djvu | 24ca31f5b2c38b141f0c22d7f6fdf6cf558c24840cf215fafab0f337afa4bac2

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	nsrE273.tmp

Executes dropped EXE 7 IoCs

pid	Process
1840	InstallSetup7.exe
4068	toolspub1.exe
3052	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4844	FirstZ.exe
464	BroomSetup.exe
4020	nsrE273.tmp
3324	reakuqnanrkn.exe

Loads dropped DLL 4 IoCs

pid	Process
1840	InstallSetup7.exe
1840	InstallSetup7.exe
4020	nsrE273.tmp
4020	nsrE273.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1940	icacls.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3676-305-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-306-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-307-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-308-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-309-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-311-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-321-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-324-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-325-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-326-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-327-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3676-328-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/files/0x0009000000000747-627.dat	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
49	pastebin.com
50	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	api.2ip.ua
71	api.2ip.ua

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1584	sc.exe
4128	sc.exe
1660	sc.exe
4688	sc.exe
3108	sc.exe
4164	sc.exe
3508	sc.exe
4224	sc.exe
792	sc.exe
2984	sc.exe
4128	sc.exe
4452	sc.exe
4432	sc.exe
3272	sc.exe
4308	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4728	2576	WerFault.exe	190

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsrE273.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsrE273.tmp

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2952	schtasks.exe
4256	schtasks.exe
2136	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3564	timeout.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4068	toolspub1.exe
4068	toolspub1.exe
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
4020	nsrE273.tmp
4020	nsrE273.tmp
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found
3576	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4068	toolspub1.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found
Token: SeShutdownPrivilege	3524	powercfg.exe
Token: SeCreatePagefilePrivilege	3524	powercfg.exe
Token: SeShutdownPrivilege	4432	Process not Found
Token: SeCreatePagefilePrivilege	4432	Process not Found
Token: SeShutdownPrivilege	1800	Process not Found
Token: SeCreatePagefilePrivilege	1800	Process not Found
Token: SeShutdownPrivilege	552	powercfg.exe
Token: SeCreatePagefilePrivilege	552	powercfg.exe
Token: SeDebugPrivilege	1904	Process not Found
Token: SeShutdownPrivilege	3576	Process not Found
Token: SeCreatePagefilePrivilege	3576	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
464	BroomSetup.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1840	2596	tmp.exe	89
PID 2596 wrote to memory of 1840	2596	tmp.exe	89
PID 2596 wrote to memory of 1840	2596	tmp.exe	89
PID 2596 wrote to memory of 4068	2596	tmp.exe	90
PID 2596 wrote to memory of 4068	2596	tmp.exe	90
PID 2596 wrote to memory of 4068	2596	tmp.exe	90
PID 2596 wrote to memory of 3052	2596	tmp.exe	91
PID 2596 wrote to memory of 3052	2596	tmp.exe	91
PID 2596 wrote to memory of 3052	2596	tmp.exe	91
PID 2596 wrote to memory of 4844	2596	tmp.exe	92
PID 2596 wrote to memory of 4844	2596	tmp.exe	92
PID 1840 wrote to memory of 464	1840	InstallSetup7.exe	93
PID 1840 wrote to memory of 464	1840	InstallSetup7.exe	93
PID 1840 wrote to memory of 464	1840	InstallSetup7.exe	93
PID 1840 wrote to memory of 4020	1840	InstallSetup7.exe	94
PID 1840 wrote to memory of 4020	1840	InstallSetup7.exe	94
PID 1840 wrote to memory of 4020	1840	InstallSetup7.exe	94
PID 464 wrote to memory of 3540	464	BroomSetup.exe	96
PID 464 wrote to memory of 3540	464	BroomSetup.exe	96
PID 464 wrote to memory of 3540	464	BroomSetup.exe	96
PID 3540 wrote to memory of 2584	3540	cmd.exe	98
PID 3540 wrote to memory of 2584	3540	cmd.exe	98
PID 3540 wrote to memory of 2584	3540	cmd.exe	98
PID 3540 wrote to memory of 2952	3540	cmd.exe	99
PID 3540 wrote to memory of 2952	3540	cmd.exe	99
PID 3540 wrote to memory of 2952	3540	cmd.exe	99
PID 3052 wrote to memory of 1724	3052	d21cbe21e38b385a41a68c5e6dd32f4c.exe	101
PID 3052 wrote to memory of 1724	3052	d21cbe21e38b385a41a68c5e6dd32f4c.exe	101
PID 3052 wrote to memory of 1724	3052	d21cbe21e38b385a41a68c5e6dd32f4c.exe	101
PID 2516 wrote to memory of 556	2516	cmd.exe	116
PID 2516 wrote to memory of 556	2516	cmd.exe	116
PID 4020 wrote to memory of 3048	4020	nsrE273.tmp	118
PID 4020 wrote to memory of 3048	4020	nsrE273.tmp	118
PID 4020 wrote to memory of 3048	4020	nsrE273.tmp	118
PID 3048 wrote to memory of 3564	3048	cmd.exe	132
PID 3048 wrote to memory of 3564	3048	cmd.exe	132
PID 3048 wrote to memory of 3564	3048	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2584
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:2952
- - C:\Users\Admin\AppData\Local\Temp\nsrE273.tmp
    C:\Users\Admin\AppData\Local\Temp\nsrE273.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsrE273.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3564
- C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
  "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    PID:3492
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:2672
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2668
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2552
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2180
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:5080
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3328
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:4256
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:4872
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4116
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:1252
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:2136
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        
        PID:1852
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        Launches sc.exe
        
        PID:4308
- C:\Users\Admin\AppData\Local\Temp\FirstZ.exe
  "C:\Users\Admin\AppData\Local\Temp\FirstZ.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4844
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:556
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4164
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3508
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4224
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4128
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:792
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:4452
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:1800
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:4432
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4688
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:3108
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1584

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
PID:3324
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:1904
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5012
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2984
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3272
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1660
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:4928
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1708
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:3660
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:4684
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:4160
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:3676

C:\Users\Admin\AppData\Local\Temp\E52B.exe
C:\Users\Admin\AppData\Local\Temp\E52B.exe
1⤵
PID:228

C:\Users\Admin\AppData\Local\Temp\F9EC.exe
C:\Users\Admin\AppData\Local\Temp\F9EC.exe
1⤵
PID:4032
- C:\Users\Admin\AppData\Local\Temp\F9EC.exe
  C:\Users\Admin\AppData\Local\Temp\F9EC.exe
  2⤵
  PID:4216
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\057a63f4-010d-43ac-bb34-94593cff6cf3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\F9EC.exe
    "C:\Users\Admin\AppData\Local\Temp\F9EC.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:2576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 236
      4⤵
      Program crash
      PID:4728

C:\Users\Admin\AppData\Local\Temp\1F09.exe
C:\Users\Admin\AppData\Local\Temp\1F09.exe
1⤵
PID:4880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2576 -ip 2576
1⤵
PID:4520

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\81BC.exe
C:\Users\Admin\AppData\Local\Temp\81BC.exe
1⤵
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe"
      4⤵
      PID:452

C:\Users\Admin\AppData\Local\Temp\92B5.exe
C:\Users\Admin\AppData\Local\Temp\92B5.exe
1⤵
PID:1368

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery