gh0strat | 98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55

Modify Registry

T1112

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240601109.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exeRemote Data.exe

pid	process
3684	R.exe
2284	N.exe
2940	TXPlatfor.exe
2700	TXPlatfor.exe
1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
2168	Remote Data.exe

Loads dropped DLL 4 IoCs

Processes:

R.exesvchost.exeregsvr32.exeRemote Data.exe

pid process

3684 R.exe
2144 svchost.exe
5100 regsvr32.exe
2168 Remote Data.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2284-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2284-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2284-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2284-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2940-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2940-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2940-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1788-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-82-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2700-83-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2700-89-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2700-88-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1788-80-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-76-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1788-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

description ioc process

File opened for modification \??\PhysicalDrive0 HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

Drops file in System32 directory 9 IoCs

Processes:

svchost.exeN.exeregsvr32.exeR.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\yxkey.ime	regsvr32.exe
File created	C:\Windows\SysWOW64\AdbWinApi.dll	regsvr32.exe
File created	C:\Windows\SysWOW64\Adb.exe	regsvr32.exe
File created	C:\Windows\SysWOW64\240601109.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Drops file in Program Files directory 1 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 35 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\ = "lwcom"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\TypeLib\ = "{71175991-9B59-42EA-B712-9ADF3319AC18}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32\ = "C:\\wckzbin\\lw.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib\ = "{71175991-9B59-42EA-B712-9ADF3319AC18}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0\win32\ = "C:\\wckzbin\\lw.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CLSID\ = "{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CurVer\ = "lw.lwsoft3.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\VersionIndependentProgID\ = "lw.lwsoft3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\CLSID\ = "{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\ = "lwcom"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\ = "lwcom"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\ = "lwcom"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ = "lwcom"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ProgID\ = "lw.lwsoft3.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib\version = "1.0"	regsvr32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1388 PING.EXE

pid	process
1388	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

pid	process
3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2700 TXPlatfor.exe

pid	process
2700	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

N.exeTXPlatfor.exeregsvr32.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2284	N.exe
Token: SeLoadDriverPrivilege	2700	TXPlatfor.exe
Token: SeDebugPrivilege	5100	regsvr32.exe
Token: 33	2700	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2700	TXPlatfor.exe
Token: 33	2700	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2700	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exeHD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

pid	process
3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exeN.exeTXPlatfor.exeHD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.execmd.exesvchost.exe

description	pid	process	target process
PID 3636 wrote to memory of 3684	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	R.exe
PID 3636 wrote to memory of 3684	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	R.exe
PID 3636 wrote to memory of 3684	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	R.exe
PID 3636 wrote to memory of 2284	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 3636 wrote to memory of 2284	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 3636 wrote to memory of 2284	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	N.exe
PID 2284 wrote to memory of 2712	2284	N.exe	cmd.exe
PID 2284 wrote to memory of 2712	2284	N.exe	cmd.exe
PID 2284 wrote to memory of 2712	2284	N.exe	cmd.exe
PID 2940 wrote to memory of 2700	2940	TXPlatfor.exe	TXPlatfor.exe
PID 2940 wrote to memory of 2700	2940	TXPlatfor.exe	TXPlatfor.exe
PID 2940 wrote to memory of 2700	2940	TXPlatfor.exe	TXPlatfor.exe
PID 3636 wrote to memory of 1788	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
PID 3636 wrote to memory of 1788	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
PID 3636 wrote to memory of 1788	3636	98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
PID 1788 wrote to memory of 1692	1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 1788 wrote to memory of 1692	1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 1788 wrote to memory of 1692	1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 1788 wrote to memory of 5100	1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 1788 wrote to memory of 5100	1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 1788 wrote to memory of 5100	1788	HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe	regsvr32.exe
PID 2712 wrote to memory of 1388	2712	cmd.exe	PING.EXE
PID 2712 wrote to memory of 1388	2712	cmd.exe	PING.EXE
PID 2712 wrote to memory of 1388	2712	cmd.exe	PING.EXE
PID 2144 wrote to memory of 2168	2144	svchost.exe	Remote Data.exe
PID 2144 wrote to memory of 2168	2144	svchost.exe	Remote Data.exe
PID 2144 wrote to memory of 2168	2144	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
"C:\Users\Admin\AppData\Local\Temp\98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3684

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:1388

C:\Users\Admin\AppData\Local\Temp\HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
C:\Users\Admin\AppData\Local\Temp\HD_98fb377635519a8c8a1c21fb6fc4d52a71094f9b0978b13e4077a1fa74ca4e55.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 atl.dll /s
3⤵
PID:1692

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 C:\wckzbin\lw.dll /s
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:3520

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240601109.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery