xred | 0d9cad0c0e4b58ef3cf1537b5888071e4e7a90091da2848745559605fcbcefc2

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ddLCicslsuisueKHitygAsoUxg\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\ddLCicslsuisueKHitygAsoUxg"	mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoDFbfyfoZRovSccOWL\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\DoDFbfyfoZRovSccOWL"	mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fWPPagQAYkjWoelOQ\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\fWPPagQAYkjWoelOQ"	mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\OoiBPqZDAOItURqbEICELIFRTMsG\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\OoiBPqZDAOItURqbEICELIFRTMsG"	mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RCCHIIJIVIhoRXa\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\RCCHIIJIVIhoRXa"	mapper.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	Plasma Temp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	._cache_Plasma Temp.exe

Executes dropped EXE 8 IoCs

pid	Process
1108	Plasma Temp.exe
64	._cache_Plasma Temp.exe
2236	Synaptics.exe
3676	mapper.exe
4676	mapper.exe
3832	mapper.exe
2708	mapper.exe
3120	mapper.exe

Loads dropped DLL 6 IoCs

pid	Process
2236	Synaptics.exe
2236	Synaptics.exe
64	._cache_Plasma Temp.exe
64	._cache_Plasma Temp.exe
64	._cache_Plasma Temp.exe
64	._cache_Plasma Temp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Plasma Temp.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Snippingtool\symbols\46bd5bd5b4ac076025e641070546ecc0.pdb	mapper.exe
File created	C:\Program Files\Snippingtool\plasmasetup.bat	._cache_Plasma Temp.exe
File created	C:\Program Files\Snippingtool\mapper.exe	._cache_Plasma Temp.exe
File created	C:\Program Files\Snippingtool\spoof.sys	._cache_Plasma Temp.exe
File created	C:\Program Files\Snippingtool\symbols\46bd5bd5b4ac076025e641070546ecc0.pdb	mapper.exe
File opened for modification	C:\Program Files\Snippingtool\symbols\46bd5bd5b4ac076025e641070546ecc0.pdb	mapper.exe
File created	C:\Program Files\Snippingtool\symbols\46bd5bd5b4ac076025e641070546ecc0.pdb.md5	mapper.exe
File opened for modification	C:\Program Files\Snippingtool\symbols\46bd5bd5b4ac076025e641070546ecc0.pdb	mapper.exe
File opened for modification	C:\Program Files\Snippingtool\symbols\46bd5bd5b4ac076025e641070546ecc0.pdb	mapper.exe
File opened for modification	C:\Program Files\Snippingtool\symbols\46bd5bd5b4ac076025e641070546ecc0.pdb	mapper.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\erigu.7z.tmp	7zG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Plasma Temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plasma Temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2472	cmd.exe
3392	cmd.exe
4868	cmd.exe
4592	cmd.exe
3340	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Plasma Temp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Plasma Temp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Plasma Temp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Plasma Temp.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3392	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2732	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3676	mapper.exe
3676	mapper.exe
4676	mapper.exe
4676	mapper.exe
3832	mapper.exe
3832	mapper.exe
2708	mapper.exe
2708	mapper.exe
3120	mapper.exe
3120	mapper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4216	7zFM.exe
4652	7zFM.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
3676	mapper.exe
4676	mapper.exe
3832	mapper.exe
2708	mapper.exe
3120	mapper.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4216	7zFM.exe
Token: 35	4216	7zFM.exe
Token: SeSecurityPrivilege	4216	7zFM.exe
Token: SeDebugPrivilege	64	._cache_Plasma Temp.exe
Token: SeLoadDriverPrivilege	3676	mapper.exe
Token: SeLoadDriverPrivilege	4676	mapper.exe
Token: SeAssignPrimaryTokenPrivilege	3848	svchost.exe
Token: SeIncreaseQuotaPrivilege	3848	svchost.exe
Token: SeSecurityPrivilege	3848	svchost.exe
Token: SeTakeOwnershipPrivilege	3848	svchost.exe
Token: SeLoadDriverPrivilege	3848	svchost.exe
Token: SeSystemtimePrivilege	3848	svchost.exe
Token: SeBackupPrivilege	3848	svchost.exe
Token: SeRestorePrivilege	3848	svchost.exe
Token: SeShutdownPrivilege	3848	svchost.exe
Token: SeSystemEnvironmentPrivilege	3848	svchost.exe
Token: SeUndockPrivilege	3848	svchost.exe
Token: SeManageVolumePrivilege	3848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3848	svchost.exe
Token: SeIncreaseQuotaPrivilege	3848	svchost.exe
Token: SeSecurityPrivilege	3848	svchost.exe
Token: SeTakeOwnershipPrivilege	3848	svchost.exe
Token: SeLoadDriverPrivilege	3848	svchost.exe
Token: SeSystemtimePrivilege	3848	svchost.exe
Token: SeBackupPrivilege	3848	svchost.exe
Token: SeRestorePrivilege	3848	svchost.exe
Token: SeShutdownPrivilege	3848	svchost.exe
Token: SeSystemEnvironmentPrivilege	3848	svchost.exe
Token: SeUndockPrivilege	3848	svchost.exe
Token: SeManageVolumePrivilege	3848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3848	svchost.exe
Token: SeIncreaseQuotaPrivilege	3848	svchost.exe
Token: SeSecurityPrivilege	3848	svchost.exe
Token: SeTakeOwnershipPrivilege	3848	svchost.exe
Token: SeLoadDriverPrivilege	3848	svchost.exe
Token: SeSystemtimePrivilege	3848	svchost.exe
Token: SeBackupPrivilege	3848	svchost.exe
Token: SeRestorePrivilege	3848	svchost.exe
Token: SeShutdownPrivilege	3848	svchost.exe
Token: SeSystemEnvironmentPrivilege	3848	svchost.exe
Token: SeUndockPrivilege	3848	svchost.exe
Token: SeManageVolumePrivilege	3848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3848	svchost.exe
Token: SeIncreaseQuotaPrivilege	3848	svchost.exe
Token: SeSecurityPrivilege	3848	svchost.exe
Token: SeTakeOwnershipPrivilege	3848	svchost.exe
Token: SeLoadDriverPrivilege	3848	svchost.exe
Token: SeSystemtimePrivilege	3848	svchost.exe
Token: SeBackupPrivilege	3848	svchost.exe
Token: SeRestorePrivilege	3848	svchost.exe
Token: SeShutdownPrivilege	3848	svchost.exe
Token: SeSystemEnvironmentPrivilege	3848	svchost.exe
Token: SeUndockPrivilege	3848	svchost.exe
Token: SeManageVolumePrivilege	3848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3848	svchost.exe
Token: SeIncreaseQuotaPrivilege	3848	svchost.exe
Token: SeSecurityPrivilege	3848	svchost.exe
Token: SeTakeOwnershipPrivilege	3848	svchost.exe
Token: SeLoadDriverPrivilege	3848	svchost.exe
Token: SeSystemtimePrivilege	3848	svchost.exe
Token: SeBackupPrivilege	3848	svchost.exe
Token: SeRestorePrivilege	3848	svchost.exe
Token: SeShutdownPrivilege	3848	svchost.exe
Token: SeSystemEnvironmentPrivilege	3848	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4216	7zFM.exe
4216	7zFM.exe
1836	7zG.exe
4652	7zFM.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2688	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 64	1108	Plasma Temp.exe	96
PID 1108 wrote to memory of 64	1108	Plasma Temp.exe	96
PID 1108 wrote to memory of 64	1108	Plasma Temp.exe	96
PID 1108 wrote to memory of 2236	1108	Plasma Temp.exe	97
PID 1108 wrote to memory of 2236	1108	Plasma Temp.exe	97
PID 1108 wrote to memory of 2236	1108	Plasma Temp.exe	97
PID 64 wrote to memory of 3268	64	._cache_Plasma Temp.exe	104
PID 64 wrote to memory of 3268	64	._cache_Plasma Temp.exe	104
PID 64 wrote to memory of 3268	64	._cache_Plasma Temp.exe	104
PID 64 wrote to memory of 2472	64	._cache_Plasma Temp.exe	107
PID 64 wrote to memory of 2472	64	._cache_Plasma Temp.exe	107
PID 64 wrote to memory of 2472	64	._cache_Plasma Temp.exe	107
PID 2472 wrote to memory of 3528	2472	cmd.exe	110
PID 2472 wrote to memory of 3528	2472	cmd.exe	110
PID 2472 wrote to memory of 3528	2472	cmd.exe	110
PID 3528 wrote to memory of 3576	3528	net.exe	112
PID 3528 wrote to memory of 3576	3528	net.exe	112
PID 3528 wrote to memory of 3576	3528	net.exe	112
PID 2472 wrote to memory of 3676	2472	cmd.exe	113
PID 2472 wrote to memory of 3676	2472	cmd.exe	113
PID 64 wrote to memory of 3392	64	._cache_Plasma Temp.exe	116
PID 64 wrote to memory of 3392	64	._cache_Plasma Temp.exe	116
PID 64 wrote to memory of 3392	64	._cache_Plasma Temp.exe	116
PID 3392 wrote to memory of 716	3392	cmd.exe	118
PID 3392 wrote to memory of 716	3392	cmd.exe	118
PID 3392 wrote to memory of 716	3392	cmd.exe	118
PID 716 wrote to memory of 3296	716	net.exe	119
PID 716 wrote to memory of 3296	716	net.exe	119
PID 716 wrote to memory of 3296	716	net.exe	119
PID 3392 wrote to memory of 4676	3392	cmd.exe	120
PID 3392 wrote to memory of 4676	3392	cmd.exe	120
PID 64 wrote to memory of 3828	64	._cache_Plasma Temp.exe	123
PID 64 wrote to memory of 3828	64	._cache_Plasma Temp.exe	123
PID 64 wrote to memory of 3828	64	._cache_Plasma Temp.exe	123
PID 64 wrote to memory of 4868	64	._cache_Plasma Temp.exe	126
PID 64 wrote to memory of 4868	64	._cache_Plasma Temp.exe	126
PID 64 wrote to memory of 4868	64	._cache_Plasma Temp.exe	126
PID 4868 wrote to memory of 444	4868	cmd.exe	128
PID 4868 wrote to memory of 444	4868	cmd.exe	128
PID 4868 wrote to memory of 444	4868	cmd.exe	128
PID 444 wrote to memory of 2524	444	net.exe	129
PID 444 wrote to memory of 2524	444	net.exe	129
PID 444 wrote to memory of 2524	444	net.exe	129
PID 4868 wrote to memory of 3832	4868	cmd.exe	130
PID 4868 wrote to memory of 3832	4868	cmd.exe	130
PID 64 wrote to memory of 1140	64	._cache_Plasma Temp.exe	133
PID 64 wrote to memory of 1140	64	._cache_Plasma Temp.exe	133
PID 64 wrote to memory of 1140	64	._cache_Plasma Temp.exe	133
PID 64 wrote to memory of 4592	64	._cache_Plasma Temp.exe	137
PID 64 wrote to memory of 4592	64	._cache_Plasma Temp.exe	137
PID 64 wrote to memory of 4592	64	._cache_Plasma Temp.exe	137
PID 4592 wrote to memory of 2844	4592	cmd.exe	139
PID 4592 wrote to memory of 2844	4592	cmd.exe	139
PID 4592 wrote to memory of 2844	4592	cmd.exe	139
PID 2844 wrote to memory of 416	2844	net.exe	140
PID 2844 wrote to memory of 416	2844	net.exe	140
PID 2844 wrote to memory of 416	2844	net.exe	140
PID 4592 wrote to memory of 2708	4592	cmd.exe	141
PID 4592 wrote to memory of 2708	4592	cmd.exe	141
PID 64 wrote to memory of 3340	64	._cache_Plasma Temp.exe	142
PID 64 wrote to memory of 3340	64	._cache_Plasma Temp.exe	142
PID 64 wrote to memory of 3340	64	._cache_Plasma Temp.exe	142
PID 3340 wrote to memory of 3808	3340	cmd.exe	144
PID 3340 wrote to memory of 3808	3340	cmd.exe	144

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\temp.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2940

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\temp\X0f4dXjaxXHoWyCqkmhXv.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3392

C:\Users\Admin\Desktop\temp\Plasma Temp.exe
"C:\Users\Admin\Desktop\temp\Plasma Temp.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\Desktop\temp\._cache_Plasma Temp.exe
  "C:\Users\Admin\Desktop\temp\._cache_Plasma Temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\SysWOW64\getmac.exe
    "getmac"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Snippingtool\plasmasetup.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
  - - C:\Program Files\Snippingtool\mapper.exe
      "C:\Program Files\Snippingtool\mapper.exe" spoof.sys .data
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      PID:3676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Snippingtool\plasmasetup.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:716
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
  - - C:\Program Files\Snippingtool\mapper.exe
      "C:\Program Files\Snippingtool\mapper.exe" spoof.sys .data
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      PID:4676
- - C:\Windows\SysWOW64\getmac.exe
    "getmac"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Snippingtool\plasmasetup.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:444
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
  - - C:\Program Files\Snippingtool\mapper.exe
      "C:\Program Files\Snippingtool\mapper.exe" spoof.sys .data
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: LoadsDriver
      PID:3832
- - C:\Windows\SysWOW64\getmac.exe
    "getmac"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Snippingtool\plasmasetup.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:416
  - - C:\Program Files\Snippingtool\mapper.exe
      "C:\Program Files\Snippingtool\mapper.exe" spoof.sys .data
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: LoadsDriver
      PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Snippingtool\plasmasetup.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
  - - C:\Program Files\Snippingtool\mapper.exe
      "C:\Program Files\Snippingtool\mapper.exe" spoof.sys .data
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: LoadsDriver
      PID:3120
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2236

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:4620

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap11135:36:7zEvent27309 -ad -saa -- "C:\Windows\Fonts"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:1836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2688

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\erigu.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery