e5f297504744c01bec8a5903f55b7fcc149e39a334a1c1cb80960878604b5012

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\tmp.exe = "0"	tmp.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	uUsATqYht49p8KEe0UCBDQwo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	tmp.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rKsKMDxgKTlKIwO271sQvHcN.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wOabFbJeiDLjCrojQa8cvNJD.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6sG041ceG3k8lepX0UkX356N.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pXcEefoh6Yaf84BhuYFcjEaI.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2yNgaCwEvVOVs5ttiMEqMor7.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BJJZie5yywIftkMByjvHTGfH.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\swgRrjawW4IL5o2WAC8lWcO2.bat	CasPol.exe

Executes dropped EXE 15 IoCs

pid	Process
1708	uUsATqYht49p8KEe0UCBDQwo.exe
4228	PTFp2RYaA4Z2VLoN4ybairXr.exe
2240	Mm6XupmbUnyBAFgQODnYVH0k.exe
1244	QWmX6gdJ1Rx3WjK4hxFNCbi0.exe
2348	o0U78GrYDx1xrDpmUaQnRnfR.exe
3160	Mm6XupmbUnyBAFgQODnYVH0k.exe
3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp
3136	Conhost.exe
2320	Mm6XupmbUnyBAFgQODnYVH0k.exe
4812	TVLand.exe
1300	Mm6XupmbUnyBAFgQODnYVH0k.exe
1876	TVLand.exe
3876	Assistant_103.0.4928.25_Setup.exe_sfx.exe
3928	assistant_installer.exe
3748	assistant_installer.exe

Loads dropped DLL 12 IoCs

pid	Process
2240	Mm6XupmbUnyBAFgQODnYVH0k.exe
3160	Mm6XupmbUnyBAFgQODnYVH0k.exe
3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp
3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp
3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp
3136	Conhost.exe
2320	Mm6XupmbUnyBAFgQODnYVH0k.exe
1300	Mm6XupmbUnyBAFgQODnYVH0k.exe
3928	assistant_installer.exe
3928	assistant_installer.exe
3748	assistant_installer.exe
3748	assistant_installer.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002310a-78.dat	upx
behavioral2/memory/2240-104-0x0000000000E50000-0x0000000001378000-memory.dmp	upx
behavioral2/files/0x000600000002310a-96.dat	upx
behavioral2/files/0x000600000002310a-118.dat	upx
behavioral2/memory/3160-123-0x0000000000E50000-0x0000000001378000-memory.dmp	upx
behavioral2/files/0x000600000002310a-127.dat	upx
behavioral2/files/0x0006000000023121-133.dat	upx
behavioral2/memory/3136-135-0x0000000000D40000-0x0000000001268000-memory.dmp	upx
behavioral2/memory/3136-170-0x0000000000D40000-0x0000000001268000-memory.dmp	upx
behavioral2/files/0x000600000002310a-172.dat	upx
behavioral2/memory/2320-208-0x0000000000E50000-0x0000000001378000-memory.dmp	upx
behavioral2/memory/1300-228-0x0000000000E50000-0x0000000001378000-memory.dmp	upx
behavioral2/memory/2240-230-0x0000000000E50000-0x0000000001378000-memory.dmp	upx
behavioral2/files/0x000600000002310a-219.dat	upx
behavioral2/memory/1300-258-0x0000000000E50000-0x0000000001378000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\tmp.exe = "0"	tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	Mm6XupmbUnyBAFgQODnYVH0k.exe
File opened (read-only)	\??\D:	Mm6XupmbUnyBAFgQODnYVH0k.exe
File opened (read-only)	\??\F:	Mm6XupmbUnyBAFgQODnYVH0k.exe
File opened (read-only)	\??\D:	Mm6XupmbUnyBAFgQODnYVH0k.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 1604	3828	tmp.exe	90

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\TVLand\is-DBGMB.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-IKFCA.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-4FF5S.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-SO4HN.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-7F630.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File opened for modification	C:\Program Files (x86)\Common Files\TVLand\TVLand.exe	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\unins000.dat	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-9P4G1.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-0PPUS.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-JC7B9.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-FV9LB.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\UIText\is-38EQE.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\UIText\is-SDUR5.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File opened for modification	C:\Program Files (x86)\Common Files\TVLand\unins000.dat	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-6PKVQ.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-1ATIE.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-49FKV.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-QVMD5.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-291GP.tmp	o0U78GrYDx1xrDpmUaQnRnfR.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	1708	WerFault.exe	93

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	uUsATqYht49p8KEe0UCBDQwo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	uUsATqYht49p8KEe0UCBDQwo.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3888	timeout.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	Mm6XupmbUnyBAFgQODnYVH0k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Mm6XupmbUnyBAFgQODnYVH0k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Mm6XupmbUnyBAFgQODnYVH0k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Mm6XupmbUnyBAFgQODnYVH0k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Mm6XupmbUnyBAFgQODnYVH0k.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
1708	uUsATqYht49p8KEe0UCBDQwo.exe
1708	uUsATqYht49p8KEe0UCBDQwo.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	1604	CasPol.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4868	3828	tmp.exe	88
PID 3828 wrote to memory of 4868	3828	tmp.exe	88
PID 3828 wrote to memory of 4868	3828	tmp.exe	88
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 3828 wrote to memory of 1604	3828	tmp.exe	90
PID 1604 wrote to memory of 1708	1604	CasPol.exe	93
PID 1604 wrote to memory of 1708	1604	CasPol.exe	93
PID 1604 wrote to memory of 1708	1604	CasPol.exe	93
PID 1604 wrote to memory of 4228	1604	CasPol.exe	91
PID 1604 wrote to memory of 4228	1604	CasPol.exe	91
PID 1604 wrote to memory of 4228	1604	CasPol.exe	91
PID 1604 wrote to memory of 2240	1604	CasPol.exe	92
PID 1604 wrote to memory of 2240	1604	CasPol.exe	92
PID 1604 wrote to memory of 2240	1604	CasPol.exe	92
PID 1604 wrote to memory of 1244	1604	CasPol.exe	95
PID 1604 wrote to memory of 1244	1604	CasPol.exe	95
PID 1604 wrote to memory of 1244	1604	CasPol.exe	95
PID 1604 wrote to memory of 2348	1604	CasPol.exe	94
PID 1604 wrote to memory of 2348	1604	CasPol.exe	94
PID 1604 wrote to memory of 2348	1604	CasPol.exe	94
PID 2240 wrote to memory of 3160	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	96
PID 2240 wrote to memory of 3160	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	96
PID 2240 wrote to memory of 3160	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	96
PID 2348 wrote to memory of 3260	2348	o0U78GrYDx1xrDpmUaQnRnfR.exe	97
PID 2348 wrote to memory of 3260	2348	o0U78GrYDx1xrDpmUaQnRnfR.exe	97
PID 2348 wrote to memory of 3260	2348	o0U78GrYDx1xrDpmUaQnRnfR.exe	97
PID 2240 wrote to memory of 3136	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	112
PID 2240 wrote to memory of 3136	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	112
PID 2240 wrote to memory of 3136	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	112
PID 2240 wrote to memory of 2320	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	99
PID 2240 wrote to memory of 2320	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	99
PID 2240 wrote to memory of 2320	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	99
PID 3260 wrote to memory of 4328	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	106
PID 3260 wrote to memory of 4328	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	106
PID 3260 wrote to memory of 4328	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	106
PID 3260 wrote to memory of 4812	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	100
PID 3260 wrote to memory of 4812	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	100
PID 3260 wrote to memory of 4812	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	100
PID 2320 wrote to memory of 1300	2320	Mm6XupmbUnyBAFgQODnYVH0k.exe	101
PID 2320 wrote to memory of 1300	2320	Mm6XupmbUnyBAFgQODnYVH0k.exe	101
PID 2320 wrote to memory of 1300	2320	Mm6XupmbUnyBAFgQODnYVH0k.exe	101
PID 3260 wrote to memory of 4548	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	104
PID 3260 wrote to memory of 4548	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	104
PID 3260 wrote to memory of 4548	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	104
PID 3260 wrote to memory of 1876	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	103
PID 3260 wrote to memory of 1876	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	103
PID 3260 wrote to memory of 1876	3260	o0U78GrYDx1xrDpmUaQnRnfR.tmp	103
PID 4548 wrote to memory of 32	4548	net.exe	107
PID 4548 wrote to memory of 32	4548	net.exe	107
PID 4548 wrote to memory of 32	4548	net.exe	107
PID 1708 wrote to memory of 808	1708	uUsATqYht49p8KEe0UCBDQwo.exe	110
PID 1708 wrote to memory of 808	1708	uUsATqYht49p8KEe0UCBDQwo.exe	110
PID 1708 wrote to memory of 808	1708	uUsATqYht49p8KEe0UCBDQwo.exe	110
PID 808 wrote to memory of 3888	808	cmd.exe	114
PID 808 wrote to memory of 3888	808	cmd.exe	114
PID 808 wrote to memory of 3888	808	cmd.exe	114
PID 2240 wrote to memory of 3876	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	115
PID 2240 wrote to memory of 3876	2240	Mm6XupmbUnyBAFgQODnYVH0k.exe	115

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmp.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\Pictures\PTFp2RYaA4Z2VLoN4ybairXr.exe
    "C:\Users\Admin\Pictures\PTFp2RYaA4Z2VLoN4ybairXr.exe"
    3⤵
    - Executes dropped EXE
    PID:4228
- - C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe
    "C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe" --silent --allusers=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe
      C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.21 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6f3a74f0,0x6f3a7500,0x6f3a750c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Mm6XupmbUnyBAFgQODnYVH0k.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Mm6XupmbUnyBAFgQODnYVH0k.exe" --version
      4⤵
      PID:3136
  - - C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe
      "C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2240 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231127222416" --session-guid=02f59107-c0c5-48be-99e0-5e47a23102ee --server-tracking-blob=NjIxNTEyYTQ5Y2M5MDJlYzU0MWQ3Y2U2YWY0YzIxZmM5NDFlMmZhM2VlOTU2ZDgzOTE0ZGRjZGQ2ZTBlYmRhZjp7ImNvdW50cnkiOiJOTCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMTEyMzg1MS4zMDIzIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI0ZDg0ZTM0OC0wMTI5LTRiZTEtYWNmZC0yNWIyM2NmOTRjZDMifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8C05000000000000
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe
        
        C:\Users\Admin\Pictures\Mm6XupmbUnyBAFgQODnYVH0k.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.21 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x2fc,0x6dbf74f0,0x6dbf7500,0x6dbf750c
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311272224161\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311272224161\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311272224161\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311272224161\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311272224161\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311272224161\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.25 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x681588,0x681598,0x6815a4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3748
- - C:\Users\Admin\Pictures\uUsATqYht49p8KEe0UCBDQwo.exe
    "C:\Users\Admin\Pictures\uUsATqYht49p8KEe0UCBDQwo.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\uUsATqYht49p8KEe0UCBDQwo.exe" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:808
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3136
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2028
      4⤵
      Program crash
      PID:2116
- - C:\Users\Admin\Pictures\o0U78GrYDx1xrDpmUaQnRnfR.exe
    "C:\Users\Admin\Pictures\o0U78GrYDx1xrDpmUaQnRnfR.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\is-AMMVR.tmp\o0U78GrYDx1xrDpmUaQnRnfR.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AMMVR.tmp\o0U78GrYDx1xrDpmUaQnRnfR.tmp" /SL5="$3020E,3256312,76288,C:\Users\Admin\Pictures\o0U78GrYDx1xrDpmUaQnRnfR.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Program Files (x86)\Common Files\TVLand\TVLand.exe
        
        "C:\Program Files (x86)\Common Files\TVLand\TVLand.exe" -i
        5⤵
        Executes dropped EXE
        
        PID:4812
    - - C:\Program Files (x86)\Common Files\TVLand\TVLand.exe
        
        "C:\Program Files (x86)\Common Files\TVLand\TVLand.exe" -s
        5⤵
        Executes dropped EXE
        
        PID:1876
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 27
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 27
        6⤵
        
        PID:32
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Query
        5⤵
        
        PID:4328
- - C:\Users\Admin\Pictures\QWmX6gdJ1Rx3WjK4hxFNCbi0.exe
    "C:\Users\Admin\Pictures\QWmX6gdJ1Rx3WjK4hxFNCbi0.exe"
    3⤵
    - Executes dropped EXE
    PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1708 -ip 1708
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery