08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell	0v3yT8.06.10.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open	0v3yT8.06.10.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	system86.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	system86.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
2380	bcdedit.exe
2568	bcdedit.exe

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

pid	Process
2192	wbadmin.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

pid	Process
4012	wbadmin.exe

Executes dropped EXE 10 IoCs

pid	Process
1472	7za.exe
380	7za.exe
1484	0v3yT8.06.10.exe
4612	system86.exe
3512	DC.exe
3200	system86.exe
2804	system86.exe
1780	system86.exe
1920	Everything.exe
2124	Everything.exe

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SelectEnable.crw.0v3yT8	system86.exe
File renamed	C:\Users\Admin\Pictures\TestSave.tif => C:\Users\Admin\Pictures\TestSave.tif.0v3yT8	system86.exe
File renamed	C:\Users\Admin\Pictures\PopDismount.png => C:\Users\Admin\Pictures\PopDismount.png.0v3yT8	system86.exe
File opened for modification	C:\Users\Admin\Pictures\PopDismount.png.0v3yT8	system86.exe
File renamed	C:\Users\Admin\Pictures\FindExport.crw => C:\Users\Admin\Pictures\FindExport.crw.0v3yT8	system86.exe
File renamed	C:\Users\Admin\Pictures\SelectEnable.crw => C:\Users\Admin\Pictures\SelectEnable.crw.0v3yT8	system86.exe
File renamed	C:\Users\Admin\Pictures\DismountSkip.raw => C:\Users\Admin\Pictures\DismountSkip.raw.0v3yT8	system86.exe
File opened for modification	C:\Users\Admin\Pictures\DismountSkip.raw.0v3yT8	system86.exe
File opened for modification	C:\Users\Admin\Pictures\TestSave.tif.0v3yT8	system86.exe
File opened for modification	C:\Users\Admin\Pictures\FindExport.crw.0v3yT8	system86.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe	system86.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	0v3yT8.06.10.exe

Loads dropped DLL 5 IoCs

pid	Process
1484	0v3yT8.06.10.exe
4612	system86.exe
3200	system86.exe
2804	system86.exe
1780	system86.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	0v3yT8.06.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system86 = "\"C:\\Users\\Admin\\AppData\\Local\\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\\system86.exe\" "	0v3yT8.06.10.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\E:	system86.exe
File opened (read-only)	\??\G:	system86.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\V:	system86.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\H:	system86.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\B:	system86.exe
File opened (read-only)	\??\J:	system86.exe
File opened (read-only)	\??\M:	system86.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\A:	system86.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\N:	system86.exe
File opened (read-only)	\??\T:	system86.exe
File opened (read-only)	\??\O:	system86.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\K:	system86.exe
File opened (read-only)	\??\X:	system86.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\L:	system86.exe
File opened (read-only)	\??\W:	system86.exe
File opened (read-only)	\??\F:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\F:	Everything.exe
File opened (read-only)	\??\F:	system86.exe
File opened (read-only)	\??\P:	system86.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\Q:	system86.exe
File opened (read-only)	\??\R:	system86.exe
File opened (read-only)	\??\S:	system86.exe
File opened (read-only)	\??\Y:	system86.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\U:	system86.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\I:	system86.exe
File opened (read-only)	\??\Z:	system86.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open	0v3yT8.06.10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\How-to-decrypt.txt\""	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.0v3yT8\ = "mimicfile"	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.0v3yT8	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile	0v3yT8.06.10.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2804	system86.exe
2804	system86.exe
1780	system86.exe
1780	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
1004	powershell.exe
972	powershell.exe
1004	powershell.exe
3800	powershell.exe
972	powershell.exe
3800	powershell.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe
4612	system86.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1472	7za.exe
Token: 35	1472	7za.exe
Token: SeRestorePrivilege	380	7za.exe
Token: 35	380	7za.exe
Token: SeSecurityPrivilege	380	7za.exe
Token: SeSecurityPrivilege	380	7za.exe
Token: SeIncreaseQuotaPrivilege	1484	0v3yT8.06.10.exe
Token: SeSecurityPrivilege	1484	0v3yT8.06.10.exe
Token: SeTakeOwnershipPrivilege	1484	0v3yT8.06.10.exe
Token: SeLoadDriverPrivilege	1484	0v3yT8.06.10.exe
Token: SeSystemProfilePrivilege	1484	0v3yT8.06.10.exe
Token: SeSystemtimePrivilege	1484	0v3yT8.06.10.exe
Token: SeProfSingleProcessPrivilege	1484	0v3yT8.06.10.exe
Token: SeIncBasePriorityPrivilege	1484	0v3yT8.06.10.exe
Token: SeCreatePagefilePrivilege	1484	0v3yT8.06.10.exe
Token: SeBackupPrivilege	1484	0v3yT8.06.10.exe
Token: SeRestorePrivilege	1484	0v3yT8.06.10.exe
Token: SeShutdownPrivilege	1484	0v3yT8.06.10.exe
Token: SeDebugPrivilege	1484	0v3yT8.06.10.exe
Token: SeSystemEnvironmentPrivilege	1484	0v3yT8.06.10.exe
Token: SeChangeNotifyPrivilege	1484	0v3yT8.06.10.exe
Token: SeRemoteShutdownPrivilege	1484	0v3yT8.06.10.exe
Token: SeUndockPrivilege	1484	0v3yT8.06.10.exe
Token: SeManageVolumePrivilege	1484	0v3yT8.06.10.exe
Token: SeImpersonatePrivilege	1484	0v3yT8.06.10.exe
Token: SeCreateGlobalPrivilege	1484	0v3yT8.06.10.exe
Token: 33	1484	0v3yT8.06.10.exe
Token: 34	1484	0v3yT8.06.10.exe
Token: 35	1484	0v3yT8.06.10.exe
Token: 36	1484	0v3yT8.06.10.exe
Token: SeIncreaseQuotaPrivilege	4612	system86.exe
Token: SeSecurityPrivilege	4612	system86.exe
Token: SeTakeOwnershipPrivilege	4612	system86.exe
Token: SeLoadDriverPrivilege	4612	system86.exe
Token: SeSystemProfilePrivilege	4612	system86.exe
Token: SeSystemtimePrivilege	4612	system86.exe
Token: SeProfSingleProcessPrivilege	4612	system86.exe
Token: SeIncBasePriorityPrivilege	4612	system86.exe
Token: SeCreatePagefilePrivilege	4612	system86.exe
Token: SeBackupPrivilege	4612	system86.exe
Token: SeRestorePrivilege	4612	system86.exe
Token: SeShutdownPrivilege	4612	system86.exe
Token: SeDebugPrivilege	4612	system86.exe
Token: SeSystemEnvironmentPrivilege	4612	system86.exe
Token: SeChangeNotifyPrivilege	4612	system86.exe
Token: SeRemoteShutdownPrivilege	4612	system86.exe
Token: SeUndockPrivilege	4612	system86.exe
Token: SeManageVolumePrivilege	4612	system86.exe
Token: SeImpersonatePrivilege	4612	system86.exe
Token: SeCreateGlobalPrivilege	4612	system86.exe
Token: 33	4612	system86.exe
Token: 34	4612	system86.exe
Token: 35	4612	system86.exe
Token: 36	4612	system86.exe
Token: SeIncreaseQuotaPrivilege	2804	system86.exe
Token: SeSecurityPrivilege	2804	system86.exe
Token: SeTakeOwnershipPrivilege	2804	system86.exe
Token: SeIncreaseQuotaPrivilege	3200	system86.exe
Token: SeSecurityPrivilege	3200	system86.exe
Token: SeTakeOwnershipPrivilege	3200	system86.exe
Token: SeLoadDriverPrivilege	2804	system86.exe
Token: SeLoadDriverPrivilege	3200	system86.exe
Token: SeSystemProfilePrivilege	3200	system86.exe
Token: SeSystemProfilePrivilege	2804	system86.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1920	Everything.exe
2124	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1472	4660	0v3yT8.06.10.exe	82
PID 4660 wrote to memory of 1472	4660	0v3yT8.06.10.exe	82
PID 4660 wrote to memory of 1472	4660	0v3yT8.06.10.exe	82
PID 4660 wrote to memory of 380	4660	0v3yT8.06.10.exe	84
PID 4660 wrote to memory of 380	4660	0v3yT8.06.10.exe	84
PID 4660 wrote to memory of 380	4660	0v3yT8.06.10.exe	84
PID 4660 wrote to memory of 1484	4660	0v3yT8.06.10.exe	86
PID 4660 wrote to memory of 1484	4660	0v3yT8.06.10.exe	86
PID 4660 wrote to memory of 1484	4660	0v3yT8.06.10.exe	86
PID 1484 wrote to memory of 4612	1484	0v3yT8.06.10.exe	91
PID 1484 wrote to memory of 4612	1484	0v3yT8.06.10.exe	91
PID 1484 wrote to memory of 4612	1484	0v3yT8.06.10.exe	91
PID 4612 wrote to memory of 4944	4612	system86.exe	94
PID 4612 wrote to memory of 4944	4612	system86.exe	94
PID 4612 wrote to memory of 4944	4612	system86.exe	94
PID 4944 wrote to memory of 3512	4944	cmd.exe	96
PID 4944 wrote to memory of 3512	4944	cmd.exe	96
PID 4944 wrote to memory of 3512	4944	cmd.exe	96
PID 4612 wrote to memory of 3200	4612	system86.exe	97
PID 4612 wrote to memory of 3200	4612	system86.exe	97
PID 4612 wrote to memory of 3200	4612	system86.exe	97
PID 4612 wrote to memory of 2804	4612	system86.exe	99
PID 4612 wrote to memory of 2804	4612	system86.exe	99
PID 4612 wrote to memory of 2804	4612	system86.exe	99
PID 4612 wrote to memory of 1780	4612	system86.exe	100
PID 4612 wrote to memory of 1780	4612	system86.exe	100
PID 4612 wrote to memory of 1780	4612	system86.exe	100
PID 4612 wrote to memory of 1920	4612	system86.exe	103
PID 4612 wrote to memory of 1920	4612	system86.exe	103
PID 4612 wrote to memory of 1920	4612	system86.exe	103
PID 4612 wrote to memory of 1260	4612	system86.exe	119
PID 4612 wrote to memory of 1260	4612	system86.exe	119
PID 4612 wrote to memory of 4944	4612	system86.exe	140
PID 4612 wrote to memory of 4944	4612	system86.exe	140
PID 4612 wrote to memory of 5088	4612	system86.exe	139
PID 4612 wrote to memory of 5088	4612	system86.exe	139
PID 4612 wrote to memory of 3772	4612	system86.exe	138
PID 4612 wrote to memory of 3772	4612	system86.exe	138
PID 4612 wrote to memory of 2060	4612	system86.exe	128
PID 4612 wrote to memory of 2060	4612	system86.exe	128
PID 4612 wrote to memory of 4584	4612	system86.exe	122
PID 4612 wrote to memory of 4584	4612	system86.exe	122
PID 4612 wrote to memory of 4852	4612	system86.exe	123
PID 4612 wrote to memory of 4852	4612	system86.exe	123
PID 4612 wrote to memory of 4664	4612	system86.exe	124
PID 4612 wrote to memory of 4664	4612	system86.exe	124
PID 4612 wrote to memory of 996	4612	system86.exe	129
PID 4612 wrote to memory of 996	4612	system86.exe	129
PID 4612 wrote to memory of 1972	4612	system86.exe	134
PID 4612 wrote to memory of 1972	4612	system86.exe	134
PID 4612 wrote to memory of 1180	4612	system86.exe	130
PID 4612 wrote to memory of 1180	4612	system86.exe	130
PID 4612 wrote to memory of 2656	4612	system86.exe	131
PID 4612 wrote to memory of 2656	4612	system86.exe	131
PID 4612 wrote to memory of 3812	4612	system86.exe	141
PID 4612 wrote to memory of 3812	4612	system86.exe	141
PID 4612 wrote to memory of 872	4612	system86.exe	153
PID 4612 wrote to memory of 872	4612	system86.exe	153
PID 4612 wrote to memory of 5096	4612	system86.exe	143
PID 4612 wrote to memory of 5096	4612	system86.exe	143
PID 4612 wrote to memory of 3800	4612	system86.exe	144
PID 4612 wrote to memory of 3800	4612	system86.exe	144
PID 4612 wrote to memory of 1004	4612	system86.exe	145
PID 4612 wrote to memory of 1004	4612	system86.exe	145

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system86.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	system86.exe

C:\Users\Admin\AppData\Local\Temp\0v3yT8.06.10.exe
"C:\Users\Admin\AppData\Local\Temp\0v3yT8.06.10.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p933916544411611201 Everything64.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe"
  2⤵
  - Modifies system executable filetype association
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
    "C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"
    3⤵
    - Modifies system executable filetype association
    - UAC bypass
    - Executes dropped EXE
    - Modifies extensions of user files
    - Sets file execution options in registry
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4612
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c DC.exe /D
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exe
        
        DC.exe /D
        5⤵
        Executes dropped EXE
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
      "C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e watch -pid 4612 -!
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3200
  - - C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
      "C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
      "C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1780
  - - C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
      "C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:1920
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -H off
      4⤵
      PID:1260
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:4584
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:4852
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:4664
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:2060
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:996
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1180
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:2656
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1972
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:3772
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:5088
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:4944
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:3812
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:972
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      PID:872
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2380
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2568
  - - C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin.exe delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:4012
  - - C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin.exe DELETE SYSTEMSTATEBACKUP
      4⤵
      Deletes System State backups
      Drops file in Windows directory
      PID:2192
  - - C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
      "C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2124

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:816

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4232

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3140

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3316

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4264

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2172

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:640

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4344

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1800

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3372

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1996

C:\Windows\system32\notepad.exe
"notepad.exe" "C:\Users\Admin\AppData\Local\How-to-decrypt.txt"
1⤵
PID:4268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3140

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2460

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery