asyncrat | ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\Client.exe"	Client.exe

Modifies firewall policy service 3 TTPs 4 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List	wowmgr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\1022:TCP = "1022:TCP:*:Enabled:Microsoft Secutiry Center"	wowmgr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List	wowmgr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\1022:TCP = "1022:TCP:*:Enabled:Microsoft Secutiry Center"	wowmgr.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	2500	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	2500	schtasks.exe	69

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000500000001a0a9-183.dat	family_stormkitty
behavioral1/memory/2068-321-0x00000000009D0000-0x0000000000A02000-memory.dmp	family_stormkitty

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000500000001a0a9-183.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000500000001a45c-246.dat	dcrat
behavioral1/memory/1964-290-0x00000000008E0000-0x00000000009B6000-memory.dmp	dcrat
behavioral1/memory/1956-293-0x0000000000120000-0x00000000001F6000-memory.dmp	dcrat
behavioral1/files/0x000500000001a037-163.dat	dcrat
behavioral1/memory/4024-1567-0x0000000001230000-0x0000000001306000-memory.dmp	dcrat
behavioral1/memory/580-1570-0x0000000001250000-0x0000000001326000-memory.dmp	dcrat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	help.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JZDHLPFP6LM = "C:\\Program Files (x86)\\see7.exe"	help.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DRIVERS\atmarph.sys	BTZ.exe
File created	C:\Windows\SysWOW64\DRIVERS\wimmouno.sys	938b92958ded4d50a357d22eddf141ad.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Modifies Windows Firewall 2 TTPs 3 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
3528	netsh.exe
3316	netsh.exe
3620	netsh.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20006afb0ec33f2e48c8c1f17d4d3382.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20006afb0ec33f2e48c8c1f17d4d3382.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\619680d438aded33a3114805b64591c9.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\619680d438aded33a3114805b64591c9.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\FNVBDKPICB-DECRYPT.txt	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\FNVBDKPICB-DECRYPT.txt	wermgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\a59477c6a594702461.lock	wermgr.exe

Executes dropped EXE 43 IoCs

pid	Process
1952	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
1484	クラック.exe
2680	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
1964	5e710462c65fe899466e4fb7c1e33c9a.exe
1152	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
2068	7f1630df6b57af024a3b561bdadc208f.exe
1916	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
1300	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
1956	73c1c41b9e71c48e752a5cd19fe808b6.exe
276	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
952	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
1904	938b92958ded4d50a357d22eddf141ad.exe
308	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
2960	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2912	BTZ.exe
2736	Cat.exe
2420	Client.exe
2788	Darkest Dungeon setub.exe
2036	evil.exe
1988	fwclt.exe
2448	Gandcrab5.0.3.exe
1764	Happy18.exe
1936	kosomk.exe
2096	LightNeuronX0.exe
2496	malecus.exe
1552	see7.exe
2276	TEST.exe
2336	vbc.exe
2464	virus.jk.exe
616	dicsord.exe
2952	evil.exe
4024	7f1630df6b57af024a3b561bdadc208f.exe
3248	fwclt.exe
580	HelpPane.exe
1532	server.exe
3304	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
1748	svhost.exe
2508	cbgsujmwws.exe
3960	cbgsujmwws.exe
1900	Microsoft To Do.exe
2768	see7.exe
3168	wowmgr.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WOWManager	BTZ.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WOWManager\ = "Service"	BTZ.exe

Loads dropped DLL 56 IoCs

pid	Process
2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe
2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1952	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
2912	BTZ.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1484	クラック.exe
1936	kosomk.exe
2036	evil.exe
1904	938b92958ded4d50a357d22eddf141ad.exe
1904	938b92958ded4d50a357d22eddf141ad.exe
1152	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
2788	Darkest Dungeon setub.exe
2336	vbc.exe
2508	cbgsujmwws.exe
3996	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000018728-8.dat	upx
behavioral1/memory/1952-10-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1952-11-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1952-94-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/308-265-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1952-327-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1952-295-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/308-410-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/files/0x000500000001a49e-263.dat	upx
behavioral1/memory/1952-450-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/308-604-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1952-1542-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/308-1568-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1952-1691-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/308-1710-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1952-1790-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/308-1818-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1952-1913-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1952-1998-0x0000000000400000-0x0000000000523000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000500000001a4e6-308.dat	vmprotect

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	cbgsujmwws.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cbgsujmwws.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cbgsujmwws.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Adobe = "C:\\Program Files (x86)\\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\WatchDog.exe"	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\DriverrHub\\Microsoft To Do.exe\""	TEST.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\20006afb0ec33f2e48c8c1f17d4d3382 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\20006afb0ec33f2e48c8c1f17d4d3382 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\619680d438aded33a3114805b64591c9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\619680d438aded33a3114805b64591c9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File created	C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File created	C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File opened for modification	C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe
File created	C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	7f1630df6b57af024a3b561bdadc208f.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	wermgr.exe
File opened (read-only)	\??\Q:	wermgr.exe
File opened (read-only)	\??\V:	wermgr.exe
File opened (read-only)	\??\Y:	wermgr.exe
File opened (read-only)	\??\N:	wermgr.exe
File opened (read-only)	\??\I:	wermgr.exe
File opened (read-only)	\??\T:	wermgr.exe
File opened (read-only)	\??\U:	wermgr.exe
File opened (read-only)	\??\W:	wermgr.exe
File opened (read-only)	\??\E:	wermgr.exe
File opened (read-only)	\??\H:	wermgr.exe
File opened (read-only)	\??\J:	wermgr.exe
File opened (read-only)	\??\M:	wermgr.exe
File opened (read-only)	\??\R:	wermgr.exe
File opened (read-only)	\??\Z:	wermgr.exe
File opened (read-only)	\??\B:	wermgr.exe
File opened (read-only)	\??\G:	wermgr.exe
File opened (read-only)	\??\K:	wermgr.exe
File opened (read-only)	\??\L:	wermgr.exe
File opened (read-only)	\??\P:	wermgr.exe
File opened (read-only)	\??\S:	wermgr.exe
File opened (read-only)	\??\X:	wermgr.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\A:	wermgr.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
47	discord.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	malecus.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	server.exe
File opened for modification	C:\autorun.inf	server.exe
File created	D:\autorun.inf	server.exe
File created	F:\autorun.inf	server.exe
File opened for modification	F:\autorun.inf	server.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winview.ocx	938b92958ded4d50a357d22eddf141ad.exe
File opened for modification	C:\Windows\SysWOW64\wmmini.swp	wowmgr.exe
File created	C:\Windows\SysWOW64\Ska.exe	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\Ska.exe	Happy18.exe
File created	C:\Windows\SysWOW64\wsock32.ska	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\wsock32.dll	Happy18.exe
File created	C:\Windows\SysWOW64\Ska.dll	Happy18.exe
File created	C:\Windows\SysWOW64\winview.ocx	938b92958ded4d50a357d22eddf141ad.exe
File created	C:\Windows\SysWOW64\wowmgr.exe	BTZ.exe
File opened for modification	C:\Windows\SysWOW64\winview.ocx	BTZ.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp"	wermgr.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 952 set thread context of 3304	952	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe	156
PID 2508 set thread context of 3960	2508	cbgsujmwws.exe	187
PID 1552 set thread context of 2768	1552	see7.exe	217
PID 2768 set thread context of 1232	2768	see7.exe	21
PID 3448 set thread context of 1232	3448	help.exe	21

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTS.ICO	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\msoeres.dll.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-3.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\icon.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\JNGLE_01.MID	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\highDpiImageSwap.js	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387604.JPG	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanResume.Dotx	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMSL.ICO	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOCS.ICO	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\localizedStrings.js	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_on.gif	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\settings.css	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_rainy.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\slideShow.css	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\YOUR_FILES_ARE_DEAD.HTA	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Common Files\Services\verisign.bmp	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Logs\b75386f1303e64	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Windows\1.txt	938b92958ded4d50a357d22eddf141ad.exe
File created	C:\Windows\DigitalLocker\ja-JP\OSPPSVC.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\DigitalLocker\ja-JP\1610b97d3ab4a7	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\schemas\TSWorkSpace\Client.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Windows\Logs\taskhost.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Windows\xdwd.dll	Client.exe
File created	C:\Windows\Microsoft.NET\assembly\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\Microsoft.NET\assembly\9ef3f90eddfd29	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\Fonts\WMIADAP.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\1.txt	BTZ.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\Setup\State\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\Setup\State\9ef3f90eddfd29	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\Fonts\75a57c1bdf437c	73c1c41b9e71c48e752a5cd19fe808b6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3232	Powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	see7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wowmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	help.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1630df6b57af024a3b561bdadc208f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Darkest Dungeon setub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	938b92958ded4d50a357d22eddf141ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virus.jk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dicsord.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbgsujmwws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	クラック.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gandcrab5.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mountvol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
3160	timeout.exe

Kills process with taskkill 1 IoCs

pid	Process
3208	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\CLSID	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\test = "0"	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\Http = "1"	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\1	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\2	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\3	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\L = "500"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\PRM = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\MIGRATE = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\PRC = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\PRS = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\2\bin = 17133a445b065703512f5944120d0b114d16186b060a065028523d5f5a731e5b1f512708195e4a175655497d194743	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\prot_test = "1"	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\1\bin = 17143f56060656185e21461a071807120c1342271e08521b60116c5f537a5800421379	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\JobObjLimitInfoProv.JobObjLimitInfoProv.1\3\bin = 17173843051a461e0333590106440d0d0e5143625743521269067e565365	938b92958ded4d50a357d22eddf141ad.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3556	schtasks.exe
1508	schtasks.exe
2288	schtasks.exe
1864	schtasks.exe
1992	schtasks.exe
536	schtasks.exe
3976	schtasks.exe
3564	schtasks.exe
856	schtasks.exe
3372	schtasks.exe
3256	schtasks.exe
3716	schtasks.exe
4036	schtasks.exe
3840	schtasks.exe
580	schtasks.exe
2148	schtasks.exe
2120	schtasks.exe
3380	schtasks.exe
3396	schtasks.exe
3936	schtasks.exe
2372	schtasks.exe
2600	schtasks.exe
3760	schtasks.exe
3852	schtasks.exe
3596	schtasks.exe
4068	schtasks.exe
3212	schtasks.exe
2872	schtasks.exe
2484	schtasks.exe
3084	schtasks.exe
1744	schtasks.exe
3668	schtasks.exe
892	schtasks.exe
3944	schtasks.exe
3312	schtasks.exe
3260	schtasks.exe
4020	schtasks.exe
1556	schtasks.exe
3092	schtasks.exe
4052	schtasks.exe
3260	schtasks.exe
1184	schtasks.exe
3164	schtasks.exe
1748	schtasks.exe
2972	schtasks.exe
3360	schtasks.exe
3500	schtasks.exe
3168	schtasks.exe
3972	schtasks.exe
3104	schtasks.exe
3696	schtasks.exe
2840	schtasks.exe
956	schtasks.exe
3620	schtasks.exe
3744	schtasks.exe
3872	schtasks.exe
2204	schtasks.exe
2764	schtasks.exe
2872	schtasks.exe
2708	schtasks.exe
3108	schtasks.exe
3264	schtasks.exe
3724	schtasks.exe
3520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1956	73c1c41b9e71c48e752a5cd19fe808b6.exe
1964	5e710462c65fe899466e4fb7c1e33c9a.exe
2276	TEST.exe
2276	TEST.exe
2276	TEST.exe
2960	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2960	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2960	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2960	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
1068	wermgr.exe
1068	wermgr.exe
1068	wermgr.exe
1068	wermgr.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe
2596	57ccb6f0bd910fed428761828ae93553.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2768	see7.exe
2768	see7.exe
2768	see7.exe
3448	help.exe
3448	help.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	Client.exe
Token: SeDebugPrivilege	2596	57ccb6f0bd910fed428761828ae93553.exe
Token: SeDebugPrivilege	2960	a6a1abaf12a28ea8f6553356c3bdcf57.exe
Token: SeDebugPrivilege	2068	7f1630df6b57af024a3b561bdadc208f.exe
Token: SeDebugPrivilege	1956	73c1c41b9e71c48e752a5cd19fe808b6.exe
Token: SeDebugPrivilege	1964	5e710462c65fe899466e4fb7c1e33c9a.exe
Token: SeDebugPrivilege	2276	TEST.exe
Token: SeDebugPrivilege	1552	see7.exe
Token: SeDebugPrivilege	952	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Token: SeDebugPrivilege	4024	7f1630df6b57af024a3b561bdadc208f.exe
Token: SeDebugPrivilege	580	HelpPane.exe
Token: SeDebugPrivilege	3960	cbgsujmwws.exe
Token: SeDebugPrivilege	1748	svhost.exe
Token: SeDebugPrivilege	1532	server.exe
Token: SeDebugPrivilege	1900	Microsoft To Do.exe
Token: SeIncreaseQuotaPrivilege	2936	wmic.exe
Token: SeSecurityPrivilege	2936	wmic.exe
Token: SeTakeOwnershipPrivilege	2936	wmic.exe
Token: SeLoadDriverPrivilege	2936	wmic.exe
Token: SeSystemProfilePrivilege	2936	wmic.exe
Token: SeSystemtimePrivilege	2936	wmic.exe
Token: SeProfSingleProcessPrivilege	2936	wmic.exe
Token: SeIncBasePriorityPrivilege	2936	wmic.exe
Token: SeCreatePagefilePrivilege	2936	wmic.exe
Token: SeBackupPrivilege	2936	wmic.exe
Token: SeRestorePrivilege	2936	wmic.exe
Token: SeShutdownPrivilege	2936	wmic.exe
Token: SeDebugPrivilege	2936	wmic.exe
Token: SeSystemEnvironmentPrivilege	2936	wmic.exe
Token: SeRemoteShutdownPrivilege	2936	wmic.exe
Token: SeUndockPrivilege	2936	wmic.exe
Token: SeManageVolumePrivilege	2936	wmic.exe
Token: 33	2936	wmic.exe
Token: 34	2936	wmic.exe
Token: 35	2936	wmic.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: 33	1532	server.exe
Token: SeIncBasePriorityPrivilege	1532	server.exe
Token: 33	1532	server.exe
Token: SeIncBasePriorityPrivilege	1532	server.exe
Token: 33	1748	svhost.exe
Token: SeIncBasePriorityPrivilege	1748	svhost.exe
Token: SeIncreaseQuotaPrivilege	2936	wmic.exe
Token: SeSecurityPrivilege	2936	wmic.exe
Token: SeTakeOwnershipPrivilege	2936	wmic.exe
Token: SeLoadDriverPrivilege	2936	wmic.exe
Token: SeSystemProfilePrivilege	2936	wmic.exe
Token: SeSystemtimePrivilege	2936	wmic.exe
Token: SeProfSingleProcessPrivilege	2936	wmic.exe
Token: SeIncBasePriorityPrivilege	2936	wmic.exe
Token: SeCreatePagefilePrivilege	2936	wmic.exe
Token: SeBackupPrivilege	2936	wmic.exe
Token: SeRestorePrivilege	2936	wmic.exe
Token: SeShutdownPrivilege	2936	wmic.exe
Token: SeDebugPrivilege	2936	wmic.exe
Token: SeSystemEnvironmentPrivilege	2936	wmic.exe
Token: SeRemoteShutdownPrivilege	2936	wmic.exe
Token: SeUndockPrivilege	2936	wmic.exe
Token: SeManageVolumePrivilege	2936	wmic.exe
Token: 33	2936	wmic.exe
Token: 34	2936	wmic.exe
Token: 35	2936	wmic.exe
Token: SeBackupPrivilege	3492	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1952	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
1952	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
2464	virus.jk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1952	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	30
PID 2196 wrote to memory of 1952	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	30
PID 2196 wrote to memory of 1952	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	30
PID 2196 wrote to memory of 1952	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	30
PID 2196 wrote to memory of 1484	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	31
PID 2196 wrote to memory of 1484	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	31
PID 2196 wrote to memory of 1484	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	31
PID 2196 wrote to memory of 1484	2196	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	31
PID 1484 wrote to memory of 2680	1484	クラック.exe	32
PID 1484 wrote to memory of 2680	1484	クラック.exe	32
PID 1484 wrote to memory of 2680	1484	クラック.exe	32
PID 1484 wrote to memory of 2680	1484	クラック.exe	32
PID 1484 wrote to memory of 1964	1484	クラック.exe	33
PID 1484 wrote to memory of 1964	1484	クラック.exe	33
PID 1484 wrote to memory of 1964	1484	クラック.exe	33
PID 1484 wrote to memory of 1964	1484	クラック.exe	33
PID 1484 wrote to memory of 2068	1484	クラック.exe	34
PID 1484 wrote to memory of 2068	1484	クラック.exe	34
PID 1484 wrote to memory of 2068	1484	クラック.exe	34
PID 1484 wrote to memory of 2068	1484	クラック.exe	34
PID 1484 wrote to memory of 1152	1484	クラック.exe	35
PID 1484 wrote to memory of 1152	1484	クラック.exe	35
PID 1484 wrote to memory of 1152	1484	クラック.exe	35
PID 1484 wrote to memory of 1152	1484	クラック.exe	35
PID 1484 wrote to memory of 1916	1484	クラック.exe	36
PID 1484 wrote to memory of 1916	1484	クラック.exe	36
PID 1484 wrote to memory of 1916	1484	クラック.exe	36
PID 1484 wrote to memory of 1916	1484	クラック.exe	36
PID 1484 wrote to memory of 2596	1484	クラック.exe	37
PID 1484 wrote to memory of 2596	1484	クラック.exe	37
PID 1484 wrote to memory of 2596	1484	クラック.exe	37
PID 1484 wrote to memory of 2596	1484	クラック.exe	37
PID 1484 wrote to memory of 1300	1484	クラック.exe	38
PID 1484 wrote to memory of 1300	1484	クラック.exe	38
PID 1484 wrote to memory of 1300	1484	クラック.exe	38
PID 1484 wrote to memory of 1300	1484	クラック.exe	38
PID 1484 wrote to memory of 1956	1484	クラック.exe	39
PID 1484 wrote to memory of 1956	1484	クラック.exe	39
PID 1484 wrote to memory of 1956	1484	クラック.exe	39
PID 1484 wrote to memory of 1956	1484	クラック.exe	39
PID 1484 wrote to memory of 276	1484	クラック.exe	40
PID 1484 wrote to memory of 276	1484	クラック.exe	40
PID 1484 wrote to memory of 276	1484	クラック.exe	40
PID 1484 wrote to memory of 276	1484	クラック.exe	40
PID 1484 wrote to memory of 952	1484	クラック.exe	41
PID 1484 wrote to memory of 952	1484	クラック.exe	41
PID 1484 wrote to memory of 952	1484	クラック.exe	41
PID 1484 wrote to memory of 952	1484	クラック.exe	41
PID 1484 wrote to memory of 1904	1484	クラック.exe	42
PID 1484 wrote to memory of 1904	1484	クラック.exe	42
PID 1484 wrote to memory of 1904	1484	クラック.exe	42
PID 1484 wrote to memory of 1904	1484	クラック.exe	42
PID 1484 wrote to memory of 308	1484	クラック.exe	43
PID 1484 wrote to memory of 308	1484	クラック.exe	43
PID 1484 wrote to memory of 308	1484	クラック.exe	43
PID 1484 wrote to memory of 308	1484	クラック.exe	43
PID 1484 wrote to memory of 2960	1484	クラック.exe	44
PID 1484 wrote to memory of 2960	1484	クラック.exe	44
PID 1484 wrote to memory of 2960	1484	クラック.exe	44
PID 1484 wrote to memory of 2960	1484	クラック.exe	44
PID 1904 wrote to memory of 2712	1904	938b92958ded4d50a357d22eddf141ad.exe	45
PID 1904 wrote to memory of 2712	1904	938b92958ded4d50a357d22eddf141ad.exe	45
PID 1904 wrote to memory of 2712	1904	938b92958ded4d50a357d22eddf141ad.exe	45
PID 1904 wrote to memory of 2712	1904	938b92958ded4d50a357d22eddf141ad.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cbgsujmwws.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cbgsujmwws.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:280

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
PID:1232
- C:\Users\Admin\AppData\Local\Temp\ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe
  "C:\Users\Admin\AppData\Local\Temp\ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe"
  2⤵
  - DcRat
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\クラック.exe
    "C:\Users\Admin\AppData\Local\Temp\クラック.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
      "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2680
  - - C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
      "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1964
    - - C:\Program Files\Windows Portable Devices\HelpPane.exe
        
        "C:\Program Files\Windows Portable Devices\HelpPane.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
  - - C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
      "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2068
  - - C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
      "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3528
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Exsample.exe
        6⤵
        Kills process with taskkill
        
        PID:3208
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 436
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
  - - C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
      "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:1916
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:3620
  - - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
      "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2596
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mampjonb\mampjonb.cmdline"
        5⤵
        
        PID:1556
  - - C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
      "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3232
  - - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
      "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1956
    - - C:\MSOCache\All Users\7f1630df6b57af024a3b561bdadc208f.exe
        
        "C:\MSOCache\All Users\7f1630df6b57af024a3b561bdadc208f.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
  - - C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
      "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:276
  - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
      "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:952
    - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
        
        "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:3304
  - - C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
      "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\fwclt.exe
        
        C:\Users\Admin\AppData\Local\Temp\fwclt.exe C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
        5⤵
        Executes dropped EXE
        
        PID:3248
  - - C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
      "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:308
  - - C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
      "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2960
  - - C:\Program Files (x86)\BTZ.exe
      "C:\Program Files (x86)\BTZ.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Impair Defenses: Safe Mode Boot
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2912
  - - C:\Program Files (x86)\Cat.exe
      "C:\Program Files (x86)\Cat.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2736
  - - C:\Program Files (x86)\Client.exe
      "C:\Program Files (x86)\Client.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:2420
    - - C:\Windows\system32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
        5⤵
        
        PID:3016
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3092
    - - C:\Windows\system32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
        5⤵
        
        PID:3920
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        6⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:3260
    - - C:\Windows\system32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
        5⤵
        
        PID:1964
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        6⤵
        
        PID:3492
    - - C:\Windows\system32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
        5⤵
        
        PID:3636
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3668
    - - C:\Windows\system32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
        5⤵
        
        PID:3356
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        6⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:1184
  - - C:\Program Files (x86)\Darkest Dungeon setub.exe
      "C:\Program Files (x86)\Darkest Dungeon setub.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:3316
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 844
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
  - - C:\Program Files (x86)\evil.exe
      "C:\Program Files (x86)\evil.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\evil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\evil.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2952
  - - C:\Program Files (x86)\fwclt.exe
      "C:\Program Files (x86)\fwclt.exe"
      4⤵
      Executes dropped EXE
      PID:1988
  - - C:\Program Files (x86)\Gandcrab5.0.3.exe
      "C:\Program Files (x86)\Gandcrab5.0.3.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2448
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\System32\wermgr.exe"
        5⤵
        Drops startup file
        Enumerates connected drives
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1068
      - C:\Windows\SysWOW64\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
  - - C:\Program Files (x86)\Happy18.exe
      "C:\Program Files (x86)\Happy18.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1764
  - - C:\Program Files (x86)\kosomk.exe
      "C:\Program Files (x86)\kosomk.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1936
    - - C:\Users\Admin\AppData\Roaming\dicsord.exe
        
        "C:\Users\Admin\AppData\Roaming\dicsord.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:616
  - - C:\Program Files (x86)\LightNeuronX0.exe
      "C:\Program Files (x86)\LightNeuronX0.exe"
      4⤵
      Executes dropped EXE
      PID:2096
  - - C:\Program Files (x86)\malecus.exe
      "C:\Program Files (x86)\malecus.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      PID:2496
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1552
    - - C:\Program Files (x86)\see7.exe
        
        "C:\Program Files (x86)\see7.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2768
  - - C:\Program Files (x86)\TEST.exe
      "C:\Program Files (x86)\TEST.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2276
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2A99.tmp.bat""
        5⤵
        Loads dropped DLL
        
        PID:3996
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:3160
      - C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe
        
        "C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\touhou virus.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\Windows\SysWOW64\net.exe
        
        net user Shanghai /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3564
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Shanghai /add
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
    - - C:\Windows\SysWOW64\net.exe
        
        net user Bad Apple /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Bad Apple /add
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
    - - C:\Windows\SysWOW64\net.exe
        
        net user Marisa
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Marisa
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
    - - C:\Windows\SysWOW64\net.exe
        
        net user Reimu /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:264
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Reimu /add
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:880
    - - C:\Windows\SysWOW64\mountvol.exe
        
        mountvol X:\ /d
        5⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:3580
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=PTt19B5_V3I
        5⤵
        
        PID:4028
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=tpedaZ0_yyQ
        5⤵
        
        PID:1200
    - - C:\Windows\SysWOW64\diskpart.exe
        
        diskpart
        5⤵
        
        PID:3600
  - - C:\Program Files (x86)\vbc.exe
      "C:\Program Files (x86)\vbc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:3960
  - - C:\Program Files (x86)\virus.jk.exe
      "C:\Program Files (x86)\virus.jk.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2464
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:3448

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:2344

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2500
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 13 /tr "'C:\Windows\Microsoft.NET\assembly\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:380
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "see7s" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\see7.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2428
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1748
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "see7" /sc ONLOGON /tr "'C:\Users\Default User\see7.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2772
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\assembly\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:580
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "see7s" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\see7.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2840
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 7 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1864
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Documents\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2288
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2872
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Users\All Users\Documents\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2148
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 10 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1992
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2972
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\audiodg.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:892
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\lsass.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2708
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\audiodg.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2600
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2936
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\audiodg.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1292
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2120
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa7" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1812
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\lsm.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2828
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2484
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\lsm.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:956
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa7" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:536
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\7f1630df6b57af024a3b561bdadc208f.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3372
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\lsm.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3380
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f" /sc ONLOGON /tr "'C:\MSOCache\All Users\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3620
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\HelpPane.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3632
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "HelpPane" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\HelpPane.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3736
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3744
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\HelpPane.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3760
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Templates\WMIADAP.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3852
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3872
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Default\Templates\WMIADAP.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3976
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3992
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Templates\WMIADAP.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:4044
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:4052
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Services\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3084
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 6 /tr "'C:\Windows\Setup\State\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3108
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3256
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Windows\Setup\State\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3260
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3360
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 14 /tr "'C:\Windows\Setup\State\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3396
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "LightNeuronX0L" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\LightNeuronX0.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:2204
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
  2⤵
  - Process spawned unexpected child process
  PID:3216
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "LightNeuronX0" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\LightNeuronX0.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3452
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3472
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "LightNeuronX0L" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\LightNeuronX0.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3492
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3564
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\WMIADAP.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3944
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\dllhost.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3428
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\Fonts\WMIADAP.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:3484
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\dllhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3556
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Windows\Fonts\WMIADAP.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1744
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\dllhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3500
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3936
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Idle.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:4020
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:1124
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  PID:2792
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:4036
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3168
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 7 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\5e710462c65fe899466e4fb7c1e33c9a.exe'" /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3312
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wermgrw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\wermgr.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:1508
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3840
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wermgr" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\wermgr.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Process spawned unexpected child process
  - Scheduled Task/Job: Scheduled Task
  PID:3104
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 6 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3596
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wermgrw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\wermgr.exe'" /rl HIGHEST /f
  2⤵
  PID:3604
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\es-ES\csrss.exe'" /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3696
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\es-ES\csrss.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  PID:3728
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\es-ES\csrss.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3716
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\Logs\taskhost.exe'" /f
  2⤵
  - DcRat
  PID:4008
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Logs\taskhost.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3972
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Windows\Logs\taskhost.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4068
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\More Games\de-DE\Happy18.exe'" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3164
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Happy18" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\More Games\de-DE\Happy18.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3212
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Games\More Games\de-DE\Happy18.exe'" /rl HIGHEST /f
  2⤵
  PID:3316
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\Client.exe'" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3264
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "Client" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\Client.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3724
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\Client.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:2764
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /f
  2⤵
  - DcRat
  PID:2128
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:1556
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:3520
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2872
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /rl HIGHEST /f
  2⤵
  - DcRat
  - Scheduled Task/Job: Scheduled Task
  PID:2372
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\SysWOW64\wowmgr.exe
C:\Windows\SysWOW64\wowmgr.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Scripting

T1064

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry