glupteba | 3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3

Processes:

NYTzCBZjsqecAwLqE3Fmi2tp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\AppCache\\Host\\apphost.exe\" run"	NYTzCBZjsqecAwLqE3Fmi2tp.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

Processes:

jdwZajcq8cUHu4Cliyt6PvAk.exeupdater.exe

description	pid	process	target process
PID 1948 created 3188	1948	jdwZajcq8cUHu4Cliyt6PvAk.exe	Explorer.EXE
PID 1948 created 3188	1948	jdwZajcq8cUHu4Cliyt6PvAk.exe	Explorer.EXE
PID 1948 created 3188	1948	jdwZajcq8cUHu4Cliyt6PvAk.exe	Explorer.EXE
PID 1948 created 3188	1948	jdwZajcq8cUHu4Cliyt6PvAk.exe	Explorer.EXE
PID 1948 created 3188	1948	jdwZajcq8cUHu4Cliyt6PvAk.exe	Explorer.EXE
PID 1948 created 3188	1948	jdwZajcq8cUHu4Cliyt6PvAk.exe	Explorer.EXE
PID 2620 created 3188	2620	updater.exe	Explorer.EXE
PID 2620 created 3188	2620	updater.exe	Explorer.EXE
PID 2620 created 3188	2620	updater.exe	Explorer.EXE
PID 2620 created 3188	2620	updater.exe	Explorer.EXE
PID 2620 created 3188	2620	updater.exe	Explorer.EXE
PID 2620 created 3188	2620	updater.exe	Explorer.EXE

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

Processes:

3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe = "0"	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

NYTzCBZjsqecAwLqE3Fmi2tp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	NYTzCBZjsqecAwLqE3Fmi2tp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\AppCacheHost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\AppCache\\Host\\apphost.exe\" run"	NYTzCBZjsqecAwLqE3Fmi2tp.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

Processes:

jdwZajcq8cUHu4Cliyt6PvAk.exeupdater.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	jdwZajcq8cUHu4Cliyt6PvAk.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

868 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

pid	process
868	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

Processes:

NYTzCBZjsqecAwLqE3Fmi2tp.exe3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation	NYTzCBZjsqecAwLqE3Fmi2tp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

Drops startup file 9 IoCs

Processes:

CasPol.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a63Kxrwu3eDNFMoaUSVTKnL3.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HpOQijUVonZA08g20ssAzvRH.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dhVOBhjeMbGuw6vO47Add3JY.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nK52ukOY3T8Jcssgc5hH3tWV.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UhzWiAXA9AnnQLJ3ZFlktplM.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rPApjjwycMPrZxhEaX0AnScT.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GtZrCLGXwQW79zO5YLJTcxvW.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\azGVEr0p6nwp19HnQIqrDEYq.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Qxw0N6p3K3xuYvb3pt1ieSgC.bat	CasPol.exe

Executes dropped EXE 20 IoCs

Processes:

NYTzCBZjsqecAwLqE3Fmi2tp.exeZti3zCTi94E735zxrLrKOC7S.exem0Ky1ZovOeYjny1mdFPv8l0K.exeVo4ockirxs7DPYbPscJ15FFq.exe7iufLYWWaZ9awLMVFF2IBDY1.exejdwZajcq8cUHu4Cliyt6PvAk.exeBroom.exeWIgH9EJ0lY733XYr7bR79vMm.exeVo4ockirxs7DPYbPscJ15FFq.tmpWIgH9EJ0lY733XYr7bR79vMm.exeVolumeUTIL.exeWIgH9EJ0lY733XYr7bR79vMm.exeWIgH9EJ0lY733XYr7bR79vMm.exeVolumeUTIL.exeWIgH9EJ0lY733XYr7bR79vMm.exeupdater.exeAssistant_103.0.4928.25_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exe7iufLYWWaZ9awLMVFF2IBDY1.exe

pid	process
2040	NYTzCBZjsqecAwLqE3Fmi2tp.exe
4232	Zti3zCTi94E735zxrLrKOC7S.exe
1980	m0Ky1ZovOeYjny1mdFPv8l0K.exe
4172	Vo4ockirxs7DPYbPscJ15FFq.exe
920	7iufLYWWaZ9awLMVFF2IBDY1.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
4728	Broom.exe
2336	WIgH9EJ0lY733XYr7bR79vMm.exe
64	Vo4ockirxs7DPYbPscJ15FFq.tmp
3852	WIgH9EJ0lY733XYr7bR79vMm.exe
4956	VolumeUTIL.exe
1316	WIgH9EJ0lY733XYr7bR79vMm.exe
1564	WIgH9EJ0lY733XYr7bR79vMm.exe
4884	VolumeUTIL.exe
2672	WIgH9EJ0lY733XYr7bR79vMm.exe
2620	updater.exe
2240	Assistant_103.0.4928.25_Setup.exe_sfx.exe
4252	assistant_installer.exe
3332	assistant_installer.exe
892	7iufLYWWaZ9awLMVFF2IBDY1.exe

Loads dropped DLL 12 IoCs

Processes:

WIgH9EJ0lY733XYr7bR79vMm.exeVo4ockirxs7DPYbPscJ15FFq.tmpWIgH9EJ0lY733XYr7bR79vMm.exeWIgH9EJ0lY733XYr7bR79vMm.exeWIgH9EJ0lY733XYr7bR79vMm.exeWIgH9EJ0lY733XYr7bR79vMm.exeassistant_installer.exeassistant_installer.exe

pid	process
2336	WIgH9EJ0lY733XYr7bR79vMm.exe
64	Vo4ockirxs7DPYbPscJ15FFq.tmp
64	Vo4ockirxs7DPYbPscJ15FFq.tmp
64	Vo4ockirxs7DPYbPscJ15FFq.tmp
3852	WIgH9EJ0lY733XYr7bR79vMm.exe
1316	WIgH9EJ0lY733XYr7bR79vMm.exe
1564	WIgH9EJ0lY733XYr7bR79vMm.exe
2672	WIgH9EJ0lY733XYr7bR79vMm.exe
4252	assistant_installer.exe
4252	assistant_installer.exe
3332	assistant_installer.exe
3332	assistant_installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe	upx
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe	upx
behavioral2/memory/2336-146-0x00000000003F0000-0x0000000000918000-memory.dmp	upx
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe	upx
behavioral2/memory/3852-168-0x00000000003F0000-0x0000000000918000-memory.dmp	upx
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\WIgH9EJ0lY733XYr7bR79vMm.exe	upx
behavioral2/memory/1316-226-0x0000000000730000-0x0000000000C58000-memory.dmp	upx
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe	upx
behavioral2/memory/1564-239-0x00000000003F0000-0x0000000000918000-memory.dmp	upx
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe	upx
behavioral2/memory/2672-246-0x00000000003F0000-0x0000000000918000-memory.dmp	upx
behavioral2/memory/3852-296-0x00000000003F0000-0x0000000000918000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 152.89.198.214

description	ioc
Destination IP	152.89.198.214

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

Processes:

3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe = "0"	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

NYTzCBZjsqecAwLqE3Fmi2tp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AppCacheHost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\AppCache\\Host\\apphost.exe\" run"	NYTzCBZjsqecAwLqE3Fmi2tp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

Processes:

3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

WIgH9EJ0lY733XYr7bR79vMm.exeWIgH9EJ0lY733XYr7bR79vMm.exe

description	ioc	process
File opened (read-only)	\??\F:	WIgH9EJ0lY733XYr7bR79vMm.exe
File opened (read-only)	\??\D:	WIgH9EJ0lY733XYr7bR79vMm.exe
File opened (read-only)	\??\F:	WIgH9EJ0lY733XYr7bR79vMm.exe
File opened (read-only)	\??\D:	WIgH9EJ0lY733XYr7bR79vMm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 4 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exeupdater.exe

description	pid	process	target process
PID 4948 set thread context of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 2620 set thread context of 2860	2620	updater.exe	conhost.exe
PID 2620 set thread context of 1760	2620	updater.exe	explorer.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

7iufLYWWaZ9awLMVFF2IBDY1.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 7iufLYWWaZ9awLMVFF2IBDY1.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	7iufLYWWaZ9awLMVFF2IBDY1.exe

Drops file in Program Files directory 20 IoCs

Processes:

Vo4ockirxs7DPYbPscJ15FFq.tmpjdwZajcq8cUHu4Cliyt6PvAk.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-LS7P3.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-KFN5P.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-PS36J.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-C6LLN.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-VU72E.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-3LDDR.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-7G3DM.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-MVUDS.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-RI871.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-LCCM3.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-QG445.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-UOCDK.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	jdwZajcq8cUHu4Cliyt6PvAk.exe
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-MU2UM.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-83QJK.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-H7ECB.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-2TKUP.tmp	Vo4ockirxs7DPYbPscJ15FFq.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat	Vo4ockirxs7DPYbPscJ15FFq.tmp

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2156 sc.exe
1396 sc.exe
4476 sc.exe
4876 sc.exe
112 sc.exe
4568 sc.exe
2796 sc.exe
2868 sc.exe
3916 sc.exe
3392 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4764 4232 WerFault.exe Zti3zCTi94E735zxrLrKOC7S.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4648 schtasks.exe
3504 schtasks.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4820 taskkill.exe

pid	process
2156	sc.exe
1396	sc.exe
4476	sc.exe
4876	sc.exe
112	sc.exe
4568	sc.exe
2796	sc.exe
2868	sc.exe
3916	sc.exe
3392	sc.exe

pid	pid_target	process	target process
4764	4232	WerFault.exe	Zti3zCTi94E735zxrLrKOC7S.exe

pid	process
4648	schtasks.exe
3504	schtasks.exe

pid	process
4820	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

7iufLYWWaZ9awLMVFF2IBDY1.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	7iufLYWWaZ9awLMVFF2IBDY1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

WIgH9EJ0lY733XYr7bR79vMm.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	WIgH9EJ0lY733XYr7bR79vMm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	WIgH9EJ0lY733XYr7bR79vMm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	WIgH9EJ0lY733XYr7bR79vMm.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exejdwZajcq8cUHu4Cliyt6PvAk.exepowershell.exepowershell.exeupdater.exepowershell.exe7iufLYWWaZ9awLMVFF2IBDY1.exeexplorer.exepowershell.exe

pid	process
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
1948	jdwZajcq8cUHu4Cliyt6PvAk.exe
2760	powershell.exe
2760	powershell.exe
2760	powershell.exe
2620	updater.exe
2620	updater.exe
4976	powershell.exe
4976	powershell.exe
4976	powershell.exe
920	7iufLYWWaZ9awLMVFF2IBDY1.exe
920	7iufLYWWaZ9awLMVFF2IBDY1.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
2620	updater.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1964	powershell.exe
1964	powershell.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1964	powershell.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

664

pid	process
664

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

CasPol.exepowershell.exetaskkill.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowershell.exe7iufLYWWaZ9awLMVFF2IBDY1.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeupdater.exeexplorer.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4320	CasPol.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	4820	taskkill.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeShutdownPrivilege	4060	powercfg.exe
Token: SeCreatePagefilePrivilege	4060	powercfg.exe
Token: SeShutdownPrivilege	4980	powercfg.exe
Token: SeCreatePagefilePrivilege	4980	powercfg.exe
Token: SeShutdownPrivilege	4328	powercfg.exe
Token: SeCreatePagefilePrivilege	4328	powercfg.exe
Token: SeShutdownPrivilege	3916	powercfg.exe
Token: SeCreatePagefilePrivilege	3916	powercfg.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	920	7iufLYWWaZ9awLMVFF2IBDY1.exe
Token: SeImpersonatePrivilege	920	7iufLYWWaZ9awLMVFF2IBDY1.exe
Token: SeShutdownPrivilege	4056	powercfg.exe
Token: SeCreatePagefilePrivilege	4056	powercfg.exe
Token: SeShutdownPrivilege	1368	powercfg.exe
Token: SeCreatePagefilePrivilege	1368	powercfg.exe
Token: SeShutdownPrivilege	396	powercfg.exe
Token: SeCreatePagefilePrivilege	396	powercfg.exe
Token: SeShutdownPrivilege	4340	powercfg.exe
Token: SeCreatePagefilePrivilege	4340	powercfg.exe
Token: SeDebugPrivilege	2620	updater.exe
Token: SeLockMemoryPrivilege	1760	explorer.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

4728 Broom.exe

pid	process
4728	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exeCasPol.exeNYTzCBZjsqecAwLqE3Fmi2tp.exem0Ky1ZovOeYjny1mdFPv8l0K.exeVo4ockirxs7DPYbPscJ15FFq.exeWIgH9EJ0lY733XYr7bR79vMm.exeVo4ockirxs7DPYbPscJ15FFq.tmpWIgH9EJ0lY733XYr7bR79vMm.exe

description	pid	process	target process
PID 4948 wrote to memory of 5016	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	powershell.exe
PID 4948 wrote to memory of 5016	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	powershell.exe
PID 4948 wrote to memory of 5016	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	powershell.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4948 wrote to memory of 4320	4948	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe	CasPol.exe
PID 4320 wrote to memory of 2040	4320	CasPol.exe	NYTzCBZjsqecAwLqE3Fmi2tp.exe
PID 4320 wrote to memory of 2040	4320	CasPol.exe	NYTzCBZjsqecAwLqE3Fmi2tp.exe
PID 4320 wrote to memory of 2040	4320	CasPol.exe	NYTzCBZjsqecAwLqE3Fmi2tp.exe
PID 4320 wrote to memory of 4232	4320	CasPol.exe	Zti3zCTi94E735zxrLrKOC7S.exe
PID 4320 wrote to memory of 4232	4320	CasPol.exe	Zti3zCTi94E735zxrLrKOC7S.exe
PID 4320 wrote to memory of 4232	4320	CasPol.exe	Zti3zCTi94E735zxrLrKOC7S.exe
PID 4320 wrote to memory of 1980	4320	CasPol.exe	m0Ky1ZovOeYjny1mdFPv8l0K.exe
PID 4320 wrote to memory of 1980	4320	CasPol.exe	m0Ky1ZovOeYjny1mdFPv8l0K.exe
PID 4320 wrote to memory of 1980	4320	CasPol.exe	m0Ky1ZovOeYjny1mdFPv8l0K.exe
PID 4320 wrote to memory of 4172	4320	CasPol.exe	Vo4ockirxs7DPYbPscJ15FFq.exe
PID 4320 wrote to memory of 4172	4320	CasPol.exe	Vo4ockirxs7DPYbPscJ15FFq.exe
PID 4320 wrote to memory of 4172	4320	CasPol.exe	Vo4ockirxs7DPYbPscJ15FFq.exe
PID 2040 wrote to memory of 4820	2040	NYTzCBZjsqecAwLqE3Fmi2tp.exe	taskkill.exe
PID 2040 wrote to memory of 4820	2040	NYTzCBZjsqecAwLqE3Fmi2tp.exe	taskkill.exe
PID 2040 wrote to memory of 4820	2040	NYTzCBZjsqecAwLqE3Fmi2tp.exe	taskkill.exe
PID 4320 wrote to memory of 920	4320	CasPol.exe	7iufLYWWaZ9awLMVFF2IBDY1.exe
PID 4320 wrote to memory of 920	4320	CasPol.exe	7iufLYWWaZ9awLMVFF2IBDY1.exe
PID 4320 wrote to memory of 920	4320	CasPol.exe	7iufLYWWaZ9awLMVFF2IBDY1.exe
PID 4320 wrote to memory of 1948	4320	CasPol.exe	jdwZajcq8cUHu4Cliyt6PvAk.exe
PID 4320 wrote to memory of 1948	4320	CasPol.exe	jdwZajcq8cUHu4Cliyt6PvAk.exe
PID 1980 wrote to memory of 4728	1980	m0Ky1ZovOeYjny1mdFPv8l0K.exe	Broom.exe
PID 1980 wrote to memory of 4728	1980	m0Ky1ZovOeYjny1mdFPv8l0K.exe	Broom.exe
PID 1980 wrote to memory of 4728	1980	m0Ky1ZovOeYjny1mdFPv8l0K.exe	Broom.exe
PID 4320 wrote to memory of 2336	4320	CasPol.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 4320 wrote to memory of 2336	4320	CasPol.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 4320 wrote to memory of 2336	4320	CasPol.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 4172 wrote to memory of 64	4172	Vo4ockirxs7DPYbPscJ15FFq.exe	Vo4ockirxs7DPYbPscJ15FFq.tmp
PID 4172 wrote to memory of 64	4172	Vo4ockirxs7DPYbPscJ15FFq.exe	Vo4ockirxs7DPYbPscJ15FFq.tmp
PID 4172 wrote to memory of 64	4172	Vo4ockirxs7DPYbPscJ15FFq.exe	Vo4ockirxs7DPYbPscJ15FFq.tmp
PID 2336 wrote to memory of 3852	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 2336 wrote to memory of 3852	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 2336 wrote to memory of 3852	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 64 wrote to memory of 1860	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	schtasks.exe
PID 64 wrote to memory of 1860	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	schtasks.exe
PID 64 wrote to memory of 1860	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	schtasks.exe
PID 64 wrote to memory of 4956	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	VolumeUTIL.exe
PID 64 wrote to memory of 4956	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	VolumeUTIL.exe
PID 64 wrote to memory of 4956	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	VolumeUTIL.exe
PID 2336 wrote to memory of 1316	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 2336 wrote to memory of 1316	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 2336 wrote to memory of 1316	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 2336 wrote to memory of 1564	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 2336 wrote to memory of 1564	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 2336 wrote to memory of 1564	2336	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 64 wrote to memory of 3220	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	net.exe
PID 64 wrote to memory of 3220	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	net.exe
PID 64 wrote to memory of 3220	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	net.exe
PID 64 wrote to memory of 4884	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	VolumeUTIL.exe
PID 64 wrote to memory of 4884	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	VolumeUTIL.exe
PID 64 wrote to memory of 4884	64	Vo4ockirxs7DPYbPscJ15FFq.tmp	VolumeUTIL.exe
PID 1564 wrote to memory of 2672	1564	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 1564 wrote to memory of 2672	1564	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe
PID 1564 wrote to memory of 2672	1564	WIgH9EJ0lY733XYr7bR79vMm.exe	WIgH9EJ0lY733XYr7bR79vMm.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe
"C:\Users\Admin\AppData\Local\Temp\3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe"
2⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3e9c5961ee8a2a0c30539e79f9ddfb8870f5488d9571562fb1d90c8440dffdf3exe.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
3⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\Pictures\Zti3zCTi94E735zxrLrKOC7S.exe
"C:\Users\Admin\Pictures\Zti3zCTi94E735zxrLrKOC7S.exe"
4⤵
- Executes dropped EXE
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 2236
5⤵
- Program crash
PID:4764

C:\Users\Admin\Pictures\m0Ky1ZovOeYjny1mdFPv8l0K.exe
"C:\Users\Admin\Pictures\m0Ky1ZovOeYjny1mdFPv8l0K.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4728

C:\Users\Admin\Pictures\Vo4ockirxs7DPYbPscJ15FFq.exe
"C:\Users\Admin\Pictures\Vo4ockirxs7DPYbPscJ15FFq.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172

C:\Users\Admin\AppData\Local\Temp\is-H2FGJ.tmp\Vo4ockirxs7DPYbPscJ15FFq.tmp
"C:\Users\Admin\AppData\Local\Temp\is-H2FGJ.tmp\Vo4ockirxs7DPYbPscJ15FFq.tmp" /SL5="$70170,3236603,54272,C:\Users\Admin\Pictures\Vo4ockirxs7DPYbPscJ15FFq.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:64

C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -i
6⤵
- Executes dropped EXE
PID:4956

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
6⤵
PID:1860

C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -s
6⤵
- Executes dropped EXE
PID:4884

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 29
6⤵
PID:3220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 29
7⤵
PID:4556

C:\Users\Admin\Pictures\7iufLYWWaZ9awLMVFF2IBDY1.exe
"C:\Users\Admin\Pictures\7iufLYWWaZ9awLMVFF2IBDY1.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Users\Admin\Pictures\7iufLYWWaZ9awLMVFF2IBDY1.exe
"C:\Users\Admin\Pictures\7iufLYWWaZ9awLMVFF2IBDY1.exe"
5⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
PID:892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
6⤵
PID:4972

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
7⤵
- Modifies Windows Firewall
PID:868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:3288

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
6⤵
PID:556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
PID:1784

C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe
"C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe" --silent --allusers=0
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.21 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x6f6774f0,0x6f677500,0x6f67750c
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3852

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\WIgH9EJ0lY733XYr7bR79vMm.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\WIgH9EJ0lY733XYr7bR79vMm.exe" --version
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316

C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe
"C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2336 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231129164459" --session-guid=2b6a200b-4ec4-4f4d-82ea-4196f1a2376e --server-tracking-blob=NTNkZjE4NDA3NjNkMWRlOGVjOTA1NjlkY2I2ZDBjZjQwMTA4ZjJiN2FkMmYwZTVlMjBkMWQwMzQ3MjZmNWQyZDp7ImNvdW50cnkiOiJOTCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMTI3NjI5My40MTYyIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI4N2YwOWFlZC1mN2VkLTQ4ZDYtYjJkMC1jOWYzMTM1MmZlYWIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1C05000000000000
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe
C:\Users\Admin\Pictures\WIgH9EJ0lY733XYr7bR79vMm.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.21 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x6dba74f0,0x6dba7500,0x6dba750c
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311291644591\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311291644591\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe"
5⤵
- Executes dropped EXE
PID:2240

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311291644591\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311291644591\assistant\assistant_installer.exe" --version
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4252

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311291644591\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311291644591\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.25 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xf71588,0xf71598,0xf715a4
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3332

C:\Users\Admin\Pictures\jdwZajcq8cUHu4Cliyt6PvAk.exe
"C:\Users\Admin\Pictures\jdwZajcq8cUHu4Cliyt6PvAk.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1948

C:\Users\Admin\Pictures\NYTzCBZjsqecAwLqE3Fmi2tp.exe
"C:\Users\Admin\Pictures\NYTzCBZjsqecAwLqE3Fmi2tp.exe" /S
4⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:3912

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:2156

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:112

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1396

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4476

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4568

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:752

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1692

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\tlxvacrdjkek.xml"
2⤵
- Creates scheduled task(s)
PID:4648

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:3648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:5048

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:2796

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2868

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3916

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:3392

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4876

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:4820

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\tlxvacrdjkek.xml"
2⤵
- Creates scheduled task(s)
PID:3504

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:2860

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /IM apphost.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4232 -ip 4232
1⤵
PID:1404

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery