lumma | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Processes:

sysarddrvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2148 powershell.exe
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
2148	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

sysarddrvs.exeSvchost.exeSvchost.exe4363463463464363463463463.exe(1).exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sysarddrvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe(1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Svchost.exe

Executes dropped EXE 20 IoCs

Processes:

bybit.exeidrB5Event.exeClient-built.exeloader_5879465914.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exe11.exesysarddrvs.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exediscord.exemain-pc.exeXClient.exe

pid	process
1484	bybit.exe
4728	idrB5Event.exe
1664	Client-built.exe
2412	loader_5879465914.exe
100	Svchost.exe
2804	Svchost.exe
4520	Svchost.exe
5008	Svchost.exe
2436	Svchost.exe
1688	Svchost.exe
2004	Svchost.exe
1616	11.exe
3980	sysarddrvs.exe
1596	Svchost.exe
968	Svchost.exe
4060	Svchost.exe
3328	Svchost.exe
2660	discord.exe
1784	main-pc.exe
4728	XClient.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysarddrvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

11.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	11.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

122 raw.githubusercontent.com
10 bitbucket.org
14 bitbucket.org
56 raw.githubusercontent.com
57 raw.githubusercontent.com

flow	ioc
122	raw.githubusercontent.com
10	bitbucket.org
14	bitbucket.org
56	raw.githubusercontent.com
57	raw.githubusercontent.com

Drops file in System32 directory 5 IoCs

Processes:

discord.exemain-pc.exe

description	ioc	process
File created	C:\Windows\system32\SubDir\main-pc.exe	discord.exe
File opened for modification	C:\Windows\system32\SubDir\main-pc.exe	discord.exe
File opened for modification	C:\Windows\system32\SubDir	discord.exe
File opened for modification	C:\Windows\system32\SubDir\main-pc.exe	main-pc.exe
File opened for modification	C:\Windows\system32\SubDir	main-pc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bybit.exe

description pid process target process

PID 1484 set thread context of 4896 1484 bybit.exe BitLockerToGo.exe
Drops file in Windows directory 2 IoCs

Processes:

11.exe

description ioc process

File opened for modification C:\Windows\sysarddrvs.exe 11.exe
File created C:\Windows\sysarddrvs.exe 11.exe
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

4924 sc.exe
4332 sc.exe
2244 sc.exe
3220 sc.exe
4984 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1484 set thread context of 4896	1484	bybit.exe	BitLockerToGo.exe

description	ioc	process
File opened for modification	C:\Windows\sysarddrvs.exe	11.exe
File created	C:\Windows\sysarddrvs.exe	11.exe

pid	process
4924	sc.exe
4332	sc.exe
2244	sc.exe
3220	sc.exe
4984	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

11.exesysarddrvs.exesc.exesc.execmd.exesc.exe4363463463464363463463463.exe(1).exebybit.exeBitLockerToGo.exesc.exepowershell.exesc.exeidrB5Event.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bybit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idrB5Event.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

736 PING.EXE
4248 PING.EXE
1224 PING.EXE
3156 PING.EXE
4332 PING.EXE
1468 PING.EXE
1556 PING.EXE
4564 PING.EXE
2844 PING.EXE
4232 PING.EXE
2648 PING.EXE

pid	process
736	PING.EXE
4248	PING.EXE
1224	PING.EXE
3156	PING.EXE
4332	PING.EXE
1468	PING.EXE
1556	PING.EXE
4564	PING.EXE
2844	PING.EXE
4232	PING.EXE
2648	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

loader_5879465914.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loader_5879465914.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loader_5879465914.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

loader_5879465914.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	loader_5879465914.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	loader_5879465914.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

2844 PING.EXE
1224 PING.EXE
1468 PING.EXE
736 PING.EXE
1556 PING.EXE
2648 PING.EXE
4248 PING.EXE
3156 PING.EXE
4332 PING.EXE
4564 PING.EXE
4232 PING.EXE

pid	process
2844	PING.EXE
1224	PING.EXE
1468	PING.EXE
736	PING.EXE
1556	PING.EXE
2648	PING.EXE
4248	PING.EXE
3156	PING.EXE
4332	PING.EXE
4564	PING.EXE
4232	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1524	schtasks.exe
3160	schtasks.exe
2644	schtasks.exe
4104	schtasks.exe
4780	schtasks.exe
3352	schtasks.exe
4296	schtasks.exe
2708	schtasks.exe
4020	schtasks.exe
2744	schtasks.exe
2408	schtasks.exe
3940	schtasks.exe
4924	schtasks.exe
2920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

loader_5879465914.exepowershell.exe

pid process

2412 loader_5879465914.exe
2412 loader_5879465914.exe
2148 powershell.exe
2148 powershell.exe

pid	process
2412	loader_5879465914.exe
2412	loader_5879465914.exe
2148	powershell.exe
2148	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

4363463463464363463463463.exe(1).exeClient-built.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exepowershell.exeSvchost.exeSvchost.exeSvchost.exeSvchost.exediscord.exeXClient.exemain-pc.exe

description	pid	process
Token: SeDebugPrivilege	4164	4363463463464363463463463.exe(1).exe
Token: SeDebugPrivilege	1664	Client-built.exe
Token: SeDebugPrivilege	100	Svchost.exe
Token: SeDebugPrivilege	2804	Svchost.exe
Token: SeDebugPrivilege	4520	Svchost.exe
Token: SeDebugPrivilege	5008	Svchost.exe
Token: SeDebugPrivilege	2436	Svchost.exe
Token: SeDebugPrivilege	1688	Svchost.exe
Token: SeDebugPrivilege	2004	Svchost.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	1596	Svchost.exe
Token: SeDebugPrivilege	968	Svchost.exe
Token: SeDebugPrivilege	4060	Svchost.exe
Token: SeDebugPrivilege	3328	Svchost.exe
Token: SeDebugPrivilege	2660	discord.exe
Token: SeDebugPrivilege	4728	XClient.exe
Token: SeDebugPrivilege	1784	main-pc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

main-pc.exe

pid process

1784 main-pc.exe

pid	process
1784	main-pc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exe(1).exeClient-built.exeSvchost.execmd.exebybit.exeSvchost.execmd.exeSvchost.execmd.exeSvchost.execmd.exeSvchost.exe

description	pid	process	target process
PID 4164 wrote to memory of 1484	4164	4363463463464363463463463.exe(1).exe	bybit.exe
PID 4164 wrote to memory of 1484	4164	4363463463464363463463463.exe(1).exe	bybit.exe
PID 4164 wrote to memory of 1484	4164	4363463463464363463463463.exe(1).exe	bybit.exe
PID 4164 wrote to memory of 4728	4164	4363463463464363463463463.exe(1).exe	idrB5Event.exe
PID 4164 wrote to memory of 4728	4164	4363463463464363463463463.exe(1).exe	idrB5Event.exe
PID 4164 wrote to memory of 4728	4164	4363463463464363463463463.exe(1).exe	idrB5Event.exe
PID 4164 wrote to memory of 1664	4164	4363463463464363463463463.exe(1).exe	Client-built.exe
PID 4164 wrote to memory of 1664	4164	4363463463464363463463463.exe(1).exe	Client-built.exe
PID 4164 wrote to memory of 2412	4164	4363463463464363463463463.exe(1).exe	loader_5879465914.exe
PID 4164 wrote to memory of 2412	4164	4363463463464363463463463.exe(1).exe	loader_5879465914.exe
PID 1664 wrote to memory of 4780	1664	Client-built.exe	schtasks.exe
PID 1664 wrote to memory of 4780	1664	Client-built.exe	schtasks.exe
PID 1664 wrote to memory of 100	1664	Client-built.exe	Svchost.exe
PID 1664 wrote to memory of 100	1664	Client-built.exe	Svchost.exe
PID 100 wrote to memory of 3940	100	Svchost.exe	schtasks.exe
PID 100 wrote to memory of 3940	100	Svchost.exe	schtasks.exe
PID 100 wrote to memory of 1616	100	Svchost.exe	cmd.exe
PID 100 wrote to memory of 1616	100	Svchost.exe	cmd.exe
PID 1616 wrote to memory of 2152	1616	cmd.exe	chcp.com
PID 1616 wrote to memory of 2152	1616	cmd.exe	chcp.com
PID 1616 wrote to memory of 2844	1616	cmd.exe	PING.EXE
PID 1616 wrote to memory of 2844	1616	cmd.exe	PING.EXE
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 1616 wrote to memory of 2804	1616	cmd.exe	Svchost.exe
PID 1616 wrote to memory of 2804	1616	cmd.exe	Svchost.exe
PID 2804 wrote to memory of 2708	2804	Svchost.exe	schtasks.exe
PID 2804 wrote to memory of 2708	2804	Svchost.exe	schtasks.exe
PID 2804 wrote to memory of 5104	2804	Svchost.exe	cmd.exe
PID 2804 wrote to memory of 5104	2804	Svchost.exe	cmd.exe
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 5104 wrote to memory of 3724	5104	cmd.exe	chcp.com
PID 5104 wrote to memory of 3724	5104	cmd.exe	chcp.com
PID 5104 wrote to memory of 4248	5104	cmd.exe	PING.EXE
PID 5104 wrote to memory of 4248	5104	cmd.exe	PING.EXE
PID 1484 wrote to memory of 4896	1484	bybit.exe	BitLockerToGo.exe
PID 5104 wrote to memory of 4520	5104	cmd.exe	Svchost.exe
PID 5104 wrote to memory of 4520	5104	cmd.exe	Svchost.exe
PID 4520 wrote to memory of 3352	4520	Svchost.exe	schtasks.exe
PID 4520 wrote to memory of 3352	4520	Svchost.exe	schtasks.exe
PID 4520 wrote to memory of 1608	4520	Svchost.exe	cmd.exe
PID 4520 wrote to memory of 1608	4520	Svchost.exe	cmd.exe
PID 1608 wrote to memory of 4356	1608	cmd.exe	chcp.com
PID 1608 wrote to memory of 4356	1608	cmd.exe	chcp.com
PID 1608 wrote to memory of 1224	1608	cmd.exe	PING.EXE
PID 1608 wrote to memory of 1224	1608	cmd.exe	PING.EXE
PID 1608 wrote to memory of 5008	1608	cmd.exe	Svchost.exe
PID 1608 wrote to memory of 5008	1608	cmd.exe	Svchost.exe
PID 5008 wrote to memory of 4296	5008	Svchost.exe	schtasks.exe
PID 5008 wrote to memory of 4296	5008	Svchost.exe	schtasks.exe
PID 5008 wrote to memory of 3100	5008	Svchost.exe	cmd.exe
PID 5008 wrote to memory of 3100	5008	Svchost.exe	cmd.exe
PID 3100 wrote to memory of 4644	3100	cmd.exe	chcp.com
PID 3100 wrote to memory of 4644	3100	cmd.exe	chcp.com
PID 3100 wrote to memory of 3156	3100	cmd.exe	PING.EXE
PID 3100 wrote to memory of 3156	3100	cmd.exe	PING.EXE
PID 3100 wrote to memory of 2436	3100	cmd.exe	Svchost.exe
PID 3100 wrote to memory of 2436	3100	cmd.exe	Svchost.exe
PID 2436 wrote to memory of 1524	2436	Svchost.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(1).exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(1).exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\Files\bybit.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\bybit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4896
- C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4728
- C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
    "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:100
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RLjKg6e7iaah.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2152
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2844
    - - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2708
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7kG3yjRabnj8.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3724
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4248
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wSpT9iXglbhw.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4356
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1224
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jP5o3GnEBXPu.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3156
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GmRRXxHcg2yQ.bat" "
        12⤵
        
        PID:1848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1836
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4332
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qm8ODXwNdMfE.bat" "
        14⤵
        
        PID:2128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3224
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1468
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nnw5T8tfRkKj.bat" "
        16⤵
        
        PID:3596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:736
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zLN1EgQBTodT.bat" "
        18⤵
        
        PID:4092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:3332
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1556
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y5vZ5i1DKCsh.bat" "
        20⤵
        
        PID:2988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:1960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4564
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4060
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q5YVlHvaTpgX.bat" "
        22⤵
        
        PID:824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1408
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2648
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3328
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zTRzHeAC55DW.bat" "
        24⤵
        
        PID:540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:3564
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4232
- C:\Users\Admin\AppData\Local\Temp\Files\loader_5879465914.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\loader_5879465914.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Users\Admin\AppData\Local\Temp\Files\11.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1616
- - C:\Windows\sysarddrvs.exe
    C:\Windows\sysarddrvs.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    PID:3980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      System Location Discovery: System Language Discovery
      PID:644
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4332
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2244
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3220
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4984
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4924
- C:\Users\Admin\AppData\Local\Temp\Files\discord.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\discord.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft Service" /sc ONLOGON /tr "C:\Windows\system32\SubDir\main-pc.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4104
- - C:\Windows\system32\SubDir\main-pc.exe
    "C:\Windows\system32\SubDir\main-pc.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1784
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Microsoft Service" /sc ONLOGON /tr "C:\Windows\system32\SubDir\main-pc.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2644
- C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery