mimic | 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca

Processes:

YOURDATA.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	YOURDATA.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

5552 bcdedit.exe
3420 bcdedit.exe
Renames multiple (4470) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes System State backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

5664 wbadmin.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2044 wbadmin.exe

pid	process
5552	bcdedit.exe
3420	bcdedit.exe

pid	process
5664	wbadmin.exe

pid	process
2044	wbadmin.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

YOURDATA.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeadtopology.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeis.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql-exchange.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe	YOURDATA.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe

Executes dropped EXE 10 IoCs

Processes:

7za.exe7za.exe5koto.exeYOURDATA.exeDC.exeYOURDATA.exeYOURDATA.exeYOURDATA.exeEverything.exeEverything.exe

pid	process
2680	7za.exe
1088	7za.exe
2112	5koto.exe
2460	YOURDATA.exe
4316	DC.exe
3176	YOURDATA.exe
1256	YOURDATA.exe
1564	YOURDATA.exe
3288	Everything.exe
6052	Everything.exe

Loads dropped DLL 5 IoCs

Processes:

5koto.exeYOURDATA.exeYOURDATA.exeYOURDATA.exeYOURDATA.exe

pid process

2112 5koto.exe
2460 YOURDATA.exe
3176 YOURDATA.exe
1564 YOURDATA.exe
1256 YOURDATA.exe

pid	process
2112	5koto.exe
2460	YOURDATA.exe
3176	YOURDATA.exe
1564	YOURDATA.exe
1256	YOURDATA.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

Processes:

5koto.exeYOURDATA.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	YOURDATA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open	5koto.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

5koto.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YOURDATA = "\"C:\\Users\\Admin\\AppData\\Local\\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\\YOURDATA.exe\" "	5koto.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

YOURDATA.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YOURDATA.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Everything.exeEverything.exe

description	ioc	process
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe

Drops file in Program Files directory 64 IoCs

Processes:

YOURDATA.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Mozilla Firefox\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\7-Zip\Lang\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\[email protected]	YOURDATA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected]	YOURDATA.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1888 powershell.exe
1040 powershell.exe
3208 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1888	powershell.exe
1040	powershell.exe
3208	powershell.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe

Modifies registry class 19 IoCs

Processes:

5koto.exeYOURDATA.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell	5koto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	5koto.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.5000USD	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.5000USD\ = "mimicfile"	YOURDATA.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command	5koto.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	YOURDATA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\----Read-Me-----.txt\""	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	5koto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	YOURDATA.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile	5koto.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open	5koto.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	YOURDATA.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command	YOURDATA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	YOURDATA.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

YOURDATA.exeYOURDATA.exeYOURDATA.exepowershell.exepowershell.exepowershell.exe

pid	process
1564	YOURDATA.exe
1564	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
2460	YOURDATA.exe
1888	powershell.exe
1888	powershell.exe
3208	powershell.exe
3208	powershell.exe
1040	powershell.exe
1040	powershell.exe
3208	powershell.exe
1888	powershell.exe
1040	powershell.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe
1256	YOURDATA.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7za.exe7za.exe5koto.exeYOURDATA.exeYOURDATA.exeYOURDATA.exe

description	pid	process
Token: SeRestorePrivilege	2680	7za.exe
Token: 35	2680	7za.exe
Token: SeRestorePrivilege	1088	7za.exe
Token: 35	1088	7za.exe
Token: SeSecurityPrivilege	1088	7za.exe
Token: SeSecurityPrivilege	1088	7za.exe
Token: SeIncreaseQuotaPrivilege	2112	5koto.exe
Token: SeSecurityPrivilege	2112	5koto.exe
Token: SeTakeOwnershipPrivilege	2112	5koto.exe
Token: SeLoadDriverPrivilege	2112	5koto.exe
Token: SeSystemProfilePrivilege	2112	5koto.exe
Token: SeSystemtimePrivilege	2112	5koto.exe
Token: SeProfSingleProcessPrivilege	2112	5koto.exe
Token: SeIncBasePriorityPrivilege	2112	5koto.exe
Token: SeCreatePagefilePrivilege	2112	5koto.exe
Token: SeBackupPrivilege	2112	5koto.exe
Token: SeRestorePrivilege	2112	5koto.exe
Token: SeShutdownPrivilege	2112	5koto.exe
Token: SeDebugPrivilege	2112	5koto.exe
Token: SeSystemEnvironmentPrivilege	2112	5koto.exe
Token: SeChangeNotifyPrivilege	2112	5koto.exe
Token: SeRemoteShutdownPrivilege	2112	5koto.exe
Token: SeUndockPrivilege	2112	5koto.exe
Token: SeManageVolumePrivilege	2112	5koto.exe
Token: SeImpersonatePrivilege	2112	5koto.exe
Token: SeCreateGlobalPrivilege	2112	5koto.exe
Token: 33	2112	5koto.exe
Token: 34	2112	5koto.exe
Token: 35	2112	5koto.exe
Token: 36	2112	5koto.exe
Token: SeIncreaseQuotaPrivilege	2460	YOURDATA.exe
Token: SeSecurityPrivilege	2460	YOURDATA.exe
Token: SeTakeOwnershipPrivilege	2460	YOURDATA.exe
Token: SeLoadDriverPrivilege	2460	YOURDATA.exe
Token: SeSystemProfilePrivilege	2460	YOURDATA.exe
Token: SeSystemtimePrivilege	2460	YOURDATA.exe
Token: SeProfSingleProcessPrivilege	2460	YOURDATA.exe
Token: SeIncBasePriorityPrivilege	2460	YOURDATA.exe
Token: SeCreatePagefilePrivilege	2460	YOURDATA.exe
Token: SeBackupPrivilege	2460	YOURDATA.exe
Token: SeRestorePrivilege	2460	YOURDATA.exe
Token: SeShutdownPrivilege	2460	YOURDATA.exe
Token: SeDebugPrivilege	2460	YOURDATA.exe
Token: SeSystemEnvironmentPrivilege	2460	YOURDATA.exe
Token: SeChangeNotifyPrivilege	2460	YOURDATA.exe
Token: SeRemoteShutdownPrivilege	2460	YOURDATA.exe
Token: SeUndockPrivilege	2460	YOURDATA.exe
Token: SeManageVolumePrivilege	2460	YOURDATA.exe
Token: SeImpersonatePrivilege	2460	YOURDATA.exe
Token: SeCreateGlobalPrivilege	2460	YOURDATA.exe
Token: 33	2460	YOURDATA.exe
Token: 34	2460	YOURDATA.exe
Token: 35	2460	YOURDATA.exe
Token: 36	2460	YOURDATA.exe
Token: SeIncreaseQuotaPrivilege	1564	YOURDATA.exe
Token: SeSecurityPrivilege	1564	YOURDATA.exe
Token: SeTakeOwnershipPrivilege	1564	YOURDATA.exe
Token: SeLoadDriverPrivilege	1564	YOURDATA.exe
Token: SeIncreaseQuotaPrivilege	3176	YOURDATA.exe
Token: SeSystemProfilePrivilege	1564	YOURDATA.exe
Token: SeSecurityPrivilege	3176	YOURDATA.exe
Token: SeSystemtimePrivilege	1564	YOURDATA.exe
Token: SeTakeOwnershipPrivilege	3176	YOURDATA.exe
Token: SeProfSingleProcessPrivilege	1564	YOURDATA.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Everything.exeEverything.exe

pid process

3288 Everything.exe
6052 Everything.exe

pid	process
3288	Everything.exe
6052	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe5koto.exeYOURDATA.execmd.exe

description	pid	process	target process
PID 4160 wrote to memory of 2680	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 4160 wrote to memory of 2680	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 4160 wrote to memory of 2680	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 4160 wrote to memory of 1088	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 4160 wrote to memory of 1088	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 4160 wrote to memory of 1088	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	7za.exe
PID 4160 wrote to memory of 2112	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	5koto.exe
PID 4160 wrote to memory of 2112	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	5koto.exe
PID 4160 wrote to memory of 2112	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	5koto.exe
PID 2112 wrote to memory of 2460	2112	5koto.exe	YOURDATA.exe
PID 2112 wrote to memory of 2460	2112	5koto.exe	YOURDATA.exe
PID 2112 wrote to memory of 2460	2112	5koto.exe	YOURDATA.exe
PID 2460 wrote to memory of 1988	2460	YOURDATA.exe	cmd.exe
PID 2460 wrote to memory of 1988	2460	YOURDATA.exe	cmd.exe
PID 2460 wrote to memory of 1988	2460	YOURDATA.exe	cmd.exe
PID 1988 wrote to memory of 4316	1988	cmd.exe	DC.exe
PID 1988 wrote to memory of 4316	1988	cmd.exe	DC.exe
PID 1988 wrote to memory of 4316	1988	cmd.exe	DC.exe
PID 2460 wrote to memory of 3176	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 3176	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 3176	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 1256	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 1256	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 1256	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 1564	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 1564	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 1564	2460	YOURDATA.exe	YOURDATA.exe
PID 2460 wrote to memory of 3288	2460	YOURDATA.exe	Everything.exe
PID 2460 wrote to memory of 3288	2460	YOURDATA.exe	Everything.exe
PID 2460 wrote to memory of 3288	2460	YOURDATA.exe	Everything.exe
PID 4160 wrote to memory of 2908	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	cmd.exe
PID 4160 wrote to memory of 2908	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	cmd.exe
PID 4160 wrote to memory of 2908	4160	1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe	cmd.exe
PID 2460 wrote to memory of 3940	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3940	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1120	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1120	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 4208	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 4208	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1996	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1996	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3480	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3480	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1960	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1960	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3484	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3484	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1632	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 1632	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 4152	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 4152	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3976	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3976	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3540	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3540	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3392	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3392	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 2524	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 2524	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 4952	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 4952	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 2360	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 2360	2460	YOURDATA.exe	powercfg.exe
PID 2460 wrote to memory of 3208	2460	YOURDATA.exe	powershell.exe

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

Processes:

YOURDATA.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	YOURDATA.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	YOURDATA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	YOURDATA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	YOURDATA.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
"C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p5056156942493511584 Everything64.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
    "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"
    3⤵
    - UAC bypass
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c DC.exe /D
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\DC.exe
        
        DC.exe /D
        5⤵
        Executes dropped EXE
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e watch -pid 2460 -!
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3176
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1256
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1564
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:3288
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -H off
      4⤵
      PID:3940
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1120
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:4208
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1996
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:3480
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1960
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:3484
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1632
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:4152
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:3976
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:3540
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:3392
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:2524
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      PID:4952
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      PID:2360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1888
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5552
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3420
  - - C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin.exe DELETE SYSTEMSTATEBACKUP
      4⤵
      Deletes System State backups
      PID:5664
  - - C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin.exe delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:2044
  - - C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe
      "C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:6052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  PID:2908

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1964

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2840

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4820

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4636

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4892

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4756

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4584

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1648

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4820

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4776

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:964

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery