amadey | 0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	UMM2.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\UMM2.exe = "0"	UMM2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	UMM2.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	kos1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	UMM2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	kos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	DXi53srrC0m4WdVDQo9lxoQE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	nhdues.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	JmAj2X7NP40y33jhdR622Knu.exe

Drops startup file 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dhkRvHrLF0Uh2wOP9jpNVLF4.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CnYL6ZZJb4GclDNVCew9aGh4.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ItsvH5HYHeiykLfcfqy2VvNw.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bSORoXz98Qpi87WfsexwO1Fn.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wJfiI3dFnvpDWG1kQ9V5B0mC.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DPBUV22Ip1DR2qbKma5mUJee.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1nfmT108JWfSQ3iAVA64N9nn.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7RyzTcZufffDaZtnjA0rjlQr.bat	aspnet_regbrowsers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jCxOnWecaIr35wmNKVaAXLgJ.bat	aspnet_regbrowsers.exe

Executes dropped EXE 28 IoCs

pid	Process
1364	aafg31.exe
4480	toolspub2.exe
5032	31839b57a4f11171d6abc8bbc4451ee4.exe
2028	toolspub2.exe
3636	kos1.exe
3316	UMM2.exe
4056	set16.exe
4076	kos.exe
3856	is-UJE1F.tmp
4680	previewer.exe
1876	previewer.exe
5028	DXi53srrC0m4WdVDQo9lxoQE.exe
4604	ZRYYPfnDGjXc1jzKWtcV6bHB.exe
944	k0dbtFN0VS21jkDoGYqKO0V8.exe
1072	JmAj2X7NP40y33jhdR622Knu.exe
224	C3HeT4LGS7R8c3aTHwNPijd8.exe
1764	nhdues.exe
3684	ZxVkWIL9isjif4rnRptLKTKj.exe
1052	ZeoeQe0ukkZNFpCnwGdzbVcT.exe
4584	Aep9zFJ4RlybRiSL8DzoQ2yy.exe
2052	Install.exe
956	C3HeT4LGS7R8c3aTHwNPijd8.exe
3600	C3HeT4LGS7R8c3aTHwNPijd8.exe
3844	ZxVkWIL9isjif4rnRptLKTKj.tmp
2068	C3HeT4LGS7R8c3aTHwNPijd8.exe
3144	Install.exe
3600	C3HeT4LGS7R8c3aTHwNPijd8.exe
3488	_setup64.tmp

Loads dropped DLL 10 IoCs

pid	Process
3856	is-UJE1F.tmp
3856	is-UJE1F.tmp
3856	is-UJE1F.tmp
224	C3HeT4LGS7R8c3aTHwNPijd8.exe
956	C3HeT4LGS7R8c3aTHwNPijd8.exe
3600	C3HeT4LGS7R8c3aTHwNPijd8.exe
2068	C3HeT4LGS7R8c3aTHwNPijd8.exe
3600	C3HeT4LGS7R8c3aTHwNPijd8.exe
1072	JmAj2X7NP40y33jhdR622Knu.exe
1072	JmAj2X7NP40y33jhdR622Knu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002321d-291.dat	upx
behavioral2/files/0x000600000002321d-302.dat	upx
behavioral2/files/0x000600000002321d-361.dat	upx
behavioral2/files/0x000600000002321d-378.dat	upx
behavioral2/memory/224-383-0x0000000000C40000-0x000000000118D000-memory.dmp	upx
behavioral2/memory/3600-392-0x0000000000EE0000-0x000000000142D000-memory.dmp	upx
behavioral2/files/0x000600000002321d-398.dat	upx
behavioral2/files/0x000600000002321d-410.dat	upx
behavioral2/files/0x0007000000023239-384.dat	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	UMM2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	UMM2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\UMM2.exe = "0"	UMM2.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DigitalPulse = "\"C:\\Users\\Admin\\AppData\\Roaming\\DigitalPulse\\DigitalPulseService.exe\" 5333:::clickId=:::srcId="	ZxVkWIL9isjif4rnRptLKTKj.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UMM2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	UMM2.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	C3HeT4LGS7R8c3aTHwNPijd8.exe
File opened (read-only)	\??\F:	C3HeT4LGS7R8c3aTHwNPijd8.exe
File opened (read-only)	\??\D:	C3HeT4LGS7R8c3aTHwNPijd8.exe
File opened (read-only)	\??\F:	C3HeT4LGS7R8c3aTHwNPijd8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4480 set thread context of 2028	4480	toolspub2.exe	90
PID 3316 set thread context of 400	3316	UMM2.exe	99

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-UJE1F.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-UJE1F.tmp
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-UJE1F.tmp
File created	C:\Program Files (x86)\PA Previewer\is-P8C6V.tmp	is-UJE1F.tmp
File created	C:\Program Files (x86)\PA Previewer\is-DP2U2.tmp	is-UJE1F.tmp
File created	C:\Program Files (x86)\PA Previewer\is-8CO6M.tmp	is-UJE1F.tmp
File created	C:\Program Files (x86)\PA Previewer\is-UCSS2.tmp	is-UJE1F.tmp

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6088	sc.exe
1408	sc.exe
5904	sc.exe
6056	sc.exe
6072	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6080	1072	WerFault.exe	112

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JmAj2X7NP40y33jhdR622Knu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JmAj2X7NP40y33jhdR622Knu.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4480	schtasks.exe
4652	schtasks.exe
5536	schtasks.exe
5508	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5844	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	toolspub2.exe
2028	toolspub2.exe
4276	powershell.exe
4276	powershell.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
4276	powershell.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	Explorer.EXE

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2028	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	kos.exe
Token: SeDebugPrivilege	400	aspnet_regbrowsers.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4680	previewer.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	1876	previewer.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	944	k0dbtFN0VS21jkDoGYqKO0V8.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3844	ZxVkWIL9isjif4rnRptLKTKj.tmp

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3132	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1364	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	86
PID 1564 wrote to memory of 1364	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	86
PID 1564 wrote to memory of 4480	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	87
PID 1564 wrote to memory of 4480	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	87
PID 1564 wrote to memory of 4480	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	87
PID 1564 wrote to memory of 5032	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	88
PID 1564 wrote to memory of 5032	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	88
PID 1564 wrote to memory of 5032	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	88
PID 4480 wrote to memory of 2028	4480	toolspub2.exe	90
PID 4480 wrote to memory of 2028	4480	toolspub2.exe	90
PID 4480 wrote to memory of 2028	4480	toolspub2.exe	90
PID 4480 wrote to memory of 2028	4480	toolspub2.exe	90
PID 4480 wrote to memory of 2028	4480	toolspub2.exe	90
PID 4480 wrote to memory of 2028	4480	toolspub2.exe	90
PID 1564 wrote to memory of 3636	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	91
PID 1564 wrote to memory of 3636	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	91
PID 1564 wrote to memory of 3636	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	91
PID 1564 wrote to memory of 3316	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	92
PID 1564 wrote to memory of 3316	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	92
PID 1564 wrote to memory of 3316	1564	0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe	92
PID 3636 wrote to memory of 4056	3636	kos1.exe	93
PID 3636 wrote to memory of 4056	3636	kos1.exe	93
PID 3636 wrote to memory of 4056	3636	kos1.exe	93
PID 3636 wrote to memory of 4076	3636	kos1.exe	98
PID 3636 wrote to memory of 4076	3636	kos1.exe	98
PID 4056 wrote to memory of 3856	4056	set16.exe	94
PID 4056 wrote to memory of 3856	4056	set16.exe	94
PID 4056 wrote to memory of 3856	4056	set16.exe	94
PID 3316 wrote to memory of 4276	3316	UMM2.exe	95
PID 3316 wrote to memory of 4276	3316	UMM2.exe	95
PID 3316 wrote to memory of 4276	3316	UMM2.exe	95
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3316 wrote to memory of 400	3316	UMM2.exe	99
PID 3856 wrote to memory of 3832	3856	is-UJE1F.tmp	103
PID 3856 wrote to memory of 3832	3856	is-UJE1F.tmp	103
PID 3856 wrote to memory of 3832	3856	is-UJE1F.tmp	103
PID 3856 wrote to memory of 4680	3856	is-UJE1F.tmp	102
PID 3856 wrote to memory of 4680	3856	is-UJE1F.tmp	102
PID 3856 wrote to memory of 4680	3856	is-UJE1F.tmp	102
PID 3856 wrote to memory of 1876	3856	is-UJE1F.tmp	106
PID 3856 wrote to memory of 1876	3856	is-UJE1F.tmp	106
PID 3856 wrote to memory of 1876	3856	is-UJE1F.tmp	106
PID 3832 wrote to memory of 3652	3832	net.exe	105
PID 3832 wrote to memory of 3652	3832	net.exe	105
PID 3832 wrote to memory of 3652	3832	net.exe	105
PID 400 wrote to memory of 5028	400	aspnet_regbrowsers.exe	107
PID 400 wrote to memory of 5028	400	aspnet_regbrowsers.exe	107
PID 400 wrote to memory of 5028	400	aspnet_regbrowsers.exe	107
PID 400 wrote to memory of 4604	400	aspnet_regbrowsers.exe	108
PID 400 wrote to memory of 4604	400	aspnet_regbrowsers.exe	108
PID 400 wrote to memory of 4604	400	aspnet_regbrowsers.exe	108
PID 400 wrote to memory of 944	400	aspnet_regbrowsers.exe	109
PID 400 wrote to memory of 944	400	aspnet_regbrowsers.exe	109
PID 400 wrote to memory of 944	400	aspnet_regbrowsers.exe	109
PID 400 wrote to memory of 1072	400	aspnet_regbrowsers.exe	112
PID 400 wrote to memory of 1072	400	aspnet_regbrowsers.exe	112
PID 400 wrote to memory of 1072	400	aspnet_regbrowsers.exe	112
PID 5028 wrote to memory of 1764	5028	DXi53srrC0m4WdVDQo9lxoQE.exe	113

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	UMM2.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3132
- C:\Users\Admin\AppData\Local\Temp\0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe
  "C:\Users\Admin\AppData\Local\Temp\0dc2870f5bbcf289c0cbcdaba91492f88da72f3a000e41721ccfe08461094724.exe"
  2⤵
  - DcRat
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\aafg31.exe
    "C:\Users\Admin\AppData\Local\Temp\aafg31.exe"
    3⤵
    - Executes dropped EXE
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2028
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    PID:5032
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1768
- - C:\Users\Admin\AppData\Local\Temp\kos1.exe
    "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\set16.exe
      "C:\Users\Admin\AppData\Local\Temp\set16.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\is-38QRG.tmp\is-UJE1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-38QRG.tmp\is-UJE1F.tmp" /SL4 $901C8 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3856
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        7⤵
        
        PID:3652
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\kos.exe
      "C:\Users\Admin\AppData\Local\Temp\kos.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\Users\Admin\AppData\Local\Temp\UMM2.exe
    "C:\Users\Admin\AppData\Local\Temp\UMM2.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3316
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\UMM2.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4276
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      DcRat
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Users\Admin\Pictures\DXi53srrC0m4WdVDQo9lxoQE.exe
        
        "C:\Users\Admin\Pictures\DXi53srrC0m4WdVDQo9lxoQE.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "Admin:N"&&CACLS "nhdues.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "Admin:N"&&CACLS "..\1ff8bec27e" /P "Admin:R" /E&&Exit
        7⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:N"
        8⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nhdues.exe" /P "Admin:R" /E
        8⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:N"
        8⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\1ff8bec27e" /P "Admin:R" /E
        8⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F
        7⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        7⤵
        
        PID:4128
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main
        8⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\clip64.dll, Main
        7⤵
        
        PID:5572
    - - C:\Users\Admin\Pictures\ZRYYPfnDGjXc1jzKWtcV6bHB.exe
        
        "C:\Users\Admin\Pictures\ZRYYPfnDGjXc1jzKWtcV6bHB.exe"
        5⤵
        Executes dropped EXE
        
        PID:4604
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1792
    - - C:\Users\Admin\Pictures\k0dbtFN0VS21jkDoGYqKO0V8.exe
        
        "C:\Users\Admin\Pictures\k0dbtFN0VS21jkDoGYqKO0V8.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
    - - C:\Users\Admin\Pictures\JmAj2X7NP40y33jhdR622Knu.exe
        
        "C:\Users\Admin\Pictures\JmAj2X7NP40y33jhdR622Knu.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:1072
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\JmAj2X7NP40y33jhdR622Knu.exe" & exit
        6⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:5844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 1840
        6⤵
        Program crash
        
        PID:6080
    - - C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe
        
        "C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe" --silent --allusers=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\C3HeT4LGS7R8c3aTHwNPijd8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\C3HeT4LGS7R8c3aTHwNPijd8.exe" --version
        6⤵
        
        PID:3600
      - C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe
        
        C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.26 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x6e128538,0x6e128548,0x6e128554
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:956
      - C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe
        
        "C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=224 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231011113922" --session-guid=8fef8bd3-306b-4e7b-ad5c-b674e7961e12 --server-tracking-blob=YzE5NjEyOWVhOTczMzdkNmNkZjJlNWI1ODk5MThlN2JhYmQ2Nzc0YTY2MTM5NDZhYjlmNDAzMDkwMzdlMjljMzp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY5NzAyNDMyNC4yNjMxIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIwMzQ4MzdlOS0wMzBjLTRhNDgtOTRkNS05MWE4MDczMWM4NjgifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3405000000000000
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:2068
        
        C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe
        
        C:\Users\Admin\Pictures\C3HeT4LGS7R8c3aTHwNPijd8.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.26 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x2f8,0x6d418538,0x6d418548,0x6d418554
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3600
    - - C:\Users\Admin\Pictures\ZeoeQe0ukkZNFpCnwGdzbVcT.exe
        
        "C:\Users\Admin\Pictures\ZeoeQe0ukkZNFpCnwGdzbVcT.exe"
        5⤵
        Executes dropped EXE
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\7zS4EE6.tmp\Install.exe
        
        .\Install.exe
        6⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\7zS848D.tmp\Install.exe
        
        .\Install.exe /Tdido "385118" /S
        7⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Enumerates system info in registry
        
        PID:3144
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        8⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        9⤵
        
        PID:1544
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        10⤵
        
        PID:3388
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        10⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        8⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        9⤵
        
        PID:1204
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        10⤵
        
        PID:5896
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        10⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gFwkDHNhj" /SC once /ST 00:30:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        8⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4652
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gFwkDHNhj"
        8⤵
        
        PID:5808
    - - C:\Users\Admin\Pictures\ZxVkWIL9isjif4rnRptLKTKj.exe
        
        "C:\Users\Admin\Pictures\ZxVkWIL9isjif4rnRptLKTKj.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
        5⤵
        Executes dropped EXE
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\is-MLCJO.tmp\ZxVkWIL9isjif4rnRptLKTKj.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MLCJO.tmp\ZxVkWIL9isjif4rnRptLKTKj.tmp" /SL5="$C0066,5025136,832512,C:\Users\Admin\Pictures\ZxVkWIL9isjif4rnRptLKTKj.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
        6⤵
        DcRat
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of FindShellTrayWindow
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\is-ULASR.tmp\_isetup\_setup64.tmp
        
        helper 105 0x434
        7⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /Query /TN "DigitalPulseUpdateTask"
        7⤵
        
        PID:5888
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /Create /TN "DigitalPulseUpdateTask" /SC HOURLY /TR "C:\Users\Admin\AppData\Roaming\DigitalPulse\DigitalPulseUpdate.exe"
        7⤵
        DcRat
        Creates scheduled task(s)
        
        PID:5508
        
        C:\Users\Admin\AppData\Roaming\DigitalPulse\DigitalPulseService.exe
        
        "C:\Users\Admin\AppData\Roaming\DigitalPulse\DigitalPulseService.exe" 5333:::clickId=:::srcId=
        7⤵
        
        PID:1816
    - - C:\Users\Admin\Pictures\Aep9zFJ4RlybRiSL8DzoQ2yy.exe
        
        "C:\Users\Admin\Pictures\Aep9zFJ4RlybRiSL8DzoQ2yy.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        
        PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:5788
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5904
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:6056
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:6072
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:6088
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1408
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1956
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:5508
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5964
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:5692
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:6016
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:464
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xyvvnnvseiqa.xml"
  2⤵
  - DcRat
  - Creates scheduled task(s)
  PID:5536
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1072 -ip 1072
1⤵
PID:428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3644

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:6088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery