amadey | f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	D01F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	D01F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	D01F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	D01F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	D01F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	D01F.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000700000001757c-143.dat	family_redline
behavioral1/memory/1728-145-0x0000000000230000-0x000000000028A000-memory.dmp	family_redline
behavioral1/files/0x000700000001757c-146.dat	family_redline
behavioral1/memory/1284-157-0x0000000000F60000-0x0000000000F7E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001757c-143.dat	family_sectoprat
behavioral1/files/0x000700000001757c-146.dat	family_sectoprat
behavioral1/memory/1284-157-0x0000000000F60000-0x0000000000F7E000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

pid	Process
1032	netsh.exe

Executes dropped EXE 24 IoCs

pid	Process
2264	C81F.exe
2684	C90A.exe
2688	C9A7.bat
2524	Kn8ax5LL.exe
2324	xA4CA7qI.exe
1976	CBBB.exe
2860	oS3dA3lQ.exe
2904	eO4ku8QT.exe
880	1wY70qY8.exe
1008	D01F.exe
1852	E48A.exe
308	explothe.exe
1744	171F.exe
1728	7131.exe
1232	75D4.exe
1284	7D34.exe
284	toolspub2.exe
2764	31839b57a4f11171d6abc8bbc4451ee4.exe
2200	source1.exe
2832	toolspub2.exe
324	latestX.exe
1308	explothe.exe
1228	tijvcar
2796	31839b57a4f11171d6abc8bbc4451ee4.exe

Loads dropped DLL 35 IoCs

pid	Process
2264	C81F.exe
2264	C81F.exe
2524	Kn8ax5LL.exe
2524	Kn8ax5LL.exe
2324	xA4CA7qI.exe
2324	xA4CA7qI.exe
2860	oS3dA3lQ.exe
2860	oS3dA3lQ.exe
2904	eO4ku8QT.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
2904	eO4ku8QT.exe
880	1wY70qY8.exe
2176	WerFault.exe
2176	WerFault.exe
2176	WerFault.exe
3060	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2176	WerFault.exe
2028	WerFault.exe
1852	E48A.exe
1744	171F.exe
1744	171F.exe
1744	171F.exe
1744	171F.exe
1744	171F.exe
284	toolspub2.exe
1744	171F.exe
2164	rundll32.exe
2164	rundll32.exe
2164	rundll32.exe
2164	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	D01F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	D01F.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Kn8ax5LL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	xA4CA7qI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	oS3dA3lQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	eO4ku8QT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	C81F.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 284 set thread context of 2832	284	toolspub2.exe	72
PID 2200 set thread context of 1520	2200	source1.exe	82

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Logs\CBS\CbsPersist_20231010202022.cab	makecab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1696	2296	WerFault.exe	17
3060	2684	WerFault.exe	32
2176	1976	WerFault.exe	37
2028	880	WerFault.exe	42

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2840	AppLaunch.exe
2840	AppLaunch.exe
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1264	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2840	AppLaunch.exe
2832	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeDebugPrivilege	1008	D01F.exe
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeDebugPrivilege	1232	75D4.exe
Token: SeDebugPrivilege	1284	7D34.exe
Token: SeDebugPrivilege	2200	source1.exe
Token: SeDebugPrivilege	1728	7131.exe
Token: SeShutdownPrivilege	1264	Process not Found
Token: SeDebugPrivilege	2764	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeImpersonatePrivilege	2764	31839b57a4f11171d6abc8bbc4451ee4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 2840	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	29
PID 2296 wrote to memory of 1696	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	30
PID 2296 wrote to memory of 1696	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	30
PID 2296 wrote to memory of 1696	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	30
PID 2296 wrote to memory of 1696	2296	f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe	30
PID 1264 wrote to memory of 2264	1264	Process not Found	31
PID 1264 wrote to memory of 2264	1264	Process not Found	31
PID 1264 wrote to memory of 2264	1264	Process not Found	31
PID 1264 wrote to memory of 2264	1264	Process not Found	31
PID 1264 wrote to memory of 2264	1264	Process not Found	31
PID 1264 wrote to memory of 2264	1264	Process not Found	31
PID 1264 wrote to memory of 2264	1264	Process not Found	31
PID 1264 wrote to memory of 2684	1264	Process not Found	32
PID 1264 wrote to memory of 2684	1264	Process not Found	32
PID 1264 wrote to memory of 2684	1264	Process not Found	32
PID 1264 wrote to memory of 2684	1264	Process not Found	32
PID 1264 wrote to memory of 2688	1264	Process not Found	33
PID 1264 wrote to memory of 2688	1264	Process not Found	33
PID 1264 wrote to memory of 2688	1264	Process not Found	33
PID 1264 wrote to memory of 2688	1264	Process not Found	33
PID 2688 wrote to memory of 2532	2688	C9A7.bat	35
PID 2688 wrote to memory of 2532	2688	C9A7.bat	35
PID 2688 wrote to memory of 2532	2688	C9A7.bat	35
PID 2688 wrote to memory of 2532	2688	C9A7.bat	35
PID 2264 wrote to memory of 2524	2264	C81F.exe	34
PID 2264 wrote to memory of 2524	2264	C81F.exe	34
PID 2264 wrote to memory of 2524	2264	C81F.exe	34
PID 2264 wrote to memory of 2524	2264	C81F.exe	34
PID 2264 wrote to memory of 2524	2264	C81F.exe	34
PID 2264 wrote to memory of 2524	2264	C81F.exe	34
PID 2264 wrote to memory of 2524	2264	C81F.exe	34
PID 2524 wrote to memory of 2324	2524	Kn8ax5LL.exe	38
PID 2524 wrote to memory of 2324	2524	Kn8ax5LL.exe	38
PID 2524 wrote to memory of 2324	2524	Kn8ax5LL.exe	38
PID 2524 wrote to memory of 2324	2524	Kn8ax5LL.exe	38
PID 2524 wrote to memory of 2324	2524	Kn8ax5LL.exe	38
PID 2524 wrote to memory of 2324	2524	Kn8ax5LL.exe	38
PID 2524 wrote to memory of 2324	2524	Kn8ax5LL.exe	38
PID 1264 wrote to memory of 1976	1264	Process not Found	37
PID 1264 wrote to memory of 1976	1264	Process not Found	37
PID 1264 wrote to memory of 1976	1264	Process not Found	37
PID 1264 wrote to memory of 1976	1264	Process not Found	37
PID 2324 wrote to memory of 2860	2324	xA4CA7qI.exe	39
PID 2324 wrote to memory of 2860	2324	xA4CA7qI.exe	39
PID 2324 wrote to memory of 2860	2324	xA4CA7qI.exe	39
PID 2324 wrote to memory of 2860	2324	xA4CA7qI.exe	39
PID 2324 wrote to memory of 2860	2324	xA4CA7qI.exe	39
PID 2324 wrote to memory of 2860	2324	xA4CA7qI.exe	39
PID 2324 wrote to memory of 2860	2324	xA4CA7qI.exe	39
PID 2860 wrote to memory of 2904	2860	oS3dA3lQ.exe	41
PID 2860 wrote to memory of 2904	2860	oS3dA3lQ.exe	41
PID 2860 wrote to memory of 2904	2860	oS3dA3lQ.exe	41
PID 2860 wrote to memory of 2904	2860	oS3dA3lQ.exe	41
PID 2860 wrote to memory of 2904	2860	oS3dA3lQ.exe	41
PID 2860 wrote to memory of 2904	2860	oS3dA3lQ.exe	41

C:\Users\Admin\AppData\Local\Temp\f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe
"C:\Users\Admin\AppData\Local\Temp\f73a11cee5e742b17dd04fb7ecec9a22bb2b2f3d22de2c37e376678b057d5b42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 68
  2⤵
  - Program crash
  PID:1696

C:\Users\Admin\AppData\Local\Temp\C81F.exe
C:\Users\Admin\AppData\Local\Temp\C81F.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Kn8ax5LL.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Kn8ax5LL.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xA4CA7qI.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xA4CA7qI.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oS3dA3lQ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oS3dA3lQ.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\eO4ku8QT.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\eO4ku8QT.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1wY70qY8.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1wY70qY8.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 280
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2028

C:\Users\Admin\AppData\Local\Temp\C90A.exe
C:\Users\Admin\AppData\Local\Temp\C90A.exe
1⤵
- Executes dropped EXE
PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 132
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:3060

C:\Users\Admin\AppData\Local\Temp\C9A7.bat
"C:\Users\Admin\AppData\Local\Temp\C9A7.bat"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CA13.tmp\CA14.tmp\CA15.bat C:\Users\Admin\AppData\Local\Temp\C9A7.bat"
  2⤵
  PID:2532

C:\Users\Admin\AppData\Local\Temp\CBBB.exe
C:\Users\Admin\AppData\Local\Temp\CBBB.exe
1⤵
- Executes dropped EXE
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 132
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2176

C:\Users\Admin\AppData\Local\Temp\D01F.exe
C:\Users\Admin\AppData\Local\Temp\D01F.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Users\Admin\AppData\Local\Temp\E48A.exe
C:\Users\Admin\AppData\Local\Temp\E48A.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Executes dropped EXE
  PID:308
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2084
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:320
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2392
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:564
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:2164

C:\Users\Admin\AppData\Local\Temp\171F.exe
C:\Users\Admin\AppData\Local\Temp\171F.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:284
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2832
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    PID:2796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:2644
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1032
- C:\Users\Admin\AppData\Local\Temp\source1.exe
  "C:\Users\Admin\AppData\Local\Temp\source1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1520
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  - Executes dropped EXE
  PID:324

C:\Users\Admin\AppData\Local\Temp\7131.exe
C:\Users\Admin\AppData\Local\Temp\7131.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Users\Admin\AppData\Local\Temp\75D4.exe
C:\Users\Admin\AppData\Local\Temp\75D4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Users\Admin\AppData\Local\Temp\7D34.exe
C:\Users\Admin\AppData\Local\Temp\7D34.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\taskeng.exe
taskeng.exe {D9BD0FCF-06DA-44EC-92D6-9D0F40E96AB5} S-1-5-21-3750544865-3773649541-1858556521-1000:XOCYHKRS\Admin:Interactive:[1]
1⤵
PID:292
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Users\Admin\AppData\Roaming\tijvcar
  C:\Users\Admin\AppData\Roaming\tijvcar
  2⤵
  - Executes dropped EXE
  PID:1228

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231010202022.log C:\Windows\Logs\CBS\CbsPersist_20231010202022.cab
1⤵
- Drops file in Windows directory
PID:2624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry