latentbot | e712e370e41df79390877580930f72642efe97a874730e3eb87184356faa3b15

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\Gerichtsdokumente.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mama.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Security Profile\Shield.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Security Profile\\Shield.exe"	mama.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscntfy.exe

Adds policy Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows-Network Component = "C:\\Program Files\\Common Files\\lsmass.exe"	xd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windowssystemrecovery = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1d5b03bd-0000-0000-0000-d01200000000}	xd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1d5b03bd-0000-0000-0000-d01200000000}\StubPath = "C:\\ProgramData\\wscntfy.exe -r"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1d5b03bd-0000-0000-0000-d01200000000}\IsInstalled = "1"	xd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EBCDABA-4DAE-ABBE-6CDE-F3DFBBFEBCDD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2672	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	xd.exe

Executes dropped EXE 11 IoCs

pid	Process
3228	Gerichtsdokumente.exe
1824	mama.exe
320	xd.exe
1592	Gerichtsdokumente.exe
1840	mama.exe
2204	mama.exe
2572	wscntfy.exe
5004	lsmass.exe
464	Shield.exe
2852	Shield.exe
4728	Shield.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1592-28-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-24-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-26-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/2204-46-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2204-58-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2204-57-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2204-56-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2204-82-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/1592-97-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/4728-98-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/1592-99-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-100-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-103-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-105-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-107-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-110-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-112-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-114-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-117-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-119-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-121-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-124-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-126-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1592-128-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windowssystemrecovery = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows-Audio Driver = "C:\\ProgramData\\wscntfy.exe"	xd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shield.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Security Profile\\Shield.exe"	mama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windowssystemrecovery = "C:\\Users\\Admin\\AppData\\Roaming\\Gerichtsdokumente.exe"	Gerichtsdokumente.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscntfy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wscntfy.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3228 set thread context of 1592	3228	Gerichtsdokumente.exe	93
PID 1824 set thread context of 1840	1824	mama.exe	106
PID 1840 set thread context of 2204	1840	mama.exe	107
PID 464 set thread context of 2852	464	Shield.exe	116
PID 2852 set thread context of 4728	2852	Shield.exe	117

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\lsmass.exe	xd.exe
File opened for modification	C:\Program Files\Common Files\lsmass.exe	xd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

pid	Process
1352	reg.exe
4012	reg.exe
1104	reg.exe
4068	reg.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: 1	1592	Gerichtsdokumente.exe
Token: SeCreateTokenPrivilege	1592	Gerichtsdokumente.exe
Token: SeAssignPrimaryTokenPrivilege	1592	Gerichtsdokumente.exe
Token: SeLockMemoryPrivilege	1592	Gerichtsdokumente.exe
Token: SeIncreaseQuotaPrivilege	1592	Gerichtsdokumente.exe
Token: SeMachineAccountPrivilege	1592	Gerichtsdokumente.exe
Token: SeTcbPrivilege	1592	Gerichtsdokumente.exe
Token: SeSecurityPrivilege	1592	Gerichtsdokumente.exe
Token: SeTakeOwnershipPrivilege	1592	Gerichtsdokumente.exe
Token: SeLoadDriverPrivilege	1592	Gerichtsdokumente.exe
Token: SeSystemProfilePrivilege	1592	Gerichtsdokumente.exe
Token: SeSystemtimePrivilege	1592	Gerichtsdokumente.exe
Token: SeProfSingleProcessPrivilege	1592	Gerichtsdokumente.exe
Token: SeIncBasePriorityPrivilege	1592	Gerichtsdokumente.exe
Token: SeCreatePagefilePrivilege	1592	Gerichtsdokumente.exe
Token: SeCreatePermanentPrivilege	1592	Gerichtsdokumente.exe
Token: SeBackupPrivilege	1592	Gerichtsdokumente.exe
Token: SeRestorePrivilege	1592	Gerichtsdokumente.exe
Token: SeShutdownPrivilege	1592	Gerichtsdokumente.exe
Token: SeDebugPrivilege	1592	Gerichtsdokumente.exe
Token: SeAuditPrivilege	1592	Gerichtsdokumente.exe
Token: SeSystemEnvironmentPrivilege	1592	Gerichtsdokumente.exe
Token: SeChangeNotifyPrivilege	1592	Gerichtsdokumente.exe
Token: SeRemoteShutdownPrivilege	1592	Gerichtsdokumente.exe
Token: SeUndockPrivilege	1592	Gerichtsdokumente.exe
Token: SeSyncAgentPrivilege	1592	Gerichtsdokumente.exe
Token: SeEnableDelegationPrivilege	1592	Gerichtsdokumente.exe
Token: SeManageVolumePrivilege	1592	Gerichtsdokumente.exe
Token: SeImpersonatePrivilege	1592	Gerichtsdokumente.exe
Token: SeCreateGlobalPrivilege	1592	Gerichtsdokumente.exe
Token: 31	1592	Gerichtsdokumente.exe
Token: 32	1592	Gerichtsdokumente.exe
Token: 33	1592	Gerichtsdokumente.exe
Token: 34	1592	Gerichtsdokumente.exe
Token: 35	1592	Gerichtsdokumente.exe
Token: SeDebugPrivilege	320	xd.exe
Token: SeDebugPrivilege	2572	wscntfy.exe
Token: SeDebugPrivilege	5004	lsmass.exe
Token: SeIncreaseQuotaPrivilege	2572	wscntfy.exe
Token: SeSecurityPrivilege	2572	wscntfy.exe
Token: SeTakeOwnershipPrivilege	2572	wscntfy.exe
Token: SeLoadDriverPrivilege	2572	wscntfy.exe
Token: SeSystemProfilePrivilege	2572	wscntfy.exe
Token: SeSystemtimePrivilege	2572	wscntfy.exe
Token: SeProfSingleProcessPrivilege	2572	wscntfy.exe
Token: SeIncBasePriorityPrivilege	2572	wscntfy.exe
Token: SeCreatePagefilePrivilege	2572	wscntfy.exe
Token: SeBackupPrivilege	2572	wscntfy.exe
Token: SeRestorePrivilege	2572	wscntfy.exe
Token: SeShutdownPrivilege	2572	wscntfy.exe
Token: SeDebugPrivilege	2572	wscntfy.exe
Token: SeSystemEnvironmentPrivilege	2572	wscntfy.exe
Token: SeRemoteShutdownPrivilege	2572	wscntfy.exe
Token: SeUndockPrivilege	2572	wscntfy.exe
Token: SeManageVolumePrivilege	2572	wscntfy.exe
Token: 33	2572	wscntfy.exe
Token: 34	2572	wscntfy.exe
Token: 35	2572	wscntfy.exe
Token: 36	2572	wscntfy.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3228	Gerichtsdokumente.exe
1824	mama.exe
1592	Gerichtsdokumente.exe
1592	Gerichtsdokumente.exe
1592	Gerichtsdokumente.exe
464	Shield.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4160	3368	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	85
PID 3368 wrote to memory of 4160	3368	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	85
PID 3368 wrote to memory of 4160	3368	5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe	85
PID 4160 wrote to memory of 3228	4160	cmd.exe	89
PID 4160 wrote to memory of 3228	4160	cmd.exe	89
PID 4160 wrote to memory of 3228	4160	cmd.exe	89
PID 4160 wrote to memory of 1824	4160	cmd.exe	90
PID 4160 wrote to memory of 1824	4160	cmd.exe	90
PID 4160 wrote to memory of 1824	4160	cmd.exe	90
PID 4160 wrote to memory of 320	4160	cmd.exe	91
PID 4160 wrote to memory of 320	4160	cmd.exe	91
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 3228 wrote to memory of 1592	3228	Gerichtsdokumente.exe	93
PID 1592 wrote to memory of 4468	1592	Gerichtsdokumente.exe	94
PID 1592 wrote to memory of 4468	1592	Gerichtsdokumente.exe	94
PID 1592 wrote to memory of 4468	1592	Gerichtsdokumente.exe	94
PID 1592 wrote to memory of 1812	1592	Gerichtsdokumente.exe	95
PID 1592 wrote to memory of 1812	1592	Gerichtsdokumente.exe	95
PID 1592 wrote to memory of 1812	1592	Gerichtsdokumente.exe	95
PID 1592 wrote to memory of 1456	1592	Gerichtsdokumente.exe	96
PID 1592 wrote to memory of 1456	1592	Gerichtsdokumente.exe	96
PID 1592 wrote to memory of 1456	1592	Gerichtsdokumente.exe	96
PID 1592 wrote to memory of 3576	1592	Gerichtsdokumente.exe	97
PID 1592 wrote to memory of 3576	1592	Gerichtsdokumente.exe	97
PID 1592 wrote to memory of 3576	1592	Gerichtsdokumente.exe	97
PID 3576 wrote to memory of 1352	3576	cmd.exe	102
PID 3576 wrote to memory of 1352	3576	cmd.exe	102
PID 3576 wrote to memory of 1352	3576	cmd.exe	102
PID 1812 wrote to memory of 4012	1812	cmd.exe	103
PID 1812 wrote to memory of 4012	1812	cmd.exe	103
PID 1812 wrote to memory of 4012	1812	cmd.exe	103
PID 1456 wrote to memory of 1104	1456	cmd.exe	105
PID 1456 wrote to memory of 1104	1456	cmd.exe	105
PID 1456 wrote to memory of 1104	1456	cmd.exe	105
PID 4468 wrote to memory of 4068	4468	cmd.exe	104
PID 4468 wrote to memory of 4068	4468	cmd.exe	104
PID 4468 wrote to memory of 4068	4468	cmd.exe	104
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1824 wrote to memory of 1840	1824	mama.exe	106
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 1840 wrote to memory of 2204	1840	mama.exe	107
PID 320 wrote to memory of 2572	320	xd.exe	108
PID 320 wrote to memory of 2572	320	xd.exe	108
PID 320 wrote to memory of 5004	320	xd.exe	109

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscntfy.exe

C:\Users\Admin\AppData\Local\Temp\5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a7a2143b1af1c765c4771c8eb218d7a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe
    Gerichtsdokumente.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe
      C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4468
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:4068
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1812
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:4012
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:1104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3576
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Gerichtsdokumente.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:1352
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe
    mama.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mama.exe"
        5⤵
        Modifies firewall policy service
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2204
      - C:\Users\Admin\AppData\Roaming\Security Profile\Shield.exe
        
        "C:\Users\Admin\AppData\Roaming\Security Profile\Shield.exe" in
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Users\Admin\AppData\Roaming\Security Profile\Shield.exe
        
        "C:\Users\Admin\AppData\Roaming\Security Profile\Shield.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2852
        
        C:\Users\Admin\AppData\Roaming\Security Profile\Shield.exe
        
        "C:\Users\Admin\AppData\Roaming\Security Profile\Shield.exe"
        8⤵
        Executes dropped EXE
        
        PID:4728
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\xd.exe
    xd.exe
    3⤵
    - UAC bypass
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:320
  - - C:\ProgramData\wscntfy.exe
      "C:\ProgramData\wscntfy.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2572
    - - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh.exe" firewall add allowedprogram program="C:\ProgramData\wscntfy.exe" name="Windows-Audio Driver" mode=ENABLE scope=ALL profile=ALL
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2672
  - - C:\Program Files\Common Files\lsmass.exe
      "C:\Program Files\Common Files\lsmass.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry