formbook | 76a7490d3f1b0685f60a417d1c9cf96927b473825a914221f092f82ea112b571

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	get4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	random.exe

Windows security bypass 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	get4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\a\get4.exe = "0"	get4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\a\random.exe = "0"	random.exe

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/4600-275-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/4600-371-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 23 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fMUk9MQhAbYJ7y1WNHAAXn4q.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\28MbOe1rzcClXlFvIBQabJhz.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fMlCmqRYG1DKANyrgupmjyXI.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Onu6BkEhLAbMwE3fYSzPeao7.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SKXC04n7R2LUWC3dhqqZS0vO.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UTbZjh8vPAU5zrp7nTpbfjFq.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x4BcAnGI7S6gqSpbXAOiWLaf.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BpNpUYztZQQqvEhGLpKh4pXF.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V8qIiffrVt5gERPFcfMn3iMO.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t5ZL4hQtbW6KOGk9gNixwvm0.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fyqBJtjy9wQvcSaCgZ6qCvei.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\di0txUQp9vFyW04CX1gz5Wbq.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kB7uPI8AdQEulvOFWgWi6CwL.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VqKMAaNKP48iod8Tc4mG8VN3.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l7VsFL3zR3PYa9Pq1YkcT3sh.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iaKymP93cv6iXQ8rzh8VImJ6.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nOlcwa2nMjUYA8eXdBvKb622.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XKw9MBfrdPm7QxmxZUANY8D4.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9BSqSVtB4jwpKqPlWyrhMK8r.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vSzjPsBkArsgIrErTnNKMXYR.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A5mxjkMttX5JjJcp9wmL974n.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QI6uiIgobzFWCMDhD491xZUm.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bIXn8Kan8u9hUVTZjhmZCigJ.bat	CasPol.exe

Executes dropped EXE 38 IoCs

pid	Process
4872	build.exe
1036	InstallSetup2.exe
5028	Broom.exe
2892	smss.exe
4588	IGCC.exe
4388	r.exe
5044	need.exe
4840	1TU15CN5.exe
4404	32.exe
3092	7qi3UN49.exe
3216	get4.exe
3696	2.exe
4428	random.exe
4416	macroniska2.1.exe
4740	eafhznn.exe
3704	StealerClient_Cpp.exe
4216	0MC4rAUCB8UBuc5ZHQJyEoSJ.exe
3100	StealerClient_Sharp.exe
1844	pcMloaDuNuSOBGerubJ3M6C5.exe
4600	eafhznn.exe
5024	6BAS2vt2SoNyZQV85rpsL4Ga.exe
3496	nQkPRbgFQaIC6PEdDVatD78Z.exe
2572	OzsWSzL0zeBLau5fTE2wVmLm.exe
3652	GVf1RhP3w6ft5r8rxfX8GdRB.exe
2840	Hgd1MM10xTQsgsztiPwjEdit.exe
208	e0LaFa87Ti6Ez4amLFVuFZjv.exe
1540	dvPdeUiwwchkJwlJ0GPKC1pd.exe
1828	Qgwf7u4sPyPT6ZV6Vcm7bpgE.exe
2828	SCds20flnG1cnvvYgE21x0qY.exe
776	MwAbZ1gkS78g33SppcZDYily.exe
5152	gPVkXHHyLWF5LPaxzs1r9r8b.exe
5192	Broom.exe
5268	BOJQvvwme8BI3eAZtYUEU98D.exe
5356	gPVkXHHyLWF5LPaxzs1r9r8b.exe
5244	pQHwHJdBPGCIBzk43d63Dynp.exe
5536	0MC4rAUCB8UBuc5ZHQJyEoSJ.exe
5580	Hgd1MM10xTQsgsztiPwjEdit.exe
5656	1kxHbEsGGJ3lSV78aCxYg3S5.exe

Loads dropped DLL 3 IoCs

pid	Process
5152	gPVkXHHyLWF5LPaxzs1r9r8b.exe
5244	pQHwHJdBPGCIBzk43d63Dynp.exe
5356	gPVkXHHyLWF5LPaxzs1r9r8b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000001ac15-356.dat	upx
behavioral1/files/0x000600000001ac15-349.dat	upx
behavioral1/memory/5152-367-0x0000000000EB0000-0x00000000013D9000-memory.dmp	upx
behavioral1/memory/5356-370-0x0000000000EB0000-0x00000000013D9000-memory.dmp	upx
behavioral1/files/0x000600000001ac30-413.dat	upx
behavioral1/memory/6124-469-0x00000000012E0000-0x0000000001809000-memory.dmp	upx

Windows security modification 2 TTPs 4 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	get4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	get4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\a\get4.exe = "0"	get4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\a\random.exe = "0"	random.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	need.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	get4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	get4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	random.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
252	api.ipify.org
253	api.ipify.org
202	api.myip.com
215	ipinfo.io
217	api.myip.com
221	ipinfo.io
228	ipinfo.io
147	api.ipify.org
204	api.myip.com
216	ipinfo.io
227	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4388	r.exe
4388	r.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 3228	4840	1TU15CN5.exe	83
PID 3216 set thread context of 4756	3216	get4.exe	92
PID 4428 set thread context of 700	4428	random.exe	97
PID 4740 set thread context of 4600	4740	eafhznn.exe	104
PID 4600 set thread context of 3132	4600	eafhznn.exe	42
PID 4216 set thread context of 5536	4216	0MC4rAUCB8UBuc5ZHQJyEoSJ.exe	123
PID 2840 set thread context of 5580	2840	Hgd1MM10xTQsgsztiPwjEdit.exe	126
PID 4600 set thread context of 3132	4600	eafhznn.exe	42

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1176	sc.exe
4420	sc.exe
5412	sc.exe
800	sc.exe
164	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4408	4404	WerFault.exe	81
4864	3228	WerFault.exe	83
5980	3100	WerFault.exe	105
5324	5968	WerFault.exe	143
6700	3496	WerFault.exe	110

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x000600000001abeb-170.dat	nsis_installer_1
behavioral1/files/0x000600000001abeb-170.dat	nsis_installer_2
behavioral1/files/0x000600000001abeb-173.dat	nsis_installer_1
behavioral1/files/0x000600000001abeb-173.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	r.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	r.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0MC4rAUCB8UBuc5ZHQJyEoSJ.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0MC4rAUCB8UBuc5ZHQJyEoSJ.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0MC4rAUCB8UBuc5ZHQJyEoSJ.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
6660	schtasks.exe
6500	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
6068	timeout.exe
3792	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4388	r.exe
4388	r.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
5008	powershell.exe
3132	Explorer.EXE
3132	Explorer.EXE
5008	powershell.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
5008	powershell.exe
3132	Explorer.EXE
3132	Explorer.EXE
4872	build.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4388	r.exe
4740	eafhznn.exe
4600	eafhznn.exe
4600	eafhznn.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	a.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	4756	CasPol.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	700	CasPol.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	4600	eafhznn.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5028	Broom.exe
4388	r.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4872	5064	a.exe	72
PID 5064 wrote to memory of 4872	5064	a.exe	72
PID 5064 wrote to memory of 4872	5064	a.exe	72
PID 5064 wrote to memory of 1036	5064	a.exe	73
PID 5064 wrote to memory of 1036	5064	a.exe	73
PID 5064 wrote to memory of 1036	5064	a.exe	73
PID 1036 wrote to memory of 5028	1036	InstallSetup2.exe	74
PID 1036 wrote to memory of 5028	1036	InstallSetup2.exe	74
PID 1036 wrote to memory of 5028	1036	InstallSetup2.exe	74
PID 5064 wrote to memory of 2892	5064	a.exe	75
PID 5064 wrote to memory of 2892	5064	a.exe	75
PID 5064 wrote to memory of 2892	5064	a.exe	75
PID 5064 wrote to memory of 4588	5064	a.exe	76
PID 5064 wrote to memory of 4588	5064	a.exe	76
PID 5064 wrote to memory of 4588	5064	a.exe	76
PID 5064 wrote to memory of 4388	5064	a.exe	77
PID 5064 wrote to memory of 4388	5064	a.exe	77
PID 5064 wrote to memory of 4388	5064	a.exe	77
PID 5064 wrote to memory of 5044	5064	a.exe	78
PID 5064 wrote to memory of 5044	5064	a.exe	78
PID 5064 wrote to memory of 5044	5064	a.exe	78
PID 5044 wrote to memory of 4840	5044	need.exe	79
PID 5044 wrote to memory of 4840	5044	need.exe	79
PID 5044 wrote to memory of 4840	5044	need.exe	79
PID 4840 wrote to memory of 1628	4840	1TU15CN5.exe	80
PID 4840 wrote to memory of 1628	4840	1TU15CN5.exe	80
PID 4840 wrote to memory of 1628	4840	1TU15CN5.exe	80
PID 5064 wrote to memory of 4404	5064	a.exe	81
PID 5064 wrote to memory of 4404	5064	a.exe	81
PID 5064 wrote to memory of 4404	5064	a.exe	81
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 4840 wrote to memory of 3228	4840	1TU15CN5.exe	83
PID 5044 wrote to memory of 3092	5044	need.exe	85
PID 5044 wrote to memory of 3092	5044	need.exe	85
PID 5044 wrote to memory of 3092	5044	need.exe	85
PID 5064 wrote to memory of 3216	5064	a.exe	86
PID 5064 wrote to memory of 3216	5064	a.exe	86
PID 5064 wrote to memory of 3216	5064	a.exe	86
PID 3092 wrote to memory of 3280	3092	7qi3UN49.exe	88
PID 3092 wrote to memory of 3280	3092	7qi3UN49.exe	88
PID 3092 wrote to memory of 3280	3092	7qi3UN49.exe	88
PID 3216 wrote to memory of 5008	3216	get4.exe	91
PID 3216 wrote to memory of 5008	3216	get4.exe	91
PID 3216 wrote to memory of 5008	3216	get4.exe	91
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 3216 wrote to memory of 4756	3216	get4.exe	92
PID 5064 wrote to memory of 3696	5064	a.exe	94
PID 5064 wrote to memory of 3696	5064	a.exe	94
PID 5064 wrote to memory of 3696	5064	a.exe	94
PID 5064 wrote to memory of 4428	5064	a.exe	95

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	get4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	random.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132
- C:\Users\Admin\AppData\Local\Temp\a.exe
  "C:\Users\Admin\AppData\Local\Temp\a.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Users\Admin\AppData\Local\Temp\a\build.exe
    "C:\Users\Admin\AppData\Local\Temp\a\build.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\build.exe" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:5776
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:6068
- - C:\Users\Admin\AppData\Local\Temp\a\InstallSetup2.exe
    "C:\Users\Admin\AppData\Local\Temp\a\InstallSetup2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
      C:\Users\Admin\AppData\Local\Temp\Broom.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5028
- - C:\Users\Admin\AppData\Local\Temp\a\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\a\smss.exe"
    3⤵
    - Executes dropped EXE
    PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\RbundagvO.bat" "
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\System32\colorcpl.exe
      4⤵
      PID:3976
- - C:\Users\Admin\AppData\Local\Temp\a\IGCC.exe
    "C:\Users\Admin\AppData\Local\Temp\a\IGCC.exe"
    3⤵
    - Executes dropped EXE
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\a\IGCC.exe
      "C:\Users\Admin\AppData\Local\Temp\a\IGCC.exe"
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\a\IGCC.exe
      "C:\Users\Admin\AppData\Local\Temp\a\IGCC.exe"
      4⤵
      PID:4280
- - C:\Users\Admin\AppData\Local\Temp\a\r.exe
    "C:\Users\Admin\AppData\Local\Temp\a\r.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\a\need.exe
    "C:\Users\Admin\AppData\Local\Temp\a\need.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TU15CN5.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TU15CN5.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4840
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:1628
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 568
        6⤵
        Program crash
        
        PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7qi3UN49.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7qi3UN49.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
        5⤵
        
        PID:3280
- - C:\Users\Admin\AppData\Local\Temp\a\32.exe
    "C:\Users\Admin\AppData\Local\Temp\a\32.exe"
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 304
      4⤵
      Program crash
      PID:4408
- - C:\Users\Admin\AppData\Local\Temp\a\get4.exe
    "C:\Users\Admin\AppData\Local\Temp\a\get4.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3216
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\get4.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      PID:4756
    - - C:\Users\Admin\Pictures\0MC4rAUCB8UBuc5ZHQJyEoSJ.exe
        
        "C:\Users\Admin\Pictures\0MC4rAUCB8UBuc5ZHQJyEoSJ.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4216
      - C:\Users\Admin\Pictures\0MC4rAUCB8UBuc5ZHQJyEoSJ.exe
        
        "C:\Users\Admin\Pictures\0MC4rAUCB8UBuc5ZHQJyEoSJ.exe"
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        
        PID:5536
    - - C:\Users\Admin\Pictures\Qgwf7u4sPyPT6ZV6Vcm7bpgE.exe
        
        "C:\Users\Admin\Pictures\Qgwf7u4sPyPT6ZV6Vcm7bpgE.exe"
        5⤵
        Executes dropped EXE
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\7zS604B.tmp\Install.exe
        
        .\Install.exe
        6⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\7zSD76F.tmp\Install.exe
        
        .\Install.exe /RmhdidxwVM "385121" /S
        7⤵
        
        PID:5332
    - - C:\Users\Admin\Pictures\dvPdeUiwwchkJwlJ0GPKC1pd.exe
        
        "C:\Users\Admin\Pictures\dvPdeUiwwchkJwlJ0GPKC1pd.exe"
        5⤵
        Executes dropped EXE
        
        PID:1540
    - - C:\Users\Admin\Pictures\GVf1RhP3w6ft5r8rxfX8GdRB.exe
        
        "C:\Users\Admin\Pictures\GVf1RhP3w6ft5r8rxfX8GdRB.exe"
        5⤵
        Executes dropped EXE
        
        PID:3652
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\dialer.exe
        
        "C:\Windows\system32\dialer.exe"
        7⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 472
        7⤵
        Program crash
        
        PID:5324
    - - C:\Users\Admin\Pictures\pcMloaDuNuSOBGerubJ3M6C5.exe
        
        "C:\Users\Admin\Pictures\pcMloaDuNuSOBGerubJ3M6C5.exe"
        5⤵
        Executes dropped EXE
        
        PID:1844
    - - C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe
        
        "C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe" --silent --allusers=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\gPVkXHHyLWF5LPaxzs1r9r8b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\gPVkXHHyLWF5LPaxzs1r9r8b.exe" --version
        6⤵
        
        PID:6124
      - C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe
        
        "C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5152 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231108145401" --session-guid=80841ebf-600d-4208-8a7a-208b41dc52f8 --server-tracking-blob=NDUyYWU3ZDBjZjM5ZGRhZjdjMWViMTJkM2M1NjYxMjk3YTk4ZTZhYzQ0ODY1MDRiYjJiNGQzMTM2YWM4ODRiZjp7ImNvdW50cnkiOiJOTCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY5OTQ1NTIwOS4wMTYyIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI0ZmU2ZjVkMS00NTM5LTQzNGItOGRjZS1jNmQyNmQ3OGNhNmEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7804000000000000
        6⤵
        
        PID:5692
        
        C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe
        
        C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.36 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x6b355648,0x6b355658,0x6b355664
        7⤵
        
        PID:5308
    - - C:\Users\Admin\Pictures\MwAbZ1gkS78g33SppcZDYily.exe
        
        "C:\Users\Admin\Pictures\MwAbZ1gkS78g33SppcZDYily.exe"
        5⤵
        Executes dropped EXE
        
        PID:776
    - - C:\Users\Admin\Pictures\1kxHbEsGGJ3lSV78aCxYg3S5.exe
        
        "C:\Users\Admin\Pictures\1kxHbEsGGJ3lSV78aCxYg3S5.exe"
        5⤵
        Executes dropped EXE
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\is-V4D68.tmp\is-KNPNL.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-V4D68.tmp\is-KNPNL.tmp" /SL4 $30276 "C:\Users\Admin\Pictures\1kxHbEsGGJ3lSV78aCxYg3S5.exe" 3899195 244736
        6⤵
        
        PID:4904
    - - C:\Users\Admin\Pictures\njZmTLhdOLbUs5WYum71US30.exe
        
        "C:\Users\Admin\Pictures\njZmTLhdOLbUs5WYum71US30.exe"
        5⤵
        
        PID:6080
- - C:\Users\Admin\AppData\Local\Temp\a\2.exe
    "C:\Users\Admin\AppData\Local\Temp\a\2.exe"
    3⤵
    - Executes dropped EXE
    PID:3696
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\2.exe" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:5532
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3792
- - C:\Users\Admin\AppData\Local\Temp\a\random.exe
    "C:\Users\Admin\AppData\Local\Temp\a\random.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - System policy modification
    PID:4428
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      PID:700
    - - C:\Users\Admin\Pictures\OzsWSzL0zeBLau5fTE2wVmLm.exe
        
        "C:\Users\Admin\Pictures\OzsWSzL0zeBLau5fTE2wVmLm.exe"
        5⤵
        Executes dropped EXE
        
        PID:2572
    - - C:\Users\Admin\Pictures\SCds20flnG1cnvvYgE21x0qY.exe
        
        "C:\Users\Admin\Pictures\SCds20flnG1cnvvYgE21x0qY.exe"
        5⤵
        Executes dropped EXE
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\is-3MB4H.tmp\is-ACO6J.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3MB4H.tmp\is-ACO6J.tmp" /SL4 $3025C "C:\Users\Admin\Pictures\SCds20flnG1cnvvYgE21x0qY.exe" 3899195 244736
        6⤵
        
        PID:5896
        
        C:\Program Files (x86)\ImapRebex\ImapRebex.exe
        
        "C:\Program Files (x86)\ImapRebex\ImapRebex.exe" -i
        7⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Query
        7⤵
        
        PID:5464
        
        C:\Program Files (x86)\ImapRebex\ImapRebex.exe
        
        "C:\Program Files (x86)\ImapRebex\ImapRebex.exe" -s
        7⤵
        
        PID:6196
    - - C:\Users\Admin\Pictures\nQkPRbgFQaIC6PEdDVatD78Z.exe
        
        "C:\Users\Admin\Pictures\nQkPRbgFQaIC6PEdDVatD78Z.exe"
        5⤵
        Executes dropped EXE
        
        PID:3496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 2256
        6⤵
        Program crash
        
        PID:6700
    - - C:\Users\Admin\Pictures\e0LaFa87Ti6Ez4amLFVuFZjv.exe
        
        "C:\Users\Admin\Pictures\e0LaFa87Ti6Ez4amLFVuFZjv.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        
        PID:208
    - - C:\Users\Admin\Pictures\Hgd1MM10xTQsgsztiPwjEdit.exe
        
        "C:\Users\Admin\Pictures\Hgd1MM10xTQsgsztiPwjEdit.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2840
      - C:\Users\Admin\Pictures\Hgd1MM10xTQsgsztiPwjEdit.exe
        
        "C:\Users\Admin\Pictures\Hgd1MM10xTQsgsztiPwjEdit.exe"
        6⤵
        Executes dropped EXE
        
        PID:5580
    - - C:\Users\Admin\Pictures\6BAS2vt2SoNyZQV85rpsL4Ga.exe
        
        "C:\Users\Admin\Pictures\6BAS2vt2SoNyZQV85rpsL4Ga.exe"
        5⤵
        Executes dropped EXE
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Broom.exe
        
        C:\Users\Admin\AppData\Local\Temp\Broom.exe
        6⤵
        Executes dropped EXE
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
        
        C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
        6⤵
        
        PID:4420
    - - C:\Users\Admin\Pictures\BOJQvvwme8BI3eAZtYUEU98D.exe
        
        "C:\Users\Admin\Pictures\BOJQvvwme8BI3eAZtYUEU98D.exe"
        5⤵
        Executes dropped EXE
        
        PID:5268
    - - C:\Users\Admin\Pictures\pQHwHJdBPGCIBzk43d63Dynp.exe
        
        "C:\Users\Admin\Pictures\pQHwHJdBPGCIBzk43d63Dynp.exe" --silent --allusers=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5244
      - C:\Users\Admin\Pictures\pQHwHJdBPGCIBzk43d63Dynp.exe
        
        C:\Users\Admin\Pictures\pQHwHJdBPGCIBzk43d63Dynp.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.36 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x6c765648,0x6c765658,0x6c765664
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\pQHwHJdBPGCIBzk43d63Dynp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\pQHwHJdBPGCIBzk43d63Dynp.exe" --version
        6⤵
        
        PID:1528
    - - C:\Users\Admin\Pictures\25WJqcj5VSEcwyHEIZvknw0l.exe
        
        "C:\Users\Admin\Pictures\25WJqcj5VSEcwyHEIZvknw0l.exe"
        5⤵
        
        PID:5804
    - - C:\Users\Admin\Pictures\s5WAdu41ncRScb1ggNJOiyck.exe
        
        "C:\Users\Admin\Pictures\s5WAdu41ncRScb1ggNJOiyck.exe"
        5⤵
        
        PID:5916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\random.exe" -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5116
- - C:\Users\Admin\AppData\Local\Temp\a\macroniska2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\a\macroniska2.1.exe"
    3⤵
    - Executes dropped EXE
    PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\eafhznn.exe
      "C:\Users\Admin\AppData\Local\Temp\eafhznn.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\eafhznn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eafhznn.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
- - C:\Users\Admin\AppData\Local\Temp\a\StealerClient_Cpp.exe
    "C:\Users\Admin\AppData\Local\Temp\a\StealerClient_Cpp.exe"
    3⤵
    - Executes dropped EXE
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\a\StealerClient_Sharp.exe
    "C:\Users\Admin\AppData\Local\Temp\a\StealerClient_Sharp.exe"
    3⤵
    - Executes dropped EXE
    PID:3100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 808
      4⤵
      Program crash
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\a\tuc19.exe
    "C:\Users\Admin\AppData\Local\Temp\a\tuc19.exe"
    3⤵
    PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\is-46HG4.tmp\is-DAS5Q.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-46HG4.tmp\is-DAS5Q.tmp" /SL4 $20348 "C:\Users\Admin\AppData\Local\Temp\a\tuc19.exe" 3883359 244736
      4⤵
      PID:5740
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Query
        5⤵
        
        PID:3588
    - - C:\Program Files (x86)\ImapRebex\ImapRebex.exe
        
        "C:\Program Files (x86)\ImapRebex\ImapRebex.exe" -i
        5⤵
        
        PID:440
    - - C:\Program Files (x86)\ImapRebex\ImapRebex.exe
        
        "C:\Program Files (x86)\ImapRebex\ImapRebex.exe" -s
        5⤵
        
        PID:6256
- - C:\Users\Admin\AppData\Local\Temp\a\WWW14_64.exe
    "C:\Users\Admin\AppData\Local\Temp\a\WWW14_64.exe"
    3⤵
    PID:5564
- - C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
    "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\a\latestumma.exe
    "C:\Users\Admin\AppData\Local\Temp\a\latestumma.exe"
    3⤵
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
        
        C:\Users\Admin\AppData\Local\Temp\Broom.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
      "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\kos4.exe
      "C:\Users\Admin\AppData\Local\Temp\kos4.exe"
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\latestX.exe
      "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\a\KL.exe
    "C:\Users\Admin\AppData\Local\Temp\a\KL.exe"
    3⤵
    PID:6516
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      4⤵
      Creates scheduled task(s)
      PID:6500
- - C:\Users\Admin\AppData\Local\Temp\a\MKiNn8877.exe
    "C:\Users\Admin\AppData\Local\Temp\a\MKiNn8877.exe"
    3⤵
    PID:6736
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:6852
- - C:\Users\Admin\AppData\Local\Temp\a\My2.exe
    "C:\Users\Admin\AppData\Local\Temp\a\My2.exe"
    3⤵
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\a\arinzezx.exe
    "C:\Users\Admin\AppData\Local\Temp\a\arinzezx.exe"
    3⤵
    PID:6628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:5572
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:5820
- C:\Windows\SysWOW64\wlanext.exe
  "C:\Windows\SysWOW64\wlanext.exe"
  2⤵
  PID:5812
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  PID:6112
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\eafhznn.exe"
    3⤵
    PID:5212
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  PID:5264
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:6076
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1176
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4420
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5412
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:800
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:164
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:204
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:5260
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5772
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:6244
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:6684
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4048
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\tlxvacrdjkek.xml"
  2⤵
  - Creates scheduled task(s)
  PID:6660
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:6164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:6024

C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe
C:\Users\Admin\Pictures\gPVkXHHyLWF5LPaxzs1r9r8b.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.36 --initial-client-data=0x2b4,0x2b8,0x2bc,0x27c,0x2c0,0x6cca5648,0x6cca5658,0x6cca5664
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5356

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\be276fb6d2334e808b74defaac58afc2 /t 5196 /p 5192
1⤵
PID:5524

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery