quasar | 95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 14 IoCs

pid	Process
3156	chrome.exe
5008	S^X.exe
3888	chrome.exe
1008	chrome.exe
2700	chrome.exe
5064	chrome.exe
924	chrome.exe
1568	chrome.exe
4852	chrome.exe
1144	chrome.exe
4560	chrome.exe
924	chrome.exe
4092	chrome.exe
1764	chrome.exe

Loads dropped DLL 1 IoCs

pid	Process
1492	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe

Obfuscated with Agile.Net obfuscator 7 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/1492-1-0x0000000000E50000-0x0000000001464000-memory.dmp	agile_net
behavioral2/memory/1492-2-0x0000000005D70000-0x0000000006382000-memory.dmp	agile_net
behavioral2/memory/1492-16-0x0000000005D70000-0x000000000637C000-memory.dmp	agile_net
behavioral2/memory/1492-17-0x0000000005D70000-0x000000000637C000-memory.dmp	agile_net
behavioral2/memory/1492-19-0x0000000005D70000-0x000000000637C000-memory.dmp	agile_net
behavioral2/memory/1492-21-0x0000000005D70000-0x000000000637C000-memory.dmp	agile_net
behavioral2/memory/1492-23-0x0000000005D70000-0x000000000637C000-memory.dmp	agile_net

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000023201-7.dat	themida
behavioral2/memory/1492-11-0x0000000071EA0000-0x00000000724A8000-memory.dmp	themida
behavioral2/memory/1492-12-0x0000000071EA0000-0x00000000724A8000-memory.dmp	themida
behavioral2/memory/1492-14-0x0000000071EA0000-0x00000000724A8000-memory.dmp	themida
behavioral2/memory/1492-50-0x0000000071EA0000-0x00000000724A8000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1492	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
364	schtasks.exe
4192	schtasks.exe
908	schtasks.exe
4324	schtasks.exe
832	schtasks.exe
4872	schtasks.exe
4928	schtasks.exe
4084	schtasks.exe
4140	schtasks.exe
1264	schtasks.exe
3812	schtasks.exe
5072	schtasks.exe
1296	schtasks.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
4128	PING.EXE
3432	PING.EXE
688	PING.EXE
3240	PING.EXE
2952	PING.EXE
5104	PING.EXE
4676	PING.EXE
4636	PING.EXE
2056	PING.EXE
1280	PING.EXE
3780	PING.EXE
3468	PING.EXE

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	chrome.exe
Token: SeDebugPrivilege	3888	chrome.exe
Token: SeDebugPrivilege	5008	S^X.exe
Token: SeDebugPrivilege	1008	chrome.exe
Token: SeDebugPrivilege	2700	chrome.exe
Token: SeDebugPrivilege	5064	chrome.exe
Token: SeDebugPrivilege	924	chrome.exe
Token: SeDebugPrivilege	1568	chrome.exe
Token: SeDebugPrivilege	4852	chrome.exe
Token: SeDebugPrivilege	1144	chrome.exe
Token: SeDebugPrivilege	4560	chrome.exe
Token: SeDebugPrivilege	924	chrome.exe
Token: SeDebugPrivilege	4092	chrome.exe
Token: SeDebugPrivilege	1764	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3156	1492	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe	88
PID 1492 wrote to memory of 3156	1492	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe	88
PID 1492 wrote to memory of 5008	1492	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe	89
PID 1492 wrote to memory of 5008	1492	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe	89
PID 1492 wrote to memory of 5008	1492	03778d811f241e83ccad830372313b3c_JaffaCakes118.exe	89
PID 3156 wrote to memory of 4140	3156	chrome.exe	90
PID 3156 wrote to memory of 4140	3156	chrome.exe	90
PID 3156 wrote to memory of 3888	3156	chrome.exe	92
PID 3156 wrote to memory of 3888	3156	chrome.exe	92
PID 3888 wrote to memory of 364	3888	chrome.exe	96
PID 3888 wrote to memory of 364	3888	chrome.exe	96
PID 3888 wrote to memory of 2644	3888	chrome.exe	100
PID 3888 wrote to memory of 2644	3888	chrome.exe	100
PID 2644 wrote to memory of 3332	2644	cmd.exe	102
PID 2644 wrote to memory of 3332	2644	cmd.exe	102
PID 2644 wrote to memory of 688	2644	cmd.exe	103
PID 2644 wrote to memory of 688	2644	cmd.exe	103
PID 2644 wrote to memory of 1008	2644	cmd.exe	107
PID 2644 wrote to memory of 1008	2644	cmd.exe	107
PID 1008 wrote to memory of 4872	1008	chrome.exe	108
PID 1008 wrote to memory of 4872	1008	chrome.exe	108
PID 1008 wrote to memory of 2816	1008	chrome.exe	110
PID 1008 wrote to memory of 2816	1008	chrome.exe	110
PID 2816 wrote to memory of 5096	2816	cmd.exe	112
PID 2816 wrote to memory of 5096	2816	cmd.exe	112
PID 2816 wrote to memory of 3240	2816	cmd.exe	113
PID 2816 wrote to memory of 3240	2816	cmd.exe	113
PID 2816 wrote to memory of 2700	2816	cmd.exe	114
PID 2816 wrote to memory of 2700	2816	cmd.exe	114
PID 2700 wrote to memory of 4928	2700	chrome.exe	115
PID 2700 wrote to memory of 4928	2700	chrome.exe	115
PID 2700 wrote to memory of 5000	2700	chrome.exe	117
PID 2700 wrote to memory of 5000	2700	chrome.exe	117
PID 5000 wrote to memory of 2340	5000	cmd.exe	119
PID 5000 wrote to memory of 2340	5000	cmd.exe	119
PID 5000 wrote to memory of 2952	5000	cmd.exe	120
PID 5000 wrote to memory of 2952	5000	cmd.exe	120
PID 5000 wrote to memory of 5064	5000	cmd.exe	128
PID 5000 wrote to memory of 5064	5000	cmd.exe	128
PID 5064 wrote to memory of 4192	5064	chrome.exe	129
PID 5064 wrote to memory of 4192	5064	chrome.exe	129
PID 5064 wrote to memory of 4396	5064	chrome.exe	131
PID 5064 wrote to memory of 4396	5064	chrome.exe	131
PID 4396 wrote to memory of 4956	4396	cmd.exe	133
PID 4396 wrote to memory of 4956	4396	cmd.exe	133
PID 4396 wrote to memory of 5104	4396	cmd.exe	134
PID 4396 wrote to memory of 5104	4396	cmd.exe	134
PID 4396 wrote to memory of 924	4396	cmd.exe	135
PID 4396 wrote to memory of 924	4396	cmd.exe	135
PID 924 wrote to memory of 1264	924	chrome.exe	136
PID 924 wrote to memory of 1264	924	chrome.exe	136
PID 924 wrote to memory of 1676	924	chrome.exe	138
PID 924 wrote to memory of 1676	924	chrome.exe	138
PID 1676 wrote to memory of 4008	1676	cmd.exe	140
PID 1676 wrote to memory of 4008	1676	cmd.exe	140
PID 1676 wrote to memory of 1280	1676	cmd.exe	141
PID 1676 wrote to memory of 1280	1676	cmd.exe	141
PID 1676 wrote to memory of 1568	1676	cmd.exe	142
PID 1676 wrote to memory of 1568	1676	cmd.exe	142
PID 1568 wrote to memory of 3812	1568	chrome.exe	143
PID 1568 wrote to memory of 3812	1568	chrome.exe	143
PID 1568 wrote to memory of 3432	1568	chrome.exe	145
PID 1568 wrote to memory of 3432	1568	chrome.exe	145
PID 3432 wrote to memory of 1132	3432	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\03778d811f241e83ccad830372313b3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03778d811f241e83ccad830372313b3c_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Roaming\chrome.exe
  "C:\Users\Admin\AppData\Roaming\chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4140
- - C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
    "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HcupRi2EDLMQ.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3332
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:688
    - - C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1008
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:4872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qE94ud1eUXHt.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5096
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:3240
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:4928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KidRvp388NqL.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2340
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:2952
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        10⤵
        Creates scheduled task(s)
        
        PID:4192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BXP6LIt921rs.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4956
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        12⤵
        Creates scheduled task(s)
        
        PID:1264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\unoUNV6CHelz.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4008
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:1280
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        14⤵
        Creates scheduled task(s)
        
        PID:3812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tCw2h8dKrMPP.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1132
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:3780
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        16⤵
        Creates scheduled task(s)
        
        PID:908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqfWuVAEUmuT.bat" "
        16⤵
        
        PID:1188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:336
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:4676
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        18⤵
        Creates scheduled task(s)
        
        PID:5072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8AgRFZAgncGA.bat" "
        18⤵
        
        PID:460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:3400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:4636
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        20⤵
        Creates scheduled task(s)
        
        PID:1296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NZEWk6DPKY37.bat" "
        20⤵
        
        PID:2988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:1544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:3468
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        22⤵
        Creates scheduled task(s)
        
        PID:4084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nyZvJtPL1wd4.bat" "
        22⤵
        
        PID:2648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1676
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:4128
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        24⤵
        Creates scheduled task(s)
        
        PID:4324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XdeFJts1fXEO.bat" "
        24⤵
        
        PID:896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:2508
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        Runs ping.exe
        
        PID:3432
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        26⤵
        Creates scheduled task(s)
        
        PID:832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACDFf4JKfS6p.bat" "
        26⤵
        
        PID:3280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        Runs ping.exe
        
        PID:2056
- C:\Users\Admin\AppData\Local\Temp\S^X.exe
  "C:\Users\Admin\AppData\Local\Temp\S^X.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery