amadey | 7cd7bf6e8ec89fecb6efbad8f40556bd1e2433b58864cec67c216bbd0bacee74

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
1988	bcdedit.exe
2856	bcdedit.exe
1960	bcdedit.exe
916	bcdedit.exe
2240	bcdedit.exe
332	bcdedit.exe
2220	bcdedit.exe
3032	bcdedit.exe
2604	bcdedit.exe
2396	bcdedit.exe
1444	bcdedit.exe
2492	bcdedit.exe
2896	bcdedit.exe
3052	bcdedit.exe

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
1480	netsh.exe
2436	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 11 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HGQJHm3cInZy1j9daMxLAErb.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5DAoIKWfBJQG4PheDxx6CxX.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phIXkuvhkK1KInL3ZrRadrB5.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I3fnm7Dd2s1XmXMHMv6rxErx.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aZgzbtirFgzg1SRIHIdx7fL1.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fAnGvVYXmr4lj1VcKxIFmXZC.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c1AXjLLXIrkZoxVjcDjXOY0F.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5vBTZGygm2PpdkZiUvBXByQ9.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zZcMMSfsCpKHODKgh9J7PIZ5.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IbnLZo1i3vW4hNZUmHtWmLsw.bat	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K8yEC4Z7s0W048yq1jrStbYX.bat	vbc.exe

Executes dropped EXE 11 IoCs

pid	Process
1856	yit2tN3xMPe86OmSVI2KJppc.exe
1220	DaGR4Uxq9gSHb12Sj5N8TlmA.exe
824	nhdues.exe
1580	9QozS80bxFzCTZHyV59uQdov.exe
1624	NKiIFq8krWGLm291I9ajQ0og.exe
1728	6FDowSruIWtc4OjY4zFD1cNV.exe
2876	1z3I1FwRWcTRNco4H2qoGYqP.exe
2148	n74btJDL7B1ZG1YPoibClFWu.exe
1564	FwluabbDaeMpfgVhK7m7PXqF.exe
2616	4Lqbaj4YR3sWvhmcJ1u0dhj9.exe
1068	jNOBSkYkcahCLlI2QimWMq7u.exe

Loads dropped DLL 19 IoCs

pid	Process
2672	vbc.exe
1856	yit2tN3xMPe86OmSVI2KJppc.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
2148	n74btJDL7B1ZG1YPoibClFWu.exe
2672	vbc.exe
2672	vbc.exe
2148	n74btJDL7B1ZG1YPoibClFWu.exe
2672	vbc.exe
2672	vbc.exe
2672	vbc.exe
1564	FwluabbDaeMpfgVhK7m7PXqF.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000018fa2-258.dat	upx
behavioral1/files/0x0005000000018fa2-263.dat	upx
behavioral1/files/0x0005000000018fa2-260.dat	upx
behavioral1/memory/2148-267-0x0000000000970000-0x0000000000EBD000-memory.dmp	upx
behavioral1/memory/2148-470-0x0000000000970000-0x0000000000EBD000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 924 set thread context of 2672	924	file.exe	31

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2752	sc.exe
2688	sc.exe
2276	sc.exe
2936	sc.exe
2484	sc.exe
1708	sc.exe
1976	sc.exe
1888	sc.exe
1752	sc.exe
2872	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3032	schtasks.exe
944	schtasks.exe
1444	schtasks.exe
2232	schtasks.exe
1532	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2484	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
924	file.exe
2736	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	file.exe
Token: SeDebugPrivilege	2672	vbc.exe
Token: SeDebugPrivilege	2736	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2736	924	file.exe	28
PID 924 wrote to memory of 2736	924	file.exe	28
PID 924 wrote to memory of 2736	924	file.exe	28
PID 924 wrote to memory of 2736	924	file.exe	28
PID 924 wrote to memory of 2656	924	file.exe	30
PID 924 wrote to memory of 2656	924	file.exe	30
PID 924 wrote to memory of 2656	924	file.exe	30
PID 924 wrote to memory of 2656	924	file.exe	30
PID 924 wrote to memory of 2656	924	file.exe	30
PID 924 wrote to memory of 2656	924	file.exe	30
PID 924 wrote to memory of 2656	924	file.exe	30
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 924 wrote to memory of 2672	924	file.exe	31
PID 2672 wrote to memory of 1856	2672	vbc.exe	32
PID 2672 wrote to memory of 1856	2672	vbc.exe	32
PID 2672 wrote to memory of 1856	2672	vbc.exe	32
PID 2672 wrote to memory of 1856	2672	vbc.exe	32
PID 1856 wrote to memory of 824	1856	yit2tN3xMPe86OmSVI2KJppc.exe	33
PID 1856 wrote to memory of 824	1856	yit2tN3xMPe86OmSVI2KJppc.exe	33
PID 1856 wrote to memory of 824	1856	yit2tN3xMPe86OmSVI2KJppc.exe	33
PID 1856 wrote to memory of 824	1856	yit2tN3xMPe86OmSVI2KJppc.exe	33
PID 2672 wrote to memory of 1220	2672	vbc.exe	34
PID 2672 wrote to memory of 1220	2672	vbc.exe	34
PID 2672 wrote to memory of 1220	2672	vbc.exe	34
PID 2672 wrote to memory of 1220	2672	vbc.exe	34
PID 2672 wrote to memory of 1624	2672	vbc.exe	49
PID 2672 wrote to memory of 1624	2672	vbc.exe	49
PID 2672 wrote to memory of 1624	2672	vbc.exe	49
PID 2672 wrote to memory of 1624	2672	vbc.exe	49
PID 2672 wrote to memory of 1580	2672	vbc.exe	48
PID 2672 wrote to memory of 1580	2672	vbc.exe	48
PID 2672 wrote to memory of 1580	2672	vbc.exe	48
PID 2672 wrote to memory of 1580	2672	vbc.exe	48
PID 2672 wrote to memory of 1728	2672	vbc.exe	47
PID 2672 wrote to memory of 1728	2672	vbc.exe	47
PID 2672 wrote to memory of 1728	2672	vbc.exe	47
PID 2672 wrote to memory of 1728	2672	vbc.exe	47
PID 2672 wrote to memory of 2876	2672	vbc.exe	35
PID 2672 wrote to memory of 2876	2672	vbc.exe	35
PID 2672 wrote to memory of 2876	2672	vbc.exe	35
PID 2672 wrote to memory of 2876	2672	vbc.exe	35
PID 824 wrote to memory of 3032	824	nhdues.exe	46
PID 824 wrote to memory of 3032	824	nhdues.exe	46
PID 824 wrote to memory of 3032	824	nhdues.exe	46
PID 824 wrote to memory of 3032	824	nhdues.exe	46
PID 2672 wrote to memory of 2148	2672	vbc.exe	37
PID 2672 wrote to memory of 2148	2672	vbc.exe	37
PID 2672 wrote to memory of 2148	2672	vbc.exe	37
PID 2672 wrote to memory of 2148	2672	vbc.exe	37
PID 2672 wrote to memory of 2148	2672	vbc.exe	37
PID 2672 wrote to memory of 2148	2672	vbc.exe	37
PID 2672 wrote to memory of 2148	2672	vbc.exe	37
PID 824 wrote to memory of 688	824	nhdues.exe	42
PID 824 wrote to memory of 688	824	nhdues.exe	42
PID 824 wrote to memory of 688	824	nhdues.exe	42
PID 824 wrote to memory of 688	824	nhdues.exe	42
PID 2672 wrote to memory of 1564	2672	vbc.exe	39

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\Pictures\yit2tN3xMPe86OmSVI2KJppc.exe
    "C:\Users\Admin\Pictures\yit2tN3xMPe86OmSVI2KJppc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
      "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "Admin:N"&&CACLS "nhdues.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "Admin:N"&&CACLS "..\1ff8bec27e" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:688
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:R" /E
        6⤵
        
        PID:2512
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:N"
        6⤵
        
        PID:2480
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2464
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:R" /E
        6⤵
        
        PID:2516
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3032
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        5⤵
        
        PID:2356
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        6⤵
        
        PID:1276
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\clip64.dll, Main
        5⤵
        
        PID:2460
- - C:\Users\Admin\Pictures\DaGR4Uxq9gSHb12Sj5N8TlmA.exe
    "C:\Users\Admin\Pictures\DaGR4Uxq9gSHb12Sj5N8TlmA.exe"
    3⤵
    - Executes dropped EXE
    PID:1220
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\8447885564.exe"
      4⤵
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\8447885564.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8447885564.exe"
        5⤵
        
        PID:2088
      - C:\Windows\syswow64\rundll32.exe
        
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61 C:\Users\Admin\AppData\Local\Temp\8447885564.exe
        6⤵
        
        PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "DaGR4Uxq9gSHb12Sj5N8TlmA.exe" /f & erase "C:\Users\Admin\Pictures\DaGR4Uxq9gSHb12Sj5N8TlmA.exe" & exit
      4⤵
      PID:2192
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "DaGR4Uxq9gSHb12Sj5N8TlmA.exe" /f
        5⤵
        Kills process with taskkill
        
        PID:2484
- - C:\Users\Admin\Pictures\1z3I1FwRWcTRNco4H2qoGYqP.exe
    "C:\Users\Admin\Pictures\1z3I1FwRWcTRNco4H2qoGYqP.exe"
    3⤵
    - Executes dropped EXE
    PID:2876
- - C:\Users\Admin\Pictures\n74btJDL7B1ZG1YPoibClFWu.exe
    "C:\Users\Admin\Pictures\n74btJDL7B1ZG1YPoibClFWu.exe" --silent --allusers=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2148
- - C:\Users\Admin\Pictures\FwluabbDaeMpfgVhK7m7PXqF.exe
    "C:\Users\Admin\Pictures\FwluabbDaeMpfgVhK7m7PXqF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\is-RCM9E.tmp\FwluabbDaeMpfgVhK7m7PXqF.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RCM9E.tmp\FwluabbDaeMpfgVhK7m7PXqF.tmp" /SL5="$201B8,491750,408064,C:\Users\Admin\Pictures\FwluabbDaeMpfgVhK7m7PXqF.exe"
      4⤵
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\is-ED5F3.tmp\8758677____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-ED5F3.tmp\8758677____.exe" /S /UID=lylal220
        5⤵
        
        PID:1672
      - C:\Program Files\DVD Maker\SKBJTVQHAH\lightcleaner.exe
        
        "C:\Program Files\DVD Maker\SKBJTVQHAH\lightcleaner.exe" /VERYSILENT
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\is-5JLR5.tmp\lightcleaner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-5JLR5.tmp\lightcleaner.tmp" /SL5="$D01C6,833775,56832,C:\Program Files\DVD Maker\SKBJTVQHAH\lightcleaner.exe" /VERYSILENT
        7⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\8e-fd121-192-bcf94-36eaa3f06daa0\Nuhokytine.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8e-fd121-192-bcf94-36eaa3f06daa0\Nuhokytine.exe"
        6⤵
        
        PID:2752
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 384
        7⤵
        
        PID:1616
- - C:\Users\Admin\Pictures\jNOBSkYkcahCLlI2QimWMq7u.exe
    "C:\Users\Admin\Pictures\jNOBSkYkcahCLlI2QimWMq7u.exe"
    3⤵
    - Executes dropped EXE
    PID:1068
  - - C:\Users\Admin\Pictures\jNOBSkYkcahCLlI2QimWMq7u.exe
      "C:\Users\Admin\Pictures\jNOBSkYkcahCLlI2QimWMq7u.exe"
      4⤵
      PID:1820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:936
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2436
- - C:\Users\Admin\Pictures\4Lqbaj4YR3sWvhmcJ1u0dhj9.exe
    "C:\Users\Admin\Pictures\4Lqbaj4YR3sWvhmcJ1u0dhj9.exe"
    3⤵
    - Executes dropped EXE
    PID:2616
- - C:\Users\Admin\Pictures\6FDowSruIWtc4OjY4zFD1cNV.exe
    "C:\Users\Admin\Pictures\6FDowSruIWtc4OjY4zFD1cNV.exe"
    3⤵
    - Executes dropped EXE
    PID:1728
- - C:\Users\Admin\Pictures\9QozS80bxFzCTZHyV59uQdov.exe
    "C:\Users\Admin\Pictures\9QozS80bxFzCTZHyV59uQdov.exe"
    3⤵
    - Executes dropped EXE
    PID:1580
- - C:\Users\Admin\Pictures\NKiIFq8krWGLm291I9ajQ0og.exe
    "C:\Users\Admin\Pictures\NKiIFq8krWGLm291I9ajQ0og.exe"
    3⤵
    - Executes dropped EXE
    PID:1624
  - - C:\Users\Admin\Pictures\NKiIFq8krWGLm291I9ajQ0og.exe
      "C:\Users\Admin\Pictures\NKiIFq8krWGLm291I9ajQ0og.exe"
      4⤵
      PID:2392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1960
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1480
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:2844
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2232
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
        6⤵
        
        PID:1656
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1988
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2856
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1960
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:916
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2240
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:332
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2220
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:3032
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2604
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2396
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1444
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2492
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2896
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\Sysnative\bcdedit.exe /v
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        6⤵
        
        PID:1724
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1532

C:\Windows\SysWOW64\cacls.exe
CACLS "nhdues.exe" /P "Admin:N"
1⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
1⤵
PID:2400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2180

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:992
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2936
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2872
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2752
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:2688
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:2484

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:2480

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:2580
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:2888
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:2220
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:1160
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:2988

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xyvvnnvseiqa.xml"
1⤵
- Creates scheduled task(s)
PID:944

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:2772

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:2020

C:\Windows\system32\taskeng.exe
taskeng.exe {ED9CF3EE-59A6-4225-BED1-8C55DE4AAC3E} S-1-5-21-3185155662-718608226-894467740-1000:YETUIZPU\Admin:Interactive:[1]
1⤵
PID:1816
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
  2⤵
  PID:2988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2492

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:1080
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1708
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1976
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2276
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:1888
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:1752

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:2740
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:2836
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:868
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:2476
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:2704

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\xyvvnnvseiqa.xml"
1⤵
- Creates scheduled task(s)
PID:1444

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231005083517.log C:\Windows\Logs\CBS\CbsPersist_20231005083517.cab
1⤵
PID:2236

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
PID:2468

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry