betabot | d2d90f02ccd7c3fd1b46d667081529a1af8172e4a51feda461c8d250081c3548

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/2756-167-0x0000000001F90000-0x000000000202D000-memory.dmp	family_vidar
behavioral2/memory/2756-172-0x0000000000400000-0x0000000001DDD000-memory.dmp	family_vidar
behavioral2/memory/2756-190-0x0000000000400000-0x0000000001DDD000-memory.dmp	family_vidar
behavioral2/memory/2756-200-0x0000000001F90000-0x000000000202D000-memory.dmp	family_vidar

Looks for VMWare services registry key. 1 TTPs 1 IoCs

evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VMware	powershell.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uq5qcoy755.exe	8B9C.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uq5qcoy755.exe\DisableExceptionChainValidation	8B9C.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "tdlsxhrbz.exe"	explorer.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000400000001e7f1-33.dat	aspack_v212_v242
behavioral2/files/0x000400000001e7ed-94.dat	aspack_v212_v242
behavioral2/files/0x000400000001e7ee-92.dat	aspack_v212_v242
behavioral2/files/0x000300000001e7f3-99.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	1923715e6214c54be40797c3d821fbfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	83904ea3382de84ea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	97A3.exe

Executes dropped EXE 17 IoCs

pid	Process
1984	setup.exe
4968	setup_install.exe
4416	83904ea3382de84ea.exe
2804	setup_install.exe
2328	Sun213b31a7e71d4cf6d.exe
1456	Sun21caad43cbccfb.exe
2756	Sun21688b2b2b63.exe
1608	Sun21cfc7686a.exe
2228	Sun21ab69e87d0.exe
2144	Sun211972de1e.exe
2544	Sun218856081dd1.exe
4392	Sun21dd3b887a3.exe
3204	Sun218856081dd1.tmp
4628	8B9C.exe
1796	97A3.exe
4652	WindowsUpdater.exe
4984	uq5qcoy755.exe

Loads dropped DLL 13 IoCs

pid	Process
4968	setup_install.exe
4968	setup_install.exe
4968	setup_install.exe
4968	setup_install.exe
2804	setup_install.exe
2804	setup_install.exe
2804	setup_install.exe
2804	setup_install.exe
2804	setup_install.exe
2804	setup_install.exe
3204	Sun218856081dd1.tmp
4652	WindowsUpdater.exe
4652	WindowsUpdater.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\uq5qcoy755.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\uq5qcoy755.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\uq5qcoy755.exe\""	powershell.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uq5qcoy755.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8B9C.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

pid	Process
4628	8B9C.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
1952	powershell.exe
1952	powershell.exe
1952	powershell.exe
1952	powershell.exe
4576	explorer.exe
4984	uq5qcoy755.exe
1984	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 23 IoCs

pid	pid_target	Process	procid_target
3700	2804	WerFault.exe	102
3968	2756	WerFault.exe	115
3852	2756	WerFault.exe	115
4956	2756	WerFault.exe	115
1144	2756	WerFault.exe	115
3324	2756	WerFault.exe	115
3148	2756	WerFault.exe	115
1288	2756	WerFault.exe	115
1608	2756	WerFault.exe	115
4492	2756	WerFault.exe	115
3324	2756	WerFault.exe	115
4960	2144	WerFault.exe	119
2064	2756	WerFault.exe	115
2136	2756	WerFault.exe	115
952	2756	WerFault.exe	115
2492	4576	WerFault.exe	147
1812	2756	WerFault.exe	115
1720	2756	WerFault.exe	115
2416	4392	WerFault.exe	121
2612	2756	WerFault.exe	115
2480	2612	WerFault.exe	175
4728	1984	WerFault.exe	168
4568	3288	WerFault.exe	183

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x002000000001e7ee-219.dat	nsis_installer_2
behavioral2/files/0x001400000001e7f1-226.dat	nsis_installer_1
behavioral2/files/0x001400000001e7f1-226.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun21cfc7686a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun21cfc7686a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun21cfc7686a.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	uq5qcoy755.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	uq5qcoy755.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8B9C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8B9C.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1608	Sun21cfc7686a.exe
1608	Sun21cfc7686a.exe
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found
3488	Process not Found

Suspicious behavior: MapViewOfSection 16 IoCs

pid	Process
1608	Sun21cfc7686a.exe
4628	8B9C.exe
4628	8B9C.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4576	explorer.exe
4984	uq5qcoy755.exe
4984	uq5qcoy755.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	Sun213b31a7e71d4cf6d.exe
Token: SeDebugPrivilege	2228	Sun21ab69e87d0.exe
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeDebugPrivilege	4628	8B9C.exe
Token: SeRestorePrivilege	4628	8B9C.exe
Token: SeBackupPrivilege	4628	8B9C.exe
Token: SeLoadDriverPrivilege	4628	8B9C.exe
Token: SeCreatePagefilePrivilege	4628	8B9C.exe
Token: SeShutdownPrivilege	4628	8B9C.exe
Token: SeTakeOwnershipPrivilege	4628	8B9C.exe
Token: SeChangeNotifyPrivilege	4628	8B9C.exe
Token: SeCreateTokenPrivilege	4628	8B9C.exe
Token: SeMachineAccountPrivilege	4628	8B9C.exe
Token: SeSecurityPrivilege	4628	8B9C.exe
Token: SeAssignPrimaryTokenPrivilege	4628	8B9C.exe
Token: SeCreateGlobalPrivilege	4628	8B9C.exe
Token: 33	4628	8B9C.exe
Token: SeDebugPrivilege	4576	explorer.exe
Token: SeRestorePrivilege	4576	explorer.exe
Token: SeBackupPrivilege	4576	explorer.exe
Token: SeLoadDriverPrivilege	4576	explorer.exe
Token: SeCreatePagefilePrivilege	4576	explorer.exe
Token: SeShutdownPrivilege	4576	explorer.exe
Token: SeTakeOwnershipPrivilege	4576	explorer.exe
Token: SeChangeNotifyPrivilege	4576	explorer.exe
Token: SeCreateTokenPrivilege	4576	explorer.exe
Token: SeMachineAccountPrivilege	4576	explorer.exe
Token: SeSecurityPrivilege	4576	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	4576	explorer.exe
Token: SeCreateGlobalPrivilege	4576	explorer.exe
Token: 33	4576	explorer.exe
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeShutdownPrivilege	3488	Process not Found
Token: SeCreatePagefilePrivilege	3488	Process not Found
Token: SeDebugPrivilege	4984	uq5qcoy755.exe
Token: SeRestorePrivilege	4984	uq5qcoy755.exe
Token: SeBackupPrivilege	4984	uq5qcoy755.exe
Token: SeLoadDriverPrivilege	4984	uq5qcoy755.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3488	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1984	2984	1923715e6214c54be40797c3d821fbfc.exe	95
PID 2984 wrote to memory of 1984	2984	1923715e6214c54be40797c3d821fbfc.exe	95
PID 2984 wrote to memory of 1984	2984	1923715e6214c54be40797c3d821fbfc.exe	95
PID 1984 wrote to memory of 4968	1984	setup.exe	97
PID 1984 wrote to memory of 4968	1984	setup.exe	97
PID 1984 wrote to memory of 4968	1984	setup.exe	97
PID 4968 wrote to memory of 1104	4968	setup_install.exe	100
PID 4968 wrote to memory of 1104	4968	setup_install.exe	100
PID 4968 wrote to memory of 1104	4968	setup_install.exe	100
PID 1104 wrote to memory of 4416	1104	cmd.exe	101
PID 1104 wrote to memory of 4416	1104	cmd.exe	101
PID 1104 wrote to memory of 4416	1104	cmd.exe	101
PID 4416 wrote to memory of 2804	4416	83904ea3382de84ea.exe	102
PID 4416 wrote to memory of 2804	4416	83904ea3382de84ea.exe	102
PID 4416 wrote to memory of 2804	4416	83904ea3382de84ea.exe	102
PID 2804 wrote to memory of 4824	2804	setup_install.exe	104
PID 2804 wrote to memory of 4824	2804	setup_install.exe	104
PID 2804 wrote to memory of 4824	2804	setup_install.exe	104
PID 2804 wrote to memory of 736	2804	setup_install.exe	105
PID 2804 wrote to memory of 736	2804	setup_install.exe	105
PID 2804 wrote to memory of 736	2804	setup_install.exe	105
PID 2804 wrote to memory of 2960	2804	setup_install.exe	106
PID 2804 wrote to memory of 2960	2804	setup_install.exe	106
PID 2804 wrote to memory of 2960	2804	setup_install.exe	106
PID 2804 wrote to memory of 1432	2804	setup_install.exe	107
PID 2804 wrote to memory of 1432	2804	setup_install.exe	107
PID 2804 wrote to memory of 1432	2804	setup_install.exe	107
PID 2804 wrote to memory of 1576	2804	setup_install.exe	108
PID 2804 wrote to memory of 1576	2804	setup_install.exe	108
PID 2804 wrote to memory of 1576	2804	setup_install.exe	108
PID 2804 wrote to memory of 4720	2804	setup_install.exe	112
PID 2804 wrote to memory of 4720	2804	setup_install.exe	112
PID 2804 wrote to memory of 4720	2804	setup_install.exe	112
PID 2804 wrote to memory of 396	2804	setup_install.exe	111
PID 2804 wrote to memory of 396	2804	setup_install.exe	111
PID 2804 wrote to memory of 396	2804	setup_install.exe	111
PID 2804 wrote to memory of 4288	2804	setup_install.exe	109
PID 2804 wrote to memory of 4288	2804	setup_install.exe	109
PID 2804 wrote to memory of 4288	2804	setup_install.exe	109
PID 2804 wrote to memory of 4516	2804	setup_install.exe	110
PID 2804 wrote to memory of 4516	2804	setup_install.exe	110
PID 2804 wrote to memory of 4516	2804	setup_install.exe	110
PID 4516 wrote to memory of 2328	4516	cmd.exe	113
PID 4516 wrote to memory of 2328	4516	cmd.exe	113
PID 1432 wrote to memory of 1456	1432	cmd.exe	114
PID 1432 wrote to memory of 1456	1432	cmd.exe	114
PID 1576 wrote to memory of 2756	1576	cmd.exe	115
PID 1576 wrote to memory of 2756	1576	cmd.exe	115
PID 1576 wrote to memory of 2756	1576	cmd.exe	115
PID 2960 wrote to memory of 1608	2960	cmd.exe	116
PID 2960 wrote to memory of 1608	2960	cmd.exe	116
PID 2960 wrote to memory of 1608	2960	cmd.exe	116
PID 4288 wrote to memory of 2228	4288	cmd.exe	117
PID 4288 wrote to memory of 2228	4288	cmd.exe	117
PID 736 wrote to memory of 2144	736	cmd.exe	119
PID 736 wrote to memory of 2144	736	cmd.exe	119
PID 736 wrote to memory of 2144	736	cmd.exe	119
PID 4720 wrote to memory of 2544	4720	cmd.exe	118
PID 4720 wrote to memory of 2544	4720	cmd.exe	118
PID 4720 wrote to memory of 2544	4720	cmd.exe	118
PID 396 wrote to memory of 4392	396	cmd.exe	121
PID 396 wrote to memory of 4392	396	cmd.exe	121
PID 396 wrote to memory of 4392	396	cmd.exe	121
PID 4824 wrote to memory of 1952	4824	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1923715e6214c54be40797c3d821fbfc.exe
"C:\Users\Admin\AppData\Local\Temp\1923715e6214c54be40797c3d821fbfc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\7zS0C7CCA98\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0C7CCA98\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\83904ea3382de84ea.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\83904ea3382de84ea.exe
        
        C:\Users\Admin\AppData\Local\Temp\83904ea3382de84ea.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\setup_install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\setup_install.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        8⤵
        Looks for VMWare services registry key.
        Adds Run key to start application
        Maps connected drives based on registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1952
        
        C:\ProgramData\Java Updater\uq5qcoy755.exe
        
        /prstb
        9⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:4984
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        
        PID:1984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 1128
        11⤵
        Program crash
        
        PID:4728
        
        C:\ProgramData\Java Updater\uq5qcoy755.exe
        
        /prstb
        9⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        10⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 1080
        11⤵
        Program crash
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun211972de1e.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun211972de1e.exe
        
        Sun211972de1e.exe
        8⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 9772
        9⤵
        Program crash
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun21cfc7686a.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun21cfc7686a.exe
        
        Sun21cfc7686a.exe
        8⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun21caad43cbccfb.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun21caad43cbccfb.exe
        
        Sun21caad43cbccfb.exe
        8⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun21688b2b2b63.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun21688b2b2b63.exe
        
        Sun21688b2b2b63.exe
        8⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 824
        9⤵
        Program crash
        
        PID:3968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 868
        9⤵
        Program crash
        
        PID:3852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 916
        9⤵
        Program crash
        
        PID:4956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 924
        9⤵
        Program crash
        
        PID:1144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1040
        9⤵
        Program crash
        
        PID:3324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1048
        9⤵
        Program crash
        
        PID:3148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1080
        9⤵
        Program crash
        
        PID:1288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1520
        9⤵
        Program crash
        
        PID:1608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1608
        9⤵
        Program crash
        
        PID:4492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1628
        9⤵
        Program crash
        
        PID:3324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1612
        9⤵
        Program crash
        
        PID:2064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1760
        9⤵
        Program crash
        
        PID:2136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1692
        9⤵
        Program crash
        
        PID:952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1604
        9⤵
        Program crash
        
        PID:1812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1756
        9⤵
        Program crash
        
        PID:1720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1892
        9⤵
        Program crash
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 868
        10⤵
        Program crash
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun21ab69e87d0.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun21ab69e87d0.exe
        
        Sun21ab69e87d0.exe
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun213b31a7e71d4cf6d.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun213b31a7e71d4cf6d.exe
        
        Sun213b31a7e71d4cf6d.exe
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun21dd3b887a3.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun21dd3b887a3.exe
        
        Sun21dd3b887a3.exe
        8⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 1008
        9⤵
        Program crash
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun218856081dd1.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun218856081dd1.exe
        
        Sun218856081dd1.exe
        8⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\is-8ATSR.tmp\Sun218856081dd1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-8ATSR.tmp\Sun218856081dd1.tmp" /SL5="$17004C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS041BB8A8\Sun218856081dd1.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 492
        7⤵
        Program crash
        
        PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2804 -ip 2804
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2756 -ip 2756
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2756 -ip 2756
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2756 -ip 2756
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2756 -ip 2756
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2756 -ip 2756
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2756 -ip 2756
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2756 -ip 2756
1⤵
PID:3508

C:\Users\Admin\AppData\Local\Temp\8B9C.exe
C:\Users\Admin\AppData\Local\Temp\8B9C.exe
1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4628
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - Modifies firewall policy service
  - Sets file execution options in registry
  - Checks BIOS information in registry
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 1136
    3⤵
    - Program crash
    PID:2492

C:\Users\Admin\AppData\Local\Temp\97A3.exe
C:\Users\Admin\AppData\Local\Temp\97A3.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1796
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2756 -ip 2756
1⤵
PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2756 -ip 2756
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2756 -ip 2756
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2144 -ip 2144
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2756 -ip 2756
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2756 -ip 2756
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2756 -ip 2756
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4576 -ip 4576
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2756 -ip 2756
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2756 -ip 2756
1⤵
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4392 -ip 4392
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2756 -ip 2756
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2612 -ip 2612
1⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1984 -ip 1984
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3288 -ip 3288
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery