glupteba | 5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\random.exe = "0"	cmd.exe

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Windows Service

T1543.003

pid	Process
5136	netsh.exe
5256	netsh.exe
3064	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FpcWnOke2XHeqLTQ9lxiMZId.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NjXxBCdmvimC4VHKQkx63YQD.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ed2URBTXRnWNKrqZv449txgS.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\waJNnwqdpyrKGuRPn1c6P3az.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NSDZTLgDHhMHZ2fifuTKAknc.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LfWippPZyqB3mRcr611UpvpL.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\319OuMkL1aeN2ZwJ0uTDW2YN.bat	CasPol.exe

Executes dropped EXE 18 IoCs

pid	Process
3872	InstallSetup5.exe
1376	toolspub2.exe
3348	powercfg.exe
4716	cmd.exe
2028	Broom.exe
2372	latestX.exe
2212	rkQQMjkTfanTegnK30kPSnct.exe
2460	jeB49wmGSCef4fjyxb58NJpU.exe
3112	cmd.exe
4392	powershell.exe
2620	joQdTvhzbzQU5qXOLYXG963s.exe
4788	toolspub2.exe
1952	joQdTvhzbzQU5qXOLYXG963s.exe
2264	ORQr3Bx16h7J3uofgKNZeHLe.exe
220	joQdTvhzbzQU5qXOLYXG963s.exe
2684	Broom.exe
3028	joQdTvhzbzQU5qXOLYXG963s.exe
4720	joQdTvhzbzQU5qXOLYXG963s.exe

Loads dropped DLL 5 IoCs

pid	Process
2620	joQdTvhzbzQU5qXOLYXG963s.exe
1952	joQdTvhzbzQU5qXOLYXG963s.exe
220	joQdTvhzbzQU5qXOLYXG963s.exe
3028	joQdTvhzbzQU5qXOLYXG963s.exe
4720	joQdTvhzbzQU5qXOLYXG963s.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000600000001ac4f-397.dat	themida
behavioral2/files/0x000600000001ac4f-396.dat	themida
behavioral2/memory/2168-533-0x00007FF707D20000-0x00007FF708B2C000-memory.dmp	themida
behavioral2/memory/2168-549-0x00007FF707D20000-0x00007FF708B2C000-memory.dmp	themida
behavioral2/memory/2168-562-0x00007FF707D20000-0x00007FF708B2C000-memory.dmp	themida
behavioral2/memory/2168-581-0x00007FF707D20000-0x00007FF708B2C000-memory.dmp	themida

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001ac1f-101.dat	upx
behavioral2/memory/2620-104-0x0000000000D20000-0x0000000001249000-memory.dmp	upx
behavioral2/files/0x000600000001ac1f-120.dat	upx
behavioral2/files/0x000600000001ac1f-123.dat	upx
behavioral2/memory/1952-126-0x0000000000D20000-0x0000000001249000-memory.dmp	upx
behavioral2/files/0x000600000001ac1f-139.dat	upx
behavioral2/files/0x000600000001ac31-147.dat	upx
behavioral2/memory/220-153-0x00000000009D0000-0x0000000000EF9000-memory.dmp	upx
behavioral2/files/0x000600000001ac1f-160.dat	upx
behavioral2/memory/3028-167-0x0000000000D20000-0x0000000001249000-memory.dmp	upx
behavioral2/files/0x000600000001ac1f-168.dat	upx
behavioral2/memory/4720-173-0x0000000000D20000-0x0000000001249000-memory.dmp	upx
behavioral2/memory/1952-324-0x0000000000D20000-0x0000000001249000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\random.exe = "0"	cmd.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	joQdTvhzbzQU5qXOLYXG963s.exe
File opened (read-only)	\??\F:	joQdTvhzbzQU5qXOLYXG963s.exe
File opened (read-only)	\??\D:	joQdTvhzbzQU5qXOLYXG963s.exe
File opened (read-only)	\??\F:	joQdTvhzbzQU5qXOLYXG963s.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 1520	4716	cmd.exe	79
PID 1376 set thread context of 4788	1376	toolspub2.exe	90

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5676	sc.exe
5716	sc.exe
5632	sc.exe
1620	sc.exe
2328	sc.exe
5232	sc.exe
2492	sc.exe
5652	sc.exe
5620	sc.exe
2688	sc.exe
5484	sc.exe
1780	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
376	schtasks.exe
5888	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3856	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4788	toolspub2.exe
4788	toolspub2.exe
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4788	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	CasPol.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	2460	jeB49wmGSCef4fjyxb58NJpU.exe
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	Broom.exe
2684	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3872	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	71
PID 4736 wrote to memory of 3872	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	71
PID 4736 wrote to memory of 3872	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	71
PID 4736 wrote to memory of 1376	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	72
PID 4736 wrote to memory of 1376	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	72
PID 4736 wrote to memory of 1376	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	72
PID 4736 wrote to memory of 3348	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	184
PID 4736 wrote to memory of 3348	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	184
PID 4736 wrote to memory of 3348	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	184
PID 4736 wrote to memory of 4716	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	144
PID 4736 wrote to memory of 4716	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	144
PID 4736 wrote to memory of 4716	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	144
PID 3872 wrote to memory of 2028	3872	InstallSetup5.exe	74
PID 3872 wrote to memory of 2028	3872	InstallSetup5.exe	74
PID 3872 wrote to memory of 2028	3872	InstallSetup5.exe	74
PID 4736 wrote to memory of 2372	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	75
PID 4736 wrote to memory of 2372	4736	5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe	75
PID 4716 wrote to memory of 4864	4716	cmd.exe	77
PID 4716 wrote to memory of 4864	4716	cmd.exe	77
PID 4716 wrote to memory of 4864	4716	cmd.exe	77
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 4716 wrote to memory of 1520	4716	cmd.exe	79
PID 1520 wrote to memory of 2212	1520	CasPol.exe	80
PID 1520 wrote to memory of 2212	1520	CasPol.exe	80
PID 1520 wrote to memory of 2212	1520	CasPol.exe	80
PID 1520 wrote to memory of 2460	1520	CasPol.exe	81
PID 1520 wrote to memory of 2460	1520	CasPol.exe	81
PID 1520 wrote to memory of 2460	1520	CasPol.exe	81
PID 1520 wrote to memory of 3112	1520	CasPol.exe	152
PID 1520 wrote to memory of 3112	1520	CasPol.exe	152
PID 1520 wrote to memory of 3112	1520	CasPol.exe	152
PID 1520 wrote to memory of 4392	1520	CasPol.exe	135
PID 1520 wrote to memory of 4392	1520	CasPol.exe	135
PID 1520 wrote to memory of 4392	1520	CasPol.exe	135
PID 1520 wrote to memory of 2620	1520	CasPol.exe	84
PID 1520 wrote to memory of 2620	1520	CasPol.exe	84
PID 1520 wrote to memory of 2620	1520	CasPol.exe	84
PID 1376 wrote to memory of 4788	1376	toolspub2.exe	90
PID 1376 wrote to memory of 4788	1376	toolspub2.exe	90
PID 1376 wrote to memory of 4788	1376	toolspub2.exe	90
PID 2620 wrote to memory of 1952	2620	joQdTvhzbzQU5qXOLYXG963s.exe	85
PID 2620 wrote to memory of 1952	2620	joQdTvhzbzQU5qXOLYXG963s.exe	85
PID 2620 wrote to memory of 1952	2620	joQdTvhzbzQU5qXOLYXG963s.exe	85
PID 1376 wrote to memory of 4788	1376	toolspub2.exe	90
PID 1376 wrote to memory of 4788	1376	toolspub2.exe	90
PID 1376 wrote to memory of 4788	1376	toolspub2.exe	90
PID 1520 wrote to memory of 2264	1520	CasPol.exe	87
PID 1520 wrote to memory of 2264	1520	CasPol.exe	87
PID 1520 wrote to memory of 2264	1520	CasPol.exe	87
PID 2620 wrote to memory of 220	2620	joQdTvhzbzQU5qXOLYXG963s.exe	89
PID 2620 wrote to memory of 220	2620	joQdTvhzbzQU5qXOLYXG963s.exe	89
PID 2620 wrote to memory of 220	2620	joQdTvhzbzQU5qXOLYXG963s.exe	89
PID 2264 wrote to memory of 2684	2264	ORQr3Bx16h7J3uofgKNZeHLe.exe	88
PID 2264 wrote to memory of 2684	2264	ORQr3Bx16h7J3uofgKNZeHLe.exe	88
PID 2264 wrote to memory of 2684	2264	ORQr3Bx16h7J3uofgKNZeHLe.exe	88
PID 2620 wrote to memory of 3028	2620	joQdTvhzbzQU5qXOLYXG963s.exe	91
PID 2620 wrote to memory of 3028	2620	joQdTvhzbzQU5qXOLYXG963s.exe	91
PID 2620 wrote to memory of 3028	2620	joQdTvhzbzQU5qXOLYXG963s.exe	91

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe
"C:\Users\Admin\AppData\Local\Temp\5184c87f70fd14293e599b26fc4361ec3e5708095678c8a84143a059be319cf5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Broom.exe
    C:\Users\Admin\AppData\Local\Temp\Broom.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4788
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:3348
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:2272
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Executes dropped EXE
      PID:4392
  - - C:\Windows\System32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:5460
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3064
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5640
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4100
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\random.exe
  "C:\Users\Admin\AppData\Local\Temp\random.exe"
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\random.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    - Drops startup file
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Users\Admin\Pictures\rkQQMjkTfanTegnK30kPSnct.exe
      "C:\Users\Admin\Pictures\rkQQMjkTfanTegnK30kPSnct.exe"
      4⤵
      Executes dropped EXE
      PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\rkQQMjkTfanTegnK30kPSnct.exe" & del "C:\ProgramData\*.dll"" & exit
        5⤵
        
        PID:3076
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:3856
  - - C:\Users\Admin\Pictures\jeB49wmGSCef4fjyxb58NJpU.exe
      "C:\Users\Admin\Pictures\jeB49wmGSCef4fjyxb58NJpU.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2460
  - - C:\Users\Admin\Pictures\XkEHUT63cKKIOh79VaAckLsn.exe
      "C:\Users\Admin\Pictures\XkEHUT63cKKIOh79VaAckLsn.exe"
      4⤵
      PID:3112
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4100
    - - C:\Users\Admin\Pictures\XkEHUT63cKKIOh79VaAckLsn.exe
        
        "C:\Users\Admin\Pictures\XkEHUT63cKKIOh79VaAckLsn.exe"
        5⤵
        
        PID:5192
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1644
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        Executes dropped EXE
        
        PID:3112
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5524
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5832
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5256
  - - C:\Users\Admin\Pictures\VesdvRhUpBnQUFpnk9OKn1mU.exe
      "C:\Users\Admin\Pictures\VesdvRhUpBnQUFpnk9OKn1mU.exe"
      4⤵
      PID:4392
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4364
    - - C:\Users\Admin\Pictures\VesdvRhUpBnQUFpnk9OKn1mU.exe
        
        "C:\Users\Admin\Pictures\VesdvRhUpBnQUFpnk9OKn1mU.exe"
        5⤵
        
        PID:5884
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:4952
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        UAC bypass
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4716
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5324
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5836
      - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        6⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:2492
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        7⤵
        
        PID:5448
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        7⤵
        
        PID:5944
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:5888
        
        C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        7⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:2492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
        7⤵
        
        PID:1508
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "ScheduledUpdate" /f
        8⤵
        
        PID:3532
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "csrss" /f
        8⤵
        
        PID:3276
  - - C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe
      "C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe" --silent --allusers=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe
        
        C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.54 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x6ead5648,0x6ead5658,0x6ead5664
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\joQdTvhzbzQU5qXOLYXG963s.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\joQdTvhzbzQU5qXOLYXG963s.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:220
    - - C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe
        
        "C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2620 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231113081058" --session-guid=8a08be9d-155e-4a76-8ec4-e7a3cbfffec8 --server-tracking-blob=NTU3OTJmNjRjNDUzNTMyYzYwYjMwNWI0NDk4NGUwMjU0YzYyMzc4MjgzM2U4NDAyMWQyMTFiNmU2NDNjNjFiMTp7ImNvdW50cnkiOiJOTCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY5OTg2MzA1My44NTI2IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIyMzA1MzJjYi1iMjk5LTQxNWItOWEzOS02MWY0ZGRmNWYyMjUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6C04000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:3028
      - C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe
        
        C:\Users\Admin\Pictures\joQdTvhzbzQU5qXOLYXG963s.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.54 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x6da45648,0x6da45658,0x6da45664
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311130810581\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311130810581\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe"
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311130810581\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311130810581\assistant\assistant_installer.exe" --version
        5⤵
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311130810581\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311130810581\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.25 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x2a1588,0x2a1598,0x2a15a4
        6⤵
        
        PID:3844
  - - C:\Users\Admin\Pictures\ORQr3Bx16h7J3uofgKNZeHLe.exe
      "C:\Users\Admin\Pictures\ORQr3Bx16h7J3uofgKNZeHLe.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
        
        C:\Users\Admin\AppData\Local\Temp\Broom.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
  - - C:\Users\Admin\Pictures\bdntAyGMkFZ38rpbvcoAPqST.exe
      "C:\Users\Admin\Pictures\bdntAyGMkFZ38rpbvcoAPqST.exe"
      4⤵
      PID:2168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:5136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:1180

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1676

C:\Windows\System32\sc.exe
sc stop bits
1⤵
- Launches sc.exe
PID:5676

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
1⤵
PID:5808

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
1⤵
PID:5900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:5764

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
1⤵
PID:5984

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
1⤵
PID:5956

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:5744

C:\Windows\System32\sc.exe
sc stop dosvc
1⤵
- Launches sc.exe
PID:5716

C:\Windows\System32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:5652

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:5632

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:5620

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:5580

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:5840

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:6044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:5600

C:\Windows\System32\sc.exe
sc stop bits
1⤵
- Launches sc.exe
PID:2688

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
1⤵
PID:3244

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
1⤵
PID:5164

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
1⤵
PID:5584
- C:\Windows\SysWOW64\sc.exe
  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  PID:1620

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:2164

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:6100

C:\Windows\System32\sc.exe
sc stop dosvc
1⤵
- Launches sc.exe
PID:5484

C:\Windows\System32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:1780

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:2328

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:5232

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:3044

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
PID:5880

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
1⤵
PID:3320

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery