amadey | 8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	12D9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	12D9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	12D9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	12D9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	12D9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	12D9.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/2540-197-0x0000000000240000-0x000000000029A000-memory.dmp	family_redline
behavioral1/memory/2596-220-0x0000000001170000-0x000000000118E000-memory.dmp	family_redline
behavioral1/memory/2596-222-0x0000000004C30000-0x0000000004C70000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2596-220-0x0000000001170000-0x000000000118E000-memory.dmp	family_sectoprat
behavioral1/memory/2596-222-0x0000000004C30000-0x0000000004C70000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

pid	Process
608	netsh.exe

Executes dropped EXE 22 IoCs

pid	Process
2496	F48C.exe
2560	F5D5.exe
2060	F6A0.bat
2828	Zm0Jj5bd.exe
2172	HV9BY3SK.exe
2824	F827.exe
1704	QA4Uz6QS.exe
2152	Lf0rd5St.exe
2016	12D9.exe
1144	1yh62AZ1.exe
2864	170F.exe
2356	explothe.exe
1784	527A.exe
1928	toolspub2.exe
2440	31839b57a4f11171d6abc8bbc4451ee4.exe
2964	source1.exe
2416	toolspub2.exe
1384	latestX.exe
2540	B66B.exe
2360	BA52.exe
1732	explothe.exe
2596	C490.exe

Loads dropped DLL 39 IoCs

pid	Process
2496	F48C.exe
2496	F48C.exe
2828	Zm0Jj5bd.exe
2828	Zm0Jj5bd.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2172	HV9BY3SK.exe
2172	HV9BY3SK.exe
1704	QA4Uz6QS.exe
1704	QA4Uz6QS.exe
2152	Lf0rd5St.exe
2892	WerFault.exe
1672	WerFault.exe
1672	WerFault.exe
1672	WerFault.exe
1672	WerFault.exe
2152	Lf0rd5St.exe
1144	1yh62AZ1.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2864	170F.exe
1784	527A.exe
1784	527A.exe
1784	527A.exe
1784	527A.exe
1784	527A.exe
1928	toolspub2.exe
1784	527A.exe
2540	B66B.exe
2540	B66B.exe
2012	WerFault.exe
2012	WerFault.exe
2012	WerFault.exe
1680	WerFault.exe
1680	WerFault.exe
1680	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	12D9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	12D9.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	F48C.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Zm0Jj5bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	HV9BY3SK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	QA4Uz6QS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Lf0rd5St.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2304 set thread context of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 1928 set thread context of 2416	1928	toolspub2.exe	64

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2600	2304	WerFault.exe	21
2892	2560	WerFault.exe	33
1672	2824	WerFault.exe	42
2056	1144	WerFault.exe	44
2012	2540	WerFault.exe	72
1680	2360	WerFault.exe	76

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	AppLaunch.exe
2636	AppLaunch.exe
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1252	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2636	AppLaunch.exe
2416	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeDebugPrivilege	2016	12D9.exe
Token: SeDebugPrivilege	2964	source1.exe
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeDebugPrivilege	2596	C490.exe
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeDebugPrivilege	2440	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeImpersonatePrivilege	2440	31839b57a4f11171d6abc8bbc4451ee4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2636	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	29
PID 2304 wrote to memory of 2600	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	31
PID 2304 wrote to memory of 2600	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	31
PID 2304 wrote to memory of 2600	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	31
PID 2304 wrote to memory of 2600	2304	8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe	31
PID 1252 wrote to memory of 2496	1252	Process not Found	32
PID 1252 wrote to memory of 2496	1252	Process not Found	32
PID 1252 wrote to memory of 2496	1252	Process not Found	32
PID 1252 wrote to memory of 2496	1252	Process not Found	32
PID 1252 wrote to memory of 2496	1252	Process not Found	32
PID 1252 wrote to memory of 2496	1252	Process not Found	32
PID 1252 wrote to memory of 2496	1252	Process not Found	32
PID 1252 wrote to memory of 2560	1252	Process not Found	33
PID 1252 wrote to memory of 2560	1252	Process not Found	33
PID 1252 wrote to memory of 2560	1252	Process not Found	33
PID 1252 wrote to memory of 2560	1252	Process not Found	33
PID 1252 wrote to memory of 2060	1252	Process not Found	34
PID 1252 wrote to memory of 2060	1252	Process not Found	34
PID 1252 wrote to memory of 2060	1252	Process not Found	34
PID 1252 wrote to memory of 2060	1252	Process not Found	34
PID 2060 wrote to memory of 2680	2060	F6A0.bat	37
PID 2060 wrote to memory of 2680	2060	F6A0.bat	37
PID 2060 wrote to memory of 2680	2060	F6A0.bat	37
PID 2060 wrote to memory of 2680	2060	F6A0.bat	37
PID 2496 wrote to memory of 2828	2496	F48C.exe	35
PID 2496 wrote to memory of 2828	2496	F48C.exe	35
PID 2496 wrote to memory of 2828	2496	F48C.exe	35
PID 2496 wrote to memory of 2828	2496	F48C.exe	35
PID 2496 wrote to memory of 2828	2496	F48C.exe	35
PID 2496 wrote to memory of 2828	2496	F48C.exe	35
PID 2496 wrote to memory of 2828	2496	F48C.exe	35
PID 2560 wrote to memory of 2892	2560	F5D5.exe	36
PID 2560 wrote to memory of 2892	2560	F5D5.exe	36
PID 2560 wrote to memory of 2892	2560	F5D5.exe	36
PID 2560 wrote to memory of 2892	2560	F5D5.exe	36
PID 2828 wrote to memory of 2172	2828	Zm0Jj5bd.exe	39
PID 2828 wrote to memory of 2172	2828	Zm0Jj5bd.exe	39
PID 2828 wrote to memory of 2172	2828	Zm0Jj5bd.exe	39
PID 2828 wrote to memory of 2172	2828	Zm0Jj5bd.exe	39
PID 2828 wrote to memory of 2172	2828	Zm0Jj5bd.exe	39
PID 2828 wrote to memory of 2172	2828	Zm0Jj5bd.exe	39
PID 2828 wrote to memory of 2172	2828	Zm0Jj5bd.exe	39
PID 1252 wrote to memory of 2824	1252	Process not Found	42
PID 1252 wrote to memory of 2824	1252	Process not Found	42
PID 1252 wrote to memory of 2824	1252	Process not Found	42
PID 1252 wrote to memory of 2824	1252	Process not Found	42
PID 2172 wrote to memory of 1704	2172	HV9BY3SK.exe	40
PID 2172 wrote to memory of 1704	2172	HV9BY3SK.exe	40
PID 2172 wrote to memory of 1704	2172	HV9BY3SK.exe	40
PID 2172 wrote to memory of 1704	2172	HV9BY3SK.exe	40
PID 2172 wrote to memory of 1704	2172	HV9BY3SK.exe	40
PID 2172 wrote to memory of 1704	2172	HV9BY3SK.exe	40
PID 2172 wrote to memory of 1704	2172	HV9BY3SK.exe	40
PID 1704 wrote to memory of 2152	1704	QA4Uz6QS.exe	41
PID 1704 wrote to memory of 2152	1704	QA4Uz6QS.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe
"C:\Users\Admin\AppData\Local\Temp\8ee2524616c17d3f7a371402f909a577a462d008c5ba59370bbd8c3bfedd35f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 76
  2⤵
  - Program crash
  PID:2600

C:\Users\Admin\AppData\Local\Temp\F48C.exe
C:\Users\Admin\AppData\Local\Temp\F48C.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Zm0Jj5bd.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Zm0Jj5bd.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HV9BY3SK.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HV9BY3SK.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QA4Uz6QS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QA4Uz6QS.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Lf0rd5St.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Lf0rd5St.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1yh62AZ1.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1yh62AZ1.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 280
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2056

C:\Users\Admin\AppData\Local\Temp\F5D5.exe
C:\Users\Admin\AppData\Local\Temp\F5D5.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 132
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2892

C:\Users\Admin\AppData\Local\Temp\F6A0.bat
"C:\Users\Admin\AppData\Local\Temp\F6A0.bat"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F779.tmp\F77A.tmp\F77B.bat C:\Users\Admin\AppData\Local\Temp\F6A0.bat"
  2⤵
  PID:2680

C:\Users\Admin\AppData\Local\Temp\F827.exe
C:\Users\Admin\AppData\Local\Temp\F827.exe
1⤵
- Executes dropped EXE
PID:2824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 132
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:1672

C:\Users\Admin\AppData\Local\Temp\12D9.exe
C:\Users\Admin\AppData\Local\Temp\12D9.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Users\Admin\AppData\Local\Temp\170F.exe
C:\Users\Admin\AppData\Local\Temp\170F.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Executes dropped EXE
  PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:288
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1112
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1148
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:1016

C:\Users\Admin\AppData\Local\Temp\527A.exe
C:\Users\Admin\AppData\Local\Temp\527A.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2416
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:1296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:3064
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:608
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\source1.exe
  "C:\Users\Admin\AppData\Local\Temp\source1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1860

C:\Windows\system32\taskeng.exe
taskeng.exe {7DE211F1-8CF2-4760-9791-D4210F70EA3F} S-1-5-21-3513876443-2771975297-1923446376-1000:GPFFWLPI\Admin:Interactive:[1]
1⤵
PID:984
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  2⤵
  - Executes dropped EXE
  PID:1732

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231011053900.log C:\Windows\Logs\CBS\CbsPersist_20231011053900.cab
1⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\B66B.exe
C:\Users\Admin\AppData\Local\Temp\B66B.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 524
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2012

C:\Users\Admin\AppData\Local\Temp\BA52.exe
C:\Users\Admin\AppData\Local\Temp\BA52.exe
1⤵
- Executes dropped EXE
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 484
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:1680

C:\Users\Admin\AppData\Local\Temp\C490.exe
C:\Users\Admin\AppData\Local\Temp\C490.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry