to memory of 3496	3100	Image Converter.exe	44
PID 3100 wrote to memory of 3696	3100	Image Converter.exe	43
PID 3100 wrote to memory of 4560	3100	Image Converter.exe	40
PID 3100 wrote to memory of 5040	3100	Image Converter.exe	23
PID 3100 wrote to memory of 4156	3100	Image Converter.exe	84
PID 3100 wrote to memory of 4156	3100	Image Converter.exe	84
PID 3100 wrote to memory of 3828	3100	Image Converter.exe	87
PID 3100 wrote to memory of 3828	3100	Image Converter.exe	87
PID 3100 wrote to memory of 3828	3100	Image Converter.exe	87
PID 4156 wrote to memory of 3628	4156	m.exe	88
PID 4156 wrote to memory of 3628	4156	m.exe	88
PID 4156 wrote to memory of 3628	4156	m.exe	88
PID 3628 wrote to memory of 4268	3628	csc.exe	90
PID 3628 wrote to memory of 4268	3628	csc.exe	90
PID 3628 wrote to memory of 4268	3628	csc.exe	90
PID 4156 wrote to memory of 2244	4156	m.exe	91
PID 4156 wrote to memory of 2244	4156	m.exe	91
PID 4156 wrote to memory of 2244	4156	m.exe	91
PID 2244 wrote to memory of 3608	2244	csc.exe	93
PID 2244 wrote to memory of 3608	2244	csc.exe	93
PID 2244 wrote to memory of 3608	2244	csc.exe	93
PID 4156 wrote to memory of 1612	4156	m.exe	94
PID 4156 wrote to memory of 1612	4156	m.exe	94
PID 4156 wrote to memory of 1612	4156	m.exe	94
PID 1612 wrote to memory of 2104	1612	csc.exe	96
PID 1612 wrote to memory of 2104	1612	csc.exe	96
PID 1612 wrote to memory of 2104	1612	csc.exe	96
PID 4156 wrote to memory of 896	4156	m.exe	97
PID 4156 wrote to memory of 896	4156	m.exe	97
PID 4156 wrote to memory of 896	4156	m.exe	97
PID 896 wrote to memory of 4452	896	csc.exe	99
PID 896 wrote to memory of 4452	896	csc.exe	99
PID 896 wrote to memory of 4452	896	csc.exe	99
PID 3100 wrote to memory of 776	3100	Image Converter.exe	8
PID 3100 wrote to memory of 768	3100	Image Converter.exe	80
PID 3100 wrote to memory of 1020	3100	Image Converter.exe	11
PID 3100 wrote to memory of 2452	3100	Image Converter.exe	59
PID 3100 wrote to memory of 2468	3100	Image Converter.exe	58
PID 3100 wrote to memory of 2768	3100	Image Converter.exe	51
PID 3100 wrote to memory of 2720	3100	Image Converter.exe	49
PID 3100 wrote to memory of 3012	3100	Image Converter.exe	48
PID 3100 wrote to memory of 3252	3100	Image Converter.exe	47
PID 3100 wrote to memory of 3344	3100	Image Converter.exe	46
PID 3100 wrote to memory of 3412	3100	Image Converter.exe	45
PID 3100 wrote to memory of 3496	3100	Image Converter.exe	44
PID 3100 wrote to memory of 3696	3100	Image Converter.exe	43
PID 3100 wrote to memory of 4560	3100	Image Converter.exe	40

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Image Converter.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3496

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3412

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2720
- C:\Users\Admin\AppData\Local\Temp\811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe
  "C:\Users\Admin\AppData\Local\Temp\811324453eba163b4cb0fc7e9b66938a8afded4c9c169ceed33bd531fe038f81.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Users\tgedt\AppData\Local\Temp\m.exe
    "C:\Users\tgedt\AppData\Local\Temp\m.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jwxuhrqw.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3628
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47B8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC47A8.tmp"
        5⤵
        
        PID:4268
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qasgxs50.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AF4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4AF3.tmp"
        5⤵
        
        PID:3608
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pd8t2g1o.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CAA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4CA9.tmp"
        5⤵
        
        PID:2104
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kjrvba2m.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:896
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4484
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E8E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4E7E.tmp"
        5⤵
        
        PID:4452
- - C:\Users\tgedt\AppData\Local\Temp\Image Converter.exe
    "C:\Users\tgedt\AppData\Local\Temp\Image Converter.exe"
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\RCIC.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RCIC.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3828

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2468

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2452

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery