remcos | 0fb1d11732acd516de3da578ac8d7a4a0f51684f588898bc0621fe5424cef0eb

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WindowsDataSystem.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Audio-EIQQ40 = "\"C:\\Windows\\Windows Data Start-Up\\Windows Data Start.exe\""	WindowsDataSystem.scr
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Windows Data Start.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Audio-EIQQ40 = "\"C:\\Windows\\Windows Data Start-Up\\Windows Data Start.exe\""	Windows Data Start.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Teklif-Formu.jar	java.exe

Executes dropped EXE 4 IoCs

pid	Process
3016	WindowsDataSystem.scr
2932	WindowsDataSystem.scr
948	Windows Data Start.exe
272	Windows Data Start.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	WindowsDataSystem.scr

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teklif-Formu = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Teklif-Formu.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Teklif-Formu = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Teklif-Formu.jar\""	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio-EIQQ40 = "\"C:\\Windows\\Windows Data Start-Up\\Windows Data Start.exe\""	WindowsDataSystem.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Audio-EIQQ40 = "\"C:\\Windows\\Windows Data Start-Up\\Windows Data Start.exe\""	WindowsDataSystem.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio-EIQQ40 = "\"C:\\Windows\\Windows Data Start-Up\\Windows Data Start.exe\""	Windows Data Start.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Audio-EIQQ40 = "\"C:\\Windows\\Windows Data Start-Up\\Windows Data Start.exe\""	Windows Data Start.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 2932	3016	WindowsDataSystem.scr	43
PID 948 set thread context of 272	948	Windows Data Start.exe	48
PID 272 set thread context of 444	272	Windows Data Start.exe	50

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Windows Data Start-Up	WindowsDataSystem.scr
File created	C:\Windows\Windows Data Start-Up\Windows Data Start.exe	WindowsDataSystem.scr
File opened for modification	C:\Windows\Windows Data Start-Up\Windows Data Start.exe	WindowsDataSystem.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2876	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908043230aa2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006861b19dab5ab4895093d497b2e17d939e5cfee8f225909c2266518306ffd193000000000e8000000002000020000000a97c7a54448d68bf00cf3942eafb315c16c189e2a11c3fc019573c7caa2d964990000000852f5df20a8cc5ee3fad337e591fe9afdccf10ae185b3ade0b80d6e6b5b6a9d96268f19469806b99727c97ce75d85f4ac6c25170cf29f0d10e318adcf74af547ec266d5e611e2d35ffde992162b7e3874eb771f5a44f4e80bc64f90261e9c9c7bf3db9bfb0150fd6ad985cace60afd85ffee573c73afd96dcf1575b894b9a4ca877dc18f9eda0a9a93dc72a59d3ed88140000000afc904eb7291d38e817a87471294fd491309c71a2b216145fdc201b1006d57ab94474eddce760c307e25fb7d84b4efb17236037754fc1b3b91775cced67dd0c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421418571"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CBB7F91-0DFD-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007b02088683dc97490184b6aa117f609a5b1f48f2995540f4a4965ad7994dc0f2000000000e8000000002000020000000733d05955ae0e48ce98fe69612566ec13ffef4c6d38712899f02b800a2e78c90200000002e7f715047540818143a44d6d0a4c10aa95cd5f5232257c27fa854b0ac5c808740000000521a53ebd50179c71a8e6febca557614d3f6530ab774cc6b9c6a0b33160b7a4d2d1efa8f3938ded54919c2234392397df62e13d086eda4623f1d8c67e98600fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
2420	reg.exe
1824	reg.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3016	WindowsDataSystem.scr

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
272	Windows Data Start.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1756	WMIC.exe
Token: SeSecurityPrivilege	1756	WMIC.exe
Token: SeTakeOwnershipPrivilege	1756	WMIC.exe
Token: SeLoadDriverPrivilege	1756	WMIC.exe
Token: SeSystemProfilePrivilege	1756	WMIC.exe
Token: SeSystemtimePrivilege	1756	WMIC.exe
Token: SeProfSingleProcessPrivilege	1756	WMIC.exe
Token: SeIncBasePriorityPrivilege	1756	WMIC.exe
Token: SeCreatePagefilePrivilege	1756	WMIC.exe
Token: SeBackupPrivilege	1756	WMIC.exe
Token: SeRestorePrivilege	1756	WMIC.exe
Token: SeShutdownPrivilege	1756	WMIC.exe
Token: SeDebugPrivilege	1756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1756	WMIC.exe
Token: SeRemoteShutdownPrivilege	1756	WMIC.exe
Token: SeUndockPrivilege	1756	WMIC.exe
Token: SeManageVolumePrivilege	1756	WMIC.exe
Token: 33	1756	WMIC.exe
Token: 34	1756	WMIC.exe
Token: 35	1756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1756	WMIC.exe
Token: SeSecurityPrivilege	1756	WMIC.exe
Token: SeTakeOwnershipPrivilege	1756	WMIC.exe
Token: SeLoadDriverPrivilege	1756	WMIC.exe
Token: SeSystemProfilePrivilege	1756	WMIC.exe
Token: SeSystemtimePrivilege	1756	WMIC.exe
Token: SeProfSingleProcessPrivilege	1756	WMIC.exe
Token: SeIncBasePriorityPrivilege	1756	WMIC.exe
Token: SeCreatePagefilePrivilege	1756	WMIC.exe
Token: SeBackupPrivilege	1756	WMIC.exe
Token: SeRestorePrivilege	1756	WMIC.exe
Token: SeShutdownPrivilege	1756	WMIC.exe
Token: SeDebugPrivilege	1756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1756	WMIC.exe
Token: SeRemoteShutdownPrivilege	1756	WMIC.exe
Token: SeUndockPrivilege	1756	WMIC.exe
Token: SeManageVolumePrivilege	1756	WMIC.exe
Token: 33	1756	WMIC.exe
Token: 34	1756	WMIC.exe
Token: 35	1756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2820	WMIC.exe
Token: SeSecurityPrivilege	2820	WMIC.exe
Token: SeTakeOwnershipPrivilege	2820	WMIC.exe
Token: SeLoadDriverPrivilege	2820	WMIC.exe
Token: SeSystemProfilePrivilege	2820	WMIC.exe
Token: SeSystemtimePrivilege	2820	WMIC.exe
Token: SeProfSingleProcessPrivilege	2820	WMIC.exe
Token: SeIncBasePriorityPrivilege	2820	WMIC.exe
Token: SeCreatePagefilePrivilege	2820	WMIC.exe
Token: SeBackupPrivilege	2820	WMIC.exe
Token: SeRestorePrivilege	2820	WMIC.exe
Token: SeShutdownPrivilege	2820	WMIC.exe
Token: SeDebugPrivilege	2820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2820	WMIC.exe
Token: SeRemoteShutdownPrivilege	2820	WMIC.exe
Token: SeUndockPrivilege	2820	WMIC.exe
Token: SeManageVolumePrivilege	2820	WMIC.exe
Token: 33	2820	WMIC.exe
Token: 34	2820	WMIC.exe
Token: 35	2820	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2820	WMIC.exe
Token: SeSecurityPrivilege	2820	WMIC.exe
Token: SeTakeOwnershipPrivilege	2820	WMIC.exe
Token: SeLoadDriverPrivilege	2820	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1820	iexplore.exe
1820	iexplore.exe
860	IEXPLORE.EXE
860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2652	1860	java.exe	29
PID 1860 wrote to memory of 2652	1860	java.exe	29
PID 1860 wrote to memory of 2652	1860	java.exe	29
PID 1860 wrote to memory of 2604	1860	java.exe	30
PID 1860 wrote to memory of 2604	1860	java.exe	30
PID 1860 wrote to memory of 2604	1860	java.exe	30
PID 2652 wrote to memory of 2876	2652	cmd.exe	31
PID 2652 wrote to memory of 2876	2652	cmd.exe	31
PID 2652 wrote to memory of 2876	2652	cmd.exe	31
PID 2604 wrote to memory of 1596	2604	java.exe	32
PID 2604 wrote to memory of 1596	2604	java.exe	32
PID 2604 wrote to memory of 1596	2604	java.exe	32
PID 1596 wrote to memory of 1756	1596	cmd.exe	33
PID 1596 wrote to memory of 1756	1596	cmd.exe	33
PID 1596 wrote to memory of 1756	1596	cmd.exe	33
PID 2604 wrote to memory of 2804	2604	java.exe	35
PID 2604 wrote to memory of 2804	2604	java.exe	35
PID 2604 wrote to memory of 2804	2604	java.exe	35
PID 2804 wrote to memory of 2820	2804	cmd.exe	36
PID 2804 wrote to memory of 2820	2804	cmd.exe	36
PID 2804 wrote to memory of 2820	2804	cmd.exe	36
PID 2604 wrote to memory of 2800	2604	java.exe	37
PID 2604 wrote to memory of 2800	2604	java.exe	37
PID 2604 wrote to memory of 2800	2604	java.exe	37
PID 2800 wrote to memory of 468	2800	cmd.exe	38
PID 2800 wrote to memory of 468	2800	cmd.exe	38
PID 2800 wrote to memory of 468	2800	cmd.exe	38
PID 2604 wrote to memory of 1908	2604	java.exe	39
PID 2604 wrote to memory of 1908	2604	java.exe	39
PID 2604 wrote to memory of 1908	2604	java.exe	39
PID 1908 wrote to memory of 1780	1908	cmd.exe	40
PID 1908 wrote to memory of 1780	1908	cmd.exe	40
PID 1908 wrote to memory of 1780	1908	cmd.exe	40
PID 2604 wrote to memory of 1684	2604	java.exe	41
PID 2604 wrote to memory of 1684	2604	java.exe	41
PID 2604 wrote to memory of 1684	2604	java.exe	41
PID 1684 wrote to memory of 3016	1684	cmd.exe	42
PID 1684 wrote to memory of 3016	1684	cmd.exe	42
PID 1684 wrote to memory of 3016	1684	cmd.exe	42
PID 1684 wrote to memory of 3016	1684	cmd.exe	42
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 3016 wrote to memory of 2932	3016	WindowsDataSystem.scr	43
PID 2932 wrote to memory of 380	2932	WindowsDataSystem.scr	44
PID 2932 wrote to memory of 380	2932	WindowsDataSystem.scr	44
PID 2932 wrote to memory of 380	2932	WindowsDataSystem.scr	44
PID 2932 wrote to memory of 380	2932	WindowsDataSystem.scr	44
PID 380 wrote to memory of 2420	380	cmd.exe	46
PID 380 wrote to memory of 2420	380	cmd.exe	46
PID 380 wrote to memory of 2420	380	cmd.exe	46
PID 380 wrote to memory of 2420	380	cmd.exe	46
PID 2932 wrote to memory of 948	2932	WindowsDataSystem.scr	47
PID 2932 wrote to memory of 948	2932	WindowsDataSystem.scr	47
PID 2932 wrote to memory of 948	2932	WindowsDataSystem.scr	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Teklif-Formu.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\system32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Teklif-Formu.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Teklif-Formu.jar"
    3⤵
    - Creates scheduled task(s)
    PID:2876
- C:\Program Files\Java\jre7\bin\java.exe
  "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Teklif-Formu.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1756
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2820
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      4⤵
      PID:468
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list
      4⤵
      PID:1780
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "C:\Users\Admin\AppData\Roaming\WindowsDataSystem.scr"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Users\Admin\AppData\Roaming\WindowsDataSystem.scr
      C:\Users\Admin\AppData\Roaming\WindowsDataSystem.scr
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Users\Admin\AppData\Roaming\WindowsDataSystem.scr
        
        "C:\Users\Admin\AppData\Roaming\WindowsDataSystem.scr"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:2420
      - C:\Windows\Windows Data Start-Up\Windows Data Start.exe
        
        "C:\Windows\Windows Data Start-Up\Windows Data Start.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:948
        
        C:\Windows\Windows Data Start-Up\Windows Data Start.exe
        
        "C:\Windows\Windows Data Start-Up\Windows Data Start.exe"
        7⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:272
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        
        PID:556
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        9⤵
        UAC bypass
        Modifies registry key
        
        PID:1824
        
        \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        8⤵
        
        PID:444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        9⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1820
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry