latentbot | e712e370e41df79390877580930f72642efe97a874730e3eb87184356faa3b15

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mama.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\Gerichtsdokumente.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Security Deamonu\Shield.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Security Deamonu\\Shield.exe"	mama.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscntfy.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windowssystemrecovery = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows-Network Component = "C:\\Program Files\\Common Files\\lsmass.exe"	xd.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{d73183e4-3d82-11ef-bab6-806e6f6e6963}	xd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{d73183e4-3d82-11ef-bab6-806e6f6e6963}\StubPath = "C:\\ProgramData\\wscntfy.exe -r"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{d73183e4-3d82-11ef-bab6-806e6f6e6963}\IsInstalled = "1"	xd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2200	netsh.exe

Executes dropped EXE 11 IoCs

pid	Process
1728	Gerichtsdokumente.exe
2664	mama.exe
2468	xd.exe
2336	Gerichtsdokumente.exe
2880	wscntfy.exe
2764	lsmass.exe
1012	mama.exe
1196	mama.exe
524	Shield.exe
392	Shield.exe
1228	Shield.exe

Loads dropped DLL 13 IoCs

pid	Process
2520	cmd.exe
2520	cmd.exe
2520	cmd.exe
2520	cmd.exe
2520	cmd.exe
2520	cmd.exe
1728	Gerichtsdokumente.exe
2664	mama.exe
1012	mama.exe
1196	mama.exe
1196	mama.exe
524	Shield.exe
392	Shield.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-39-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2336-43-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2336-41-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2336-49-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1196-98-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1196-97-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1196-96-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1196-88-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1196-86-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1196-95-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1196-91-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1196-110-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2336-151-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1228-154-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows-Audio Driver = "C:\\ProgramData\\wscntfy.exe"	xd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windowssystemrecovery = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windowssystemrecovery = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Shield.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Security Deamonu\\Shield.exe"	mama.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wscntfy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscntfy.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 2336	1728	Gerichtsdokumente.exe	35
PID 2664 set thread context of 1012	2664	mama.exe	52
PID 1012 set thread context of 1196	1012	mama.exe	54
PID 524 set thread context of 392	524	Shield.exe	56
PID 392 set thread context of 1228	392	Shield.exe	57

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\lsmass.exe	xd.exe
File opened for modification	C:\Program Files\Common Files\lsmass.exe	xd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

pid	Process
1536	reg.exe
748	reg.exe
3048	reg.exe
2700	reg.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	xd.exe
Token: 1	2336	Gerichtsdokumente.exe
Token: SeCreateTokenPrivilege	2336	Gerichtsdokumente.exe
Token: SeAssignPrimaryTokenPrivilege	2336	Gerichtsdokumente.exe
Token: SeLockMemoryPrivilege	2336	Gerichtsdokumente.exe
Token: SeIncreaseQuotaPrivilege	2336	Gerichtsdokumente.exe
Token: SeMachineAccountPrivilege	2336	Gerichtsdokumente.exe
Token: SeTcbPrivilege	2336	Gerichtsdokumente.exe
Token: SeSecurityPrivilege	2336	Gerichtsdokumente.exe
Token: SeTakeOwnershipPrivilege	2336	Gerichtsdokumente.exe
Token: SeLoadDriverPrivilege	2336	Gerichtsdokumente.exe
Token: SeSystemProfilePrivilege	2336	Gerichtsdokumente.exe
Token: SeSystemtimePrivilege	2336	Gerichtsdokumente.exe
Token: SeProfSingleProcessPrivilege	2336	Gerichtsdokumente.exe
Token: SeIncBasePriorityPrivilege	2336	Gerichtsdokumente.exe
Token: SeCreatePagefilePrivilege	2336	Gerichtsdokumente.exe
Token: SeCreatePermanentPrivilege	2336	Gerichtsdokumente.exe
Token: SeBackupPrivilege	2336	Gerichtsdokumente.exe
Token: SeRestorePrivilege	2336	Gerichtsdokumente.exe
Token: SeShutdownPrivilege	2336	Gerichtsdokumente.exe
Token: SeDebugPrivilege	2336	Gerichtsdokumente.exe
Token: SeAuditPrivilege	2336	Gerichtsdokumente.exe
Token: SeSystemEnvironmentPrivilege	2336	Gerichtsdokumente.exe
Token: SeChangeNotifyPrivilege	2336	Gerichtsdokumente.exe
Token: SeRemoteShutdownPrivilege	2336	Gerichtsdokumente.exe
Token: SeUndockPrivilege	2336	Gerichtsdokumente.exe
Token: SeSyncAgentPrivilege	2336	Gerichtsdokumente.exe
Token: SeEnableDelegationPrivilege	2336	Gerichtsdokumente.exe
Token: SeManageVolumePrivilege	2336	Gerichtsdokumente.exe
Token: SeImpersonatePrivilege	2336	Gerichtsdokumente.exe
Token: SeCreateGlobalPrivilege	2336	Gerichtsdokumente.exe
Token: 31	2336	Gerichtsdokumente.exe
Token: 32	2336	Gerichtsdokumente.exe
Token: 33	2336	Gerichtsdokumente.exe
Token: 34	2336	Gerichtsdokumente.exe
Token: 35	2336	Gerichtsdokumente.exe
Token: SeDebugPrivilege	2880	wscntfy.exe
Token: SeDebugPrivilege	2764	lsmass.exe
Token: SeIncreaseQuotaPrivilege	2880	wscntfy.exe
Token: SeSecurityPrivilege	2880	wscntfy.exe
Token: SeTakeOwnershipPrivilege	2880	wscntfy.exe
Token: SeLoadDriverPrivilege	2880	wscntfy.exe
Token: SeSystemProfilePrivilege	2880	wscntfy.exe
Token: SeSystemtimePrivilege	2880	wscntfy.exe
Token: SeProfSingleProcessPrivilege	2880	wscntfy.exe
Token: SeIncBasePriorityPrivilege	2880	wscntfy.exe
Token: SeCreatePagefilePrivilege	2880	wscntfy.exe
Token: SeBackupPrivilege	2880	wscntfy.exe
Token: SeRestorePrivilege	2880	wscntfy.exe
Token: SeShutdownPrivilege	2880	wscntfy.exe
Token: SeDebugPrivilege	2880	wscntfy.exe
Token: SeSystemEnvironmentPrivilege	2880	wscntfy.exe
Token: SeRemoteShutdownPrivilege	2880	wscntfy.exe
Token: SeUndockPrivilege	2880	wscntfy.exe
Token: SeManageVolumePrivilege	2880	wscntfy.exe
Token: 33	2880	wscntfy.exe
Token: 34	2880	wscntfy.exe
Token: 35	2880	wscntfy.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	Gerichtsdokumente.exe
2664	mama.exe
2336	Gerichtsdokumente.exe
2336	Gerichtsdokumente.exe
2336	Gerichtsdokumente.exe
524	Shield.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 2520	292	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	30
PID 292 wrote to memory of 2520	292	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	30
PID 292 wrote to memory of 2520	292	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	30
PID 292 wrote to memory of 2520	292	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	30
PID 292 wrote to memory of 2520	292	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	30
PID 292 wrote to memory of 2520	292	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	30
PID 292 wrote to memory of 2520	292	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	30
PID 2520 wrote to memory of 1728	2520	cmd.exe	32
PID 2520 wrote to memory of 1728	2520	cmd.exe	32
PID 2520 wrote to memory of 1728	2520	cmd.exe	32
PID 2520 wrote to memory of 1728	2520	cmd.exe	32
PID 2520 wrote to memory of 1728	2520	cmd.exe	32
PID 2520 wrote to memory of 1728	2520	cmd.exe	32
PID 2520 wrote to memory of 1728	2520	cmd.exe	32
PID 2520 wrote to memory of 2664	2520	cmd.exe	33
PID 2520 wrote to memory of 2664	2520	cmd.exe	33
PID 2520 wrote to memory of 2664	2520	cmd.exe	33
PID 2520 wrote to memory of 2664	2520	cmd.exe	33
PID 2520 wrote to memory of 2664	2520	cmd.exe	33
PID 2520 wrote to memory of 2664	2520	cmd.exe	33
PID 2520 wrote to memory of 2664	2520	cmd.exe	33
PID 2520 wrote to memory of 2468	2520	cmd.exe	34
PID 2520 wrote to memory of 2468	2520	cmd.exe	34
PID 2520 wrote to memory of 2468	2520	cmd.exe	34
PID 2520 wrote to memory of 2468	2520	cmd.exe	34
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 1728 wrote to memory of 2336	1728	Gerichtsdokumente.exe	35
PID 2468 wrote to memory of 2880	2468	xd.exe	36
PID 2468 wrote to memory of 2880	2468	xd.exe	36
PID 2468 wrote to memory of 2880	2468	xd.exe	36
PID 2336 wrote to memory of 2888	2336	Gerichtsdokumente.exe	37
PID 2336 wrote to memory of 2888	2336	Gerichtsdokumente.exe	37
PID 2336 wrote to memory of 2888	2336	Gerichtsdokumente.exe	37
PID 2336 wrote to memory of 2888	2336	Gerichtsdokumente.exe	37
PID 2336 wrote to memory of 2888	2336	Gerichtsdokumente.exe	37
PID 2336 wrote to memory of 2888	2336	Gerichtsdokumente.exe	37
PID 2336 wrote to memory of 2888	2336	Gerichtsdokumente.exe	37
PID 2336 wrote to memory of 2904	2336	Gerichtsdokumente.exe	38
PID 2336 wrote to memory of 2904	2336	Gerichtsdokumente.exe	38
PID 2336 wrote to memory of 2904	2336	Gerichtsdokumente.exe	38
PID 2336 wrote to memory of 2904	2336	Gerichtsdokumente.exe	38
PID 2336 wrote to memory of 2904	2336	Gerichtsdokumente.exe	38
PID 2336 wrote to memory of 2904	2336	Gerichtsdokumente.exe	38
PID 2336 wrote to memory of 2904	2336	Gerichtsdokumente.exe	38
PID 2336 wrote to memory of 2740	2336	Gerichtsdokumente.exe	39
PID 2336 wrote to memory of 2740	2336	Gerichtsdokumente.exe	39
PID 2336 wrote to memory of 2740	2336	Gerichtsdokumente.exe	39
PID 2336 wrote to memory of 2740	2336	Gerichtsdokumente.exe	39
PID 2336 wrote to memory of 2740	2336	Gerichtsdokumente.exe	39
PID 2336 wrote to memory of 2740	2336	Gerichtsdokumente.exe	39
PID 2336 wrote to memory of 2740	2336	Gerichtsdokumente.exe	39
PID 2336 wrote to memory of 2616	2336	Gerichtsdokumente.exe	40
PID 2336 wrote to memory of 2616	2336	Gerichtsdokumente.exe	40
PID 2336 wrote to memory of 2616	2336	Gerichtsdokumente.exe	40

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscntfy.exe

C:\Users\Admin\AppData\Local\Temp\5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.cmd" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe
    Gerichtsdokumente.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe
      C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2888
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:2700
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:2904
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:748
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2740
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3048
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:2616
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:1536
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe
    mama.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe"
        5⤵
        Modifies firewall policy service
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1196
      - C:\Users\Admin\AppData\Roaming\Security Deamonu\Shield.exe
        
        "C:\Users\Admin\AppData\Roaming\Security Deamonu\Shield.exe" in
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:524
        
        C:\Users\Admin\AppData\Roaming\Security Deamonu\Shield.exe
        
        "C:\Users\Admin\AppData\Roaming\Security Deamonu\Shield.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:392
        
        C:\Users\Admin\AppData\Roaming\Security Deamonu\Shield.exe
        
        "C:\Users\Admin\AppData\Roaming\Security Deamonu\Shield.exe"
        8⤵
        Executes dropped EXE
        
        PID:1228
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\xd.exe
    xd.exe
    3⤵
    - UAC bypass
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2468
  - - C:\ProgramData\wscntfy.exe
      "C:\ProgramData\wscntfy.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2880
    - - C:\Windows\system32\netsh.exe
        
        "netsh.exe" firewall add allowedprogram program="C:\ProgramData\wscntfy.exe" name="Windows-Audio Driver" mode=ENABLE scope=ALL profile=ALL
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2200
  - - C:\Program Files\Common Files\lsmass.exe
      "C:\Program Files\Common Files\lsmass.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry