ed9a7ff6e6bc2cc42bd856a288c04b2e353e5f0542f6d6389097afb4fcaca9e6

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	setup.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	spf.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	spf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\ImagePath	spf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	spf.exe

Power Settings 1 TTPs 14 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2432	cmd.exe
3584	powercfg.exe
936	cmd.exe
3736	cmd.exe
3292	cmd.exe
1100	powercfg.exe
3288	powercfg.exe
2548	powercfg.exe
320	cmd.exe
2556	powercfg.exe
4168	cmd.exe
4048	powercfg.exe
2224	powercfg.exe
3560	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4508	sc.exe
1792	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4580	taskkill.exe
1400	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Document Windows\z = 090000000000000000000000017f00003e00000000000000ffffffff0000000000000000	spf.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\Geo\Nation = "68"	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TYPELIB\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\WIN32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INTERFACE\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TYPELIB	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TYPELIB\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\WIN64	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INTERFACE\{C9C2B807-7731-4F34-81B7-44FF7779522B}\PROXYSTUBCLSID32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\SHELL\OPEN\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LOCALSERVER32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\SHELL\OPEN\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CurVer	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4008	spf.exe
4008	spf.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
4008	spf.exe
372	powershell.exe
372	powershell.exe
372	powershell.exe
372	powershell.exe
372	powershell.exe
372	powershell.exe
3156	setup.exe
3156	setup.exe
3156	setup.exe
3156	setup.exe
3156	setup.exe
3156	setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	spf.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeShutdownPrivilege	4048	powercfg.exe
Token: SeCreatePagefilePrivilege	4048	powercfg.exe
Token: SeShutdownPrivilege	4048	powercfg.exe
Token: SeCreatePagefilePrivilege	4048	powercfg.exe
Token: SeShutdownPrivilege	2224	powercfg.exe
Token: SeCreatePagefilePrivilege	2224	powercfg.exe
Token: SeShutdownPrivilege	3288	powercfg.exe
Token: SeCreatePagefilePrivilege	3288	powercfg.exe
Token: SeShutdownPrivilege	1100	powercfg.exe
Token: SeCreatePagefilePrivilege	1100	powercfg.exe
Token: SeShutdownPrivilege	3584	powercfg.exe
Token: SeCreatePagefilePrivilege	3584	powercfg.exe
Token: SeShutdownPrivilege	2548	powercfg.exe
Token: SeCreatePagefilePrivilege	2548	powercfg.exe
Token: SeShutdownPrivilege	2556	powercfg.exe
Token: SeCreatePagefilePrivilege	2556	powercfg.exe
Token: SeDebugPrivilege	1400	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeIncreaseQuotaPrivilege	372	powershell.exe
Token: SeSecurityPrivilege	372	powershell.exe
Token: SeTakeOwnershipPrivilege	372	powershell.exe
Token: SeLoadDriverPrivilege	372	powershell.exe
Token: SeSystemProfilePrivilege	372	powershell.exe
Token: SeSystemtimePrivilege	372	powershell.exe
Token: SeProfSingleProcessPrivilege	372	powershell.exe
Token: SeIncBasePriorityPrivilege	372	powershell.exe
Token: SeCreatePagefilePrivilege	372	powershell.exe
Token: SeBackupPrivilege	372	powershell.exe
Token: SeRestorePrivilege	372	powershell.exe
Token: SeShutdownPrivilege	372	powershell.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeSystemEnvironmentPrivilege	372	powershell.exe
Token: SeRemoteShutdownPrivilege	372	powershell.exe
Token: SeUndockPrivilege	372	powershell.exe
Token: SeManageVolumePrivilege	372	powershell.exe
Token: 33	372	powershell.exe
Token: 34	372	powershell.exe
Token: 35	372	powershell.exe
Token: 36	372	powershell.exe
Token: SeIncreaseQuotaPrivilege	372	powershell.exe
Token: SeSecurityPrivilege	372	powershell.exe
Token: SeTakeOwnershipPrivilege	372	powershell.exe
Token: SeLoadDriverPrivilege	372	powershell.exe
Token: SeSystemProfilePrivilege	372	powershell.exe
Token: SeSystemtimePrivilege	372	powershell.exe
Token: SeProfSingleProcessPrivilege	372	powershell.exe
Token: SeIncBasePriorityPrivilege	372	powershell.exe
Token: SeCreatePagefilePrivilege	372	powershell.exe
Token: SeBackupPrivilege	372	powershell.exe
Token: SeRestorePrivilege	372	powershell.exe
Token: SeShutdownPrivilege	372	powershell.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeSystemEnvironmentPrivilege	372	powershell.exe
Token: SeRemoteShutdownPrivilege	372	powershell.exe
Token: SeUndockPrivilege	372	powershell.exe
Token: SeManageVolumePrivilege	372	powershell.exe
Token: 33	372	powershell.exe
Token: 34	372	powershell.exe
Token: 35	372	powershell.exe
Token: 36	372	powershell.exe
Token: SeManageVolumePrivilege	4408	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
372	powershell.exe
372	powershell.exe
3156	setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4008	spf.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 3912	4008	spf.exe	140
PID 4008 wrote to memory of 3912	4008	spf.exe	140
PID 3912 wrote to memory of 4508	3912	cmd.exe	108
PID 3912 wrote to memory of 4508	3912	cmd.exe	108
PID 4008 wrote to memory of 2892	4008	spf.exe	109
PID 4008 wrote to memory of 2892	4008	spf.exe	109
PID 2892 wrote to memory of 1792	2892	cmd.exe	111
PID 2892 wrote to memory of 1792	2892	cmd.exe	111
PID 4008 wrote to memory of 3676	4008	spf.exe	112
PID 4008 wrote to memory of 3676	4008	spf.exe	112
PID 3676 wrote to memory of 2236	3676	cmd.exe	114
PID 3676 wrote to memory of 2236	3676	cmd.exe	114
PID 4008 wrote to memory of 4168	4008	spf.exe	115
PID 4008 wrote to memory of 4168	4008	spf.exe	115
PID 4168 wrote to memory of 4048	4168	cmd.exe	117
PID 4168 wrote to memory of 4048	4168	cmd.exe	117
PID 4008 wrote to memory of 936	4008	spf.exe	118
PID 4008 wrote to memory of 936	4008	spf.exe	118
PID 936 wrote to memory of 2224	936	cmd.exe	120
PID 936 wrote to memory of 2224	936	cmd.exe	120
PID 4008 wrote to memory of 3736	4008	spf.exe	121
PID 4008 wrote to memory of 3736	4008	spf.exe	121
PID 3736 wrote to memory of 3288	3736	cmd.exe	123
PID 3736 wrote to memory of 3288	3736	cmd.exe	123
PID 4008 wrote to memory of 3292	4008	spf.exe	124
PID 4008 wrote to memory of 3292	4008	spf.exe	124
PID 3292 wrote to memory of 1100	3292	cmd.exe	126
PID 3292 wrote to memory of 1100	3292	cmd.exe	126
PID 4008 wrote to memory of 2432	4008	spf.exe	127
PID 4008 wrote to memory of 2432	4008	spf.exe	127
PID 2432 wrote to memory of 3584	2432	cmd.exe	129
PID 2432 wrote to memory of 3584	2432	cmd.exe	129
PID 4008 wrote to memory of 3560	4008	spf.exe	130
PID 4008 wrote to memory of 3560	4008	spf.exe	130
PID 3560 wrote to memory of 2548	3560	cmd.exe	132
PID 3560 wrote to memory of 2548	3560	cmd.exe	132
PID 4008 wrote to memory of 320	4008	spf.exe	133
PID 4008 wrote to memory of 320	4008	spf.exe	133
PID 320 wrote to memory of 2556	320	cmd.exe	135
PID 320 wrote to memory of 2556	320	cmd.exe	135
PID 4008 wrote to memory of 336	4008	spf.exe	136
PID 4008 wrote to memory of 336	4008	spf.exe	136
PID 4008 wrote to memory of 4580	4008	spf.exe	137
PID 4008 wrote to memory of 4580	4008	spf.exe	137
PID 4008 wrote to memory of 1400	4008	spf.exe	138
PID 4008 wrote to memory of 1400	4008	spf.exe	138
PID 372 wrote to memory of 1376	372	powershell.exe	153
PID 372 wrote to memory of 1376	372	powershell.exe	153
PID 372 wrote to memory of 1376	372	powershell.exe	153
PID 1376 wrote to memory of 4908	1376	csc.exe	154
PID 1376 wrote to memory of 4908	1376	csc.exe	154
PID 1376 wrote to memory of 4908	1376	csc.exe	154
PID 372 wrote to memory of 2640	372	powershell.exe	161
PID 372 wrote to memory of 2640	372	powershell.exe	161
PID 372 wrote to memory of 2640	372	powershell.exe	161
PID 372 wrote to memory of 3156	372	powershell.exe	163
PID 372 wrote to memory of 3156	372	powershell.exe	163
PID 3156 wrote to memory of 1560	3156	setup.exe	164
PID 3156 wrote to memory of 1560	3156	setup.exe	164
PID 3156 wrote to memory of 1180	3156	setup.exe	169
PID 3156 wrote to memory of 1180	3156	setup.exe	169

C:\Users\Admin\AppData\Local\Temp\spf.exe
"C:\Users\Admin\AppData\Local\Temp\spf.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C sc stop bam
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\system32\sc.exe
    sc stop bam
    3⤵
    - Launches sc.exe
    PID:4508
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C SC CONFIG "bam" START= DISABLED
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\sc.exe
    SC CONFIG "bam" START= DISABLED
    3⤵
    - Launches sc.exe
    PID:1792
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C fsutil behavior set DisableLastAccess 3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\fsutil.exe
    fsutil behavior set DisableLastAccess 3
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /hibernate off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -disk-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\powercfg.exe
    powercfg /x -disk-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -disk-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\powercfg.exe
    powercfg /x -disk-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /resync
  2⤵
  PID:336
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM battle.net.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xlq3pcyq\xlq3pcyq.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1A3.tmp" "c:\Users\Admin\AppData\Local\Temp\xlq3pcyq\CSCCB03D5A7B45C4FB1AB9E5A346C2A5156.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4908
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" interface teredo set state disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --uninstall --msedge --system-level --verbose-logging --force-uninstall --delete-profile
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops desktop.ini file(s)
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6b1455460,0x7ff6b1455470,0x7ff6b1455480
    3⤵
    PID:1560
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3156" "2108" "2072" "2112" "0" "0" "0" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1180

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe
1⤵
PID:3068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery