saintbot | cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293

Windows Service

T1543.003

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe

SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
dropper saintbot

SaintBot payload 5 IoCs

resource	yara_rule
behavioral1/memory/2620-37-0x0000000000400000-0x000000000040B000-memory.dmp	family_saintbot
behavioral1/memory/2192-102-0x0000000000400000-0x000000000040B000-memory.dmp	family_saintbot
behavioral1/memory/2236-106-0x0000000000080000-0x000000000008B000-memory.dmp	family_saintbot
behavioral1/memory/2236-107-0x0000000000080000-0x000000000008B000-memory.dmp	family_saintbot
behavioral1/memory/2236-108-0x0000000000080000-0x000000000008B000-memory.dmp	family_saintbot

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe = "0"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe = "0"	Microsoft Office Outlook MUI (English) 2010.exe

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000144e0-5.dat	Nirsoft

Deletes itself 1 IoCs

pid	Process
2364	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe	Microsoft Office Outlook MUI (English) 2010.exe

Executes dropped EXE 6 IoCs

pid	Process
2720	AdvancedRun.exe
2648	AdvancedRun.exe
2476	Microsoft Office Outlook MUI (English) 2010.exe
2752	AdvancedRun.exe
2332	AdvancedRun.exe
2192	Microsoft Office Outlook MUI (English) 2010.exe

Loads dropped DLL 12 IoCs

pid	Process
2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
2720	AdvancedRun.exe
2720	AdvancedRun.exe
2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
2476	Microsoft Office Outlook MUI (English) 2010.exe
2476	Microsoft Office Outlook MUI (English) 2010.exe
2752	AdvancedRun.exe
2752	AdvancedRun.exe
2192	Microsoft Office Outlook MUI (English) 2010.exe
2236	dfrgui.exe

Windows security modification 2 TTPs 9 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe = "0"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe = "0"	Microsoft Office Outlook MUI (English) 2010.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\zzAdmin\\Admin.vbs"	dfrgui.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	dfrgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Microsoft Office Outlook MUI (English) 2010.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	Microsoft Office Outlook MUI (English) 2010.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	dfrgui.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2476 set thread context of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dfrgui.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2776	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1596	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2720	AdvancedRun.exe
2720	AdvancedRun.exe
2648	AdvancedRun.exe
2648	AdvancedRun.exe
2552	powershell.exe
2752	AdvancedRun.exe
2752	AdvancedRun.exe
2332	AdvancedRun.exe
2332	AdvancedRun.exe
1656	powershell.exe
2192	Microsoft Office Outlook MUI (English) 2010.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	AdvancedRun.exe
Token: SeImpersonatePrivilege	2720	AdvancedRun.exe
Token: SeDebugPrivilege	2648	AdvancedRun.exe
Token: SeImpersonatePrivilege	2648	AdvancedRun.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2752	AdvancedRun.exe
Token: SeImpersonatePrivilege	2752	AdvancedRun.exe
Token: SeDebugPrivilege	2332	AdvancedRun.exe
Token: SeImpersonatePrivilege	2332	AdvancedRun.exe
Token: SeDebugPrivilege	1656	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2720	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	28
PID 2040 wrote to memory of 2720	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	28
PID 2040 wrote to memory of 2720	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	28
PID 2040 wrote to memory of 2720	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	28
PID 2720 wrote to memory of 2648	2720	AdvancedRun.exe	29
PID 2720 wrote to memory of 2648	2720	AdvancedRun.exe	29
PID 2720 wrote to memory of 2648	2720	AdvancedRun.exe	29
PID 2720 wrote to memory of 2648	2720	AdvancedRun.exe	29
PID 2040 wrote to memory of 2552	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	30
PID 2040 wrote to memory of 2552	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	30
PID 2040 wrote to memory of 2552	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	30
PID 2040 wrote to memory of 2552	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	30
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2040 wrote to memory of 2620	2040	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	32
PID 2620 wrote to memory of 2476	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	33
PID 2620 wrote to memory of 2476	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	33
PID 2620 wrote to memory of 2476	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	33
PID 2620 wrote to memory of 2476	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	33
PID 2620 wrote to memory of 2364	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	34
PID 2620 wrote to memory of 2364	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	34
PID 2620 wrote to memory of 2364	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	34
PID 2620 wrote to memory of 2364	2620	cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe	34
PID 2364 wrote to memory of 1596	2364	cmd.exe	36
PID 2364 wrote to memory of 1596	2364	cmd.exe	36
PID 2364 wrote to memory of 1596	2364	cmd.exe	36
PID 2364 wrote to memory of 1596	2364	cmd.exe	36
PID 2476 wrote to memory of 2752	2476	Microsoft Office Outlook MUI (English) 2010.exe	37
PID 2476 wrote to memory of 2752	2476	Microsoft Office Outlook MUI (English) 2010.exe	37
PID 2476 wrote to memory of 2752	2476	Microsoft Office Outlook MUI (English) 2010.exe	37
PID 2476 wrote to memory of 2752	2476	Microsoft Office Outlook MUI (English) 2010.exe	37
PID 2752 wrote to memory of 2332	2752	AdvancedRun.exe	38
PID 2752 wrote to memory of 2332	2752	AdvancedRun.exe	38
PID 2752 wrote to memory of 2332	2752	AdvancedRun.exe	38
PID 2752 wrote to memory of 2332	2752	AdvancedRun.exe	38
PID 2364 wrote to memory of 332	2364	cmd.exe	39
PID 2364 wrote to memory of 332	2364	cmd.exe	39
PID 2364 wrote to memory of 332	2364	cmd.exe	39
PID 2364 wrote to memory of 332	2364	cmd.exe	39
PID 2476 wrote to memory of 1656	2476	Microsoft Office Outlook MUI (English) 2010.exe	40
PID 2476 wrote to memory of 1656	2476	Microsoft Office Outlook MUI (English) 2010.exe	40
PID 2476 wrote to memory of 1656	2476	Microsoft Office Outlook MUI (English) 2010.exe	40
PID 2476 wrote to memory of 1656	2476	Microsoft Office Outlook MUI (English) 2010.exe	40
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2476 wrote to memory of 2192	2476	Microsoft Office Outlook MUI (English) 2010.exe	42
PID 2192 wrote to memory of 2236	2192	Microsoft Office Outlook MUI (English) 2010.exe	43
PID 2192 wrote to memory of 2236	2192	Microsoft Office Outlook MUI (English) 2010.exe	43

C:\Users\Admin\AppData\Local\Temp\cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
"C:\Users\Admin\AppData\Local\Temp\cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\04c22e63-aa58-4b01-ac7e-93f958f72e53\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\04c22e63-aa58-4b01-ac7e-93f958f72e53\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\04c22e63-aa58-4b01-ac7e-93f958f72e53\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\04c22e63-aa58-4b01-ac7e-93f958f72e53\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\04c22e63-aa58-4b01-ac7e-93f958f72e53\AdvancedRun.exe" /SpecialRun 4101d8 2720
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe
  "C:\Users\Admin\AppData\Local\Temp\cb6c05b2e9d8e3c384b7eabacde32fc3ac2f9663c63b9908e876712582bf2293.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe"
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\263e1b12-3e5d-49cd-89d7-ddf6f1b65df1\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\263e1b12-3e5d-49cd-89d7-ddf6f1b65df1\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\263e1b12-3e5d-49cd-89d7-ddf6f1b65df1\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\263e1b12-3e5d-49cd-89d7-ddf6f1b65df1\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\263e1b12-3e5d-49cd-89d7-ddf6f1b65df1\AdvancedRun.exe" /SpecialRun 4101d8 2752
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2332
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1656
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook MUI (English) 2010.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\SysWOW64\dfrgui.exe
        
        "C:\Windows\system32\dfrgui.exe"
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Maps connected drives based on registry
        Drops file in System32 directory
        Checks processor information in registry
        
        PID:2236
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 5 /tn "Update" /tr "%SYSTEMDRIVE%\Users\%USERNAME%\AppData\Local\zz%USERNAME%\%USERNAME%.vbs" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Roaming\del.bat
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
      4⤵
      PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry