glupteba | addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe = "0"	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	Install.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dy3uUBRUCsj1tUHkHitGgdRv.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gm6vaHAiqQDAGkOIa7mxZMkO.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GX7rNpgSfEuuXxzYcv5xGydw.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q7UtfpHLs6dstzGYmXd9pHGm.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kP5i2KQTrR1NR9tPUR1m0aqo.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kKM4waF9Sfl5iM5wH9MBH7Ow.bat	CasPol.exe

Executes dropped EXE 12 IoCs

pid	Process
1276	qvOerqhMqQmmMYKPtttIEYIO.exe
2332	ZPxqZUYwCbqXK8E7dXSyoNh1.exe
3848	eIHrglttdI1sUFxOEGP5WKa0.exe
3748	Broom.exe
3792	bIsl5z2cOxJuSOrqa6oQiczN.exe
3368	hw1JdVWBDLFVPwXILIb6DdTM.exe
2284	bIsl5z2cOxJuSOrqa6oQiczN.exe
4324	Install.exe
4956	bIsl5z2cOxJuSOrqa6oQiczN.exe
4432	bIsl5z2cOxJuSOrqa6oQiczN.exe
3740	bIsl5z2cOxJuSOrqa6oQiczN.exe
5048	Install.exe

Loads dropped DLL 5 IoCs

pid	Process
3792	bIsl5z2cOxJuSOrqa6oQiczN.exe
2284	bIsl5z2cOxJuSOrqa6oQiczN.exe
4956	bIsl5z2cOxJuSOrqa6oQiczN.exe
4432	bIsl5z2cOxJuSOrqa6oQiczN.exe
3740	bIsl5z2cOxJuSOrqa6oQiczN.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000022e03-81.dat	upx
behavioral1/files/0x0006000000022e03-87.dat	upx
behavioral1/memory/3792-89-0x0000000000280000-0x00000000007A9000-memory.dmp	upx
behavioral1/files/0x0006000000022e03-110.dat	upx
behavioral1/memory/2284-111-0x0000000000280000-0x00000000007A9000-memory.dmp	upx
behavioral1/files/0x0006000000022e03-123.dat	upx
behavioral1/files/0x0006000000022e19-130.dat	upx
behavioral1/memory/3792-128-0x0000000000280000-0x00000000007A9000-memory.dmp	upx
behavioral1/memory/4956-138-0x0000000000F60000-0x0000000001489000-memory.dmp	upx
behavioral1/files/0x0006000000022e03-140.dat	upx
behavioral1/memory/2284-141-0x0000000000280000-0x00000000007A9000-memory.dmp	upx
behavioral1/files/0x0006000000022e03-160.dat	upx
behavioral1/memory/3740-170-0x0000000000280000-0x00000000007A9000-memory.dmp	upx
behavioral1/memory/4432-145-0x0000000000280000-0x00000000007A9000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe = "0"	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	bIsl5z2cOxJuSOrqa6oQiczN.exe
File opened (read-only)	\??\F:	bIsl5z2cOxJuSOrqa6oQiczN.exe
File opened (read-only)	\??\D:	bIsl5z2cOxJuSOrqa6oQiczN.exe
File opened (read-only)	\??\F:	bIsl5z2cOxJuSOrqa6oQiczN.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4348 set thread context of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qvOerqhMqQmmMYKPtttIEYIO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	qvOerqhMqQmmMYKPtttIEYIO.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1276	qvOerqhMqQmmMYKPtttIEYIO.exe
1276	qvOerqhMqQmmMYKPtttIEYIO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	CasPol.exe
Token: SeDebugPrivilege	1028	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3748	Broom.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1028	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	93
PID 4348 wrote to memory of 1028	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	93
PID 4348 wrote to memory of 1028	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	93
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 4348 wrote to memory of 3076	4348	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe	95
PID 3076 wrote to memory of 1276	3076	CasPol.exe	98
PID 3076 wrote to memory of 1276	3076	CasPol.exe	98
PID 3076 wrote to memory of 1276	3076	CasPol.exe	98
PID 3076 wrote to memory of 2332	3076	CasPol.exe	99
PID 3076 wrote to memory of 2332	3076	CasPol.exe	99
PID 3076 wrote to memory of 2332	3076	CasPol.exe	99
PID 3076 wrote to memory of 3848	3076	CasPol.exe	100
PID 3076 wrote to memory of 3848	3076	CasPol.exe	100
PID 3076 wrote to memory of 3848	3076	CasPol.exe	100
PID 2332 wrote to memory of 3748	2332	ZPxqZUYwCbqXK8E7dXSyoNh1.exe	101
PID 2332 wrote to memory of 3748	2332	ZPxqZUYwCbqXK8E7dXSyoNh1.exe	101
PID 2332 wrote to memory of 3748	2332	ZPxqZUYwCbqXK8E7dXSyoNh1.exe	101
PID 3076 wrote to memory of 3792	3076	CasPol.exe	102
PID 3076 wrote to memory of 3792	3076	CasPol.exe	102
PID 3076 wrote to memory of 3792	3076	CasPol.exe	102
PID 3076 wrote to memory of 3368	3076	CasPol.exe	104
PID 3076 wrote to memory of 3368	3076	CasPol.exe	104
PID 3076 wrote to memory of 3368	3076	CasPol.exe	104
PID 3792 wrote to memory of 2284	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	105
PID 3792 wrote to memory of 2284	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	105
PID 3792 wrote to memory of 2284	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	105
PID 3792 wrote to memory of 4956	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	107
PID 3792 wrote to memory of 4956	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	107
PID 3792 wrote to memory of 4956	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	107
PID 3368 wrote to memory of 4324	3368	hw1JdVWBDLFVPwXILIb6DdTM.exe	108
PID 3368 wrote to memory of 4324	3368	hw1JdVWBDLFVPwXILIb6DdTM.exe	108
PID 3368 wrote to memory of 4324	3368	hw1JdVWBDLFVPwXILIb6DdTM.exe	108
PID 3792 wrote to memory of 4432	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	110
PID 3792 wrote to memory of 4432	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	110
PID 3792 wrote to memory of 4432	3792	bIsl5z2cOxJuSOrqa6oQiczN.exe	110
PID 4432 wrote to memory of 3740	4432	bIsl5z2cOxJuSOrqa6oQiczN.exe	111
PID 4432 wrote to memory of 3740	4432	bIsl5z2cOxJuSOrqa6oQiczN.exe	111
PID 4432 wrote to memory of 3740	4432	bIsl5z2cOxJuSOrqa6oQiczN.exe	111
PID 4324 wrote to memory of 5048	4324	Install.exe	112
PID 4324 wrote to memory of 5048	4324	Install.exe	112
PID 4324 wrote to memory of 5048	4324	Install.exe	112
PID 5048 wrote to memory of 1252	5048	Install.exe	113
PID 5048 wrote to memory of 1252	5048	Install.exe	113
PID 5048 wrote to memory of 1252	5048	Install.exe	113
PID 5048 wrote to memory of 2856	5048	Install.exe	116
PID 5048 wrote to memory of 2856	5048	Install.exe	116
PID 5048 wrote to memory of 2856	5048	Install.exe	116

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe

C:\Users\Admin\AppData\Local\Temp\addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe
"C:\Users\Admin\AppData\Local\Temp\addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe"
1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\Pictures\qvOerqhMqQmmMYKPtttIEYIO.exe
    "C:\Users\Admin\Pictures\qvOerqhMqQmmMYKPtttIEYIO.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1276
- - C:\Users\Admin\Pictures\ZPxqZUYwCbqXK8E7dXSyoNh1.exe
    "C:\Users\Admin\Pictures\ZPxqZUYwCbqXK8E7dXSyoNh1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
      C:\Users\Admin\AppData\Local\Temp\Broom.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3748
- - C:\Users\Admin\Pictures\eIHrglttdI1sUFxOEGP5WKa0.exe
    "C:\Users\Admin\Pictures\eIHrglttdI1sUFxOEGP5WKa0.exe"
    3⤵
    - Executes dropped EXE
    PID:3848
- - C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe
    "C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe" --silent --allusers=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe
      C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.13 --initial-client-data=0x294,0x2a8,0x2c8,0x2a4,0x2ec,0x6f4774f0,0x6f477500,0x6f47750c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\bIsl5z2cOxJuSOrqa6oQiczN.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\bIsl5z2cOxJuSOrqa6oQiczN.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4956
  - - C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe
      "C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3792 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231117011050" --session-guid=56287ba0-662c-4f48-96b7-177328a3150a --server-tracking-blob=MjJlMWZjZjIxZTJjNmU0MzU5ZjcxMjM5MmY1ODFiYzk5YjZmNGMyMWFmYzg4YjVmNTY2YjE5MzU0ZGVmZTUzMTp7ImNvdW50cnkiOiJOTCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMDE4MzQzNy43ODgxIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI1MWFlYjJmYi1mNTZkLTQwMmEtOWM3ZS1iNTg3MDI1ZmEyNjgifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=CC04000000000000
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe
        
        C:\Users\Admin\Pictures\bIsl5z2cOxJuSOrqa6oQiczN.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.13 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x6df974f0,0x6df97500,0x6df9750c
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3740
- - C:\Users\Admin\Pictures\hw1JdVWBDLFVPwXILIb6DdTM.exe
    "C:\Users\Admin\Pictures\hw1JdVWBDLFVPwXILIb6DdTM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\7zSA3A2.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\7zSC8ED.tmp\Install.exe
        
        .\Install.exe /vMYCdidKN "385118" /S
        5⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:5048
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:1252
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery