gh0strat | 98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55

Modify Registry

T1112

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259393579.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exeRemote Data.exe

pid	process
1628	R.exe
2968	N.exe
2688	TXPlatfor.exe
2612	TXPlatfor.exe
2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1932	Remote Data.exe

Loads dropped DLL 10 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exeR.exesvchost.exeTXPlatfor.exeregsvr32.exeRemote Data.exe

pid	process
1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1628	R.exe
1836	svchost.exe
1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
2688	TXPlatfor.exe
1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1648	regsvr32.exe
1836	svchost.exe
1932	Remote Data.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2968-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2968-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2968-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2612-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2612-50-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2508-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-86-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-94-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-92-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-90-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-88-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-82-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-96-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2508-80-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-76-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2508-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

description ioc process

File opened for modification \??\PhysicalDrive0 HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

Drops file in System32 directory 9 IoCs

Processes:

regsvr32.exeR.exesvchost.exeN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\AdbWinApi.dll	regsvr32.exe
File created	C:\Windows\SysWOW64\259393579.txt	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\yxkey.ime	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\Adb.exe	regsvr32.exe

Modifies registry class 35 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\ = "lwcom"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CurVer\ = "lw.lwsoft3.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\VersionIndependentProgID\ = "lw.lwsoft3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32\ = "C:\\wckzbin\\lw.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CLSID\ = "{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ = "lwcom"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\TypeLib\ = "{71175991-9B59-42EA-B712-9ADF3319AC18}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib\ = "{71175991-9B59-42EA-B712-9ADF3319AC18}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\CLSID\ = "{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\ = "lwcom"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib\version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\ = "lwcom"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0\win32\ = "C:\\wckzbin\\lw.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\ = "lwcom"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ProgID\ = "lw.lwsoft3.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0	regsvr32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2492 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

pid process

1600 98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2612 TXPlatfor.exe

pid	process
2492	PING.EXE

pid	process
2612	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

N.exeTXPlatfor.exeregsvr32.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2968	N.exe
Token: SeLoadDriverPrivilege	2612	TXPlatfor.exe
Token: SeDebugPrivilege	1648	regsvr32.exe
Token: 33	2612	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2612	TXPlatfor.exe
Token: 33	2612	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2612	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exeHD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

pid	process
1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exeN.exeTXPlatfor.execmd.exeHD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exesvchost.exe

description	pid	process	target process
PID 1600 wrote to memory of 1628	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	R.exe
PID 1600 wrote to memory of 1628	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	R.exe
PID 1600 wrote to memory of 1628	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	R.exe
PID 1600 wrote to memory of 1628	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	R.exe
PID 1600 wrote to memory of 2968	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 1600 wrote to memory of 2968	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 1600 wrote to memory of 2968	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 1600 wrote to memory of 2968	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 1600 wrote to memory of 2968	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 1600 wrote to memory of 2968	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 1600 wrote to memory of 2968	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 2968 wrote to memory of 2628	2968	N.exe	cmd.exe
PID 2968 wrote to memory of 2628	2968	N.exe	cmd.exe
PID 2968 wrote to memory of 2628	2968	N.exe	cmd.exe
PID 2968 wrote to memory of 2628	2968	N.exe	cmd.exe
PID 2688 wrote to memory of 2612	2688	TXPlatfor.exe	TXPlatfor.exe
PID 2688 wrote to memory of 2612	2688	TXPlatfor.exe	TXPlatfor.exe
PID 2688 wrote to memory of 2612	2688	TXPlatfor.exe	TXPlatfor.exe
PID 2688 wrote to memory of 2612	2688	TXPlatfor.exe	TXPlatfor.exe
PID 2688 wrote to memory of 2612	2688	TXPlatfor.exe	TXPlatfor.exe
PID 2688 wrote to memory of 2612	2688	TXPlatfor.exe	TXPlatfor.exe
PID 2688 wrote to memory of 2612	2688	TXPlatfor.exe	TXPlatfor.exe
PID 1600 wrote to memory of 2508	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
PID 1600 wrote to memory of 2508	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
PID 1600 wrote to memory of 2508	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
PID 1600 wrote to memory of 2508	1600	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
PID 2628 wrote to memory of 2492	2628	cmd.exe	PING.EXE
PID 2628 wrote to memory of 2492	2628	cmd.exe	PING.EXE
PID 2628 wrote to memory of 2492	2628	cmd.exe	PING.EXE
PID 2628 wrote to memory of 2492	2628	cmd.exe	PING.EXE
PID 2508 wrote to memory of 2776	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 2776	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 2776	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 2776	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 2776	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 2776	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 2776	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 1648	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 1648	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 1648	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 1648	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 1648	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 1648	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2508 wrote to memory of 1648	2508	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 1836 wrote to memory of 1932	1836	svchost.exe	Remote Data.exe
PID 1836 wrote to memory of 1932	1836	svchost.exe	Remote Data.exe
PID 1836 wrote to memory of 1932	1836	svchost.exe	Remote Data.exe
PID 1836 wrote to memory of 1932	1836	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
"C:\Users\Admin\AppData\Local\Temp\98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1628

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2492

C:\Users\Admin\AppData\Local\Temp\HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
C:\Users\Admin\AppData\Local\Temp\HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 atl.dll /s
3⤵
PID:2776

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 C:\wckzbin\lw.dll /s
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:3020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259393579.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Remote System Discovery