asyncrat | a7521b44c71baaaa5ac4c74b1918196713fee07470a48cbd27b2c46142375154

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Service Host.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Y:	WO18.exe
File opened (read-only)	\??\F:	WO18.exe
File opened (read-only)	\??\H:	WO18.exe
File opened (read-only)	\??\K:	WO18.exe
File opened (read-only)	\??\M:	WO18.exe
File opened (read-only)	\??\S:	WO18.exe
File opened (read-only)	\??\V:	WO18.exe
File opened (read-only)	\??\R:	WO18.exe
File opened (read-only)	\??\U:	WO18.exe
File opened (read-only)	\??\D:	WO18.exe
File opened (read-only)	\??\E:	WO18.exe
File opened (read-only)	\??\G:	WO18.exe
File opened (read-only)	\??\I:	WO18.exe
File opened (read-only)	\??\L:	WO18.exe
File opened (read-only)	\??\O:	WO18.exe
File opened (read-only)	\??\Z:	WO18.exe
File opened (read-only)	\??\B:	WO18.exe
File opened (read-only)	\??\P:	WO18.exe
File opened (read-only)	\??\J:	WO18.exe
File opened (read-only)	\??\N:	WO18.exe
File opened (read-only)	\??\Q:	WO18.exe
File opened (read-only)	\??\T:	WO18.exe
File opened (read-only)	\??\W:	WO18.exe
File opened (read-only)	\??\X:	WO18.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	WO18.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	WO18.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	WO18.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2720 set thread context of 2696	2720	Service Host.exe	32
PID 2764 set thread context of 2408	2764	svchost.exe	34
PID 2096 set thread context of 1740	2096	Windows Help.exe	46
PID 1524 set thread context of 1580	1524	Windows Microsoft.exe	52
PID 1720 set thread context of 2380	1720	Windows Service.exe	54

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini.__meta__.__tmp__	WO18.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini.__meta__.__tmp__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo.__meta__.__tmp__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\xregistry.bin.__tmp__	WinOptimizer.18.00.18.Portable.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe.manifest.__tmp__	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\temp\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini.__deleted__	WO18.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18.__meta__.__tmp__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\WinOptimizer.18.00.18.Portable.exe	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\xsandbox.bin.__tmp__	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\xregistry.bin.__tmp__	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\xsandbox.bin	WinOptimizer.18.00.18.Portable.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini.__meta__.__tmp__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18.__meta__.__tmp__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe.__tmp__	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\temp\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\modified\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini.__meta__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini.__deleted__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo.__meta__	WO18.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo.__meta__.__tmp__	WO18.exe
File created	C:\Program Files (x86)\SCSI Service\scsisvc.exe	Service Host.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe.__tmp__	WinOptimizer.18.00.18.Portable.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\temp\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe.manifest.__tmp__	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe.manifest	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\xsandbox.bin.__tmp__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini.__meta__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\modified\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Uninstall.exe	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Uninstall.ini	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\xsandbox.bin.__tmp__	WinOptimizer.18.00.18.Portable.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini.__meta__.__tmp__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18.__meta__	WO18.exe
File opened for modification	C:\Program Files (x86)\SCSI Service\scsisvc.exe	Service Host.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini.__meta__	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\modified\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini	WO18.exe
File created	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\temp\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\data\dc.ini	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\xsandbox.bin	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\roaming\modified\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini	WO18.exe
File opened for modification	C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\meta\@PROGRAMFILESX86@\Ashampoo\Ashampoo WinOptimizer 18\skins\default\skin.ini.__meta__	WO18.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Help.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinOptimizer.18.00.18.Portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WO18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Help.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Service.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WO18.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WO18.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
896	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1048	schtasks.exe
2772	schtasks.exe
2488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2696	Service Host.exe
2696	Service Host.exe
2696	Service Host.exe
2408	svchost.exe
2096	Windows Help.exe
2096	Windows Help.exe
2096	Windows Help.exe
2096	Windows Help.exe
1376	WO18.exe
1376	WO18.exe
2696	Service Host.exe
2696	Service Host.exe
2696	Service Host.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	Service Host.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	Service Host.exe
Token: SeDebugPrivilege	2408	svchost.exe
Token: SeDebugPrivilege	2096	Windows Help.exe
Token: SeDebugPrivilege	1740	Windows Help.exe
Token: SeDebugPrivilege	1580	Windows Microsoft.exe
Token: SeDebugPrivilege	2380	Windows Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2380	Windows Service.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1376	WO18.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2720	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	31
PID 2316 wrote to memory of 2720	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	31
PID 2316 wrote to memory of 2720	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	31
PID 2316 wrote to memory of 2720	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	31
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2720 wrote to memory of 2696	2720	Service Host.exe	32
PID 2316 wrote to memory of 2764	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	33
PID 2316 wrote to memory of 2764	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	33
PID 2316 wrote to memory of 2764	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	33
PID 2316 wrote to memory of 2764	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	33
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2764 wrote to memory of 2408	2764	svchost.exe	34
PID 2316 wrote to memory of 2096	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	35
PID 2316 wrote to memory of 2096	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	35
PID 2316 wrote to memory of 2096	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	35
PID 2316 wrote to memory of 2096	2316	CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe	35
PID 2408 wrote to memory of 1584	2408	svchost.exe	36
PID 2408 wrote to memory of 1584	2408	svchost.exe	36
PID 2408 wrote to memory of 1584	2408	svchost.exe	36
PID 2408 wrote to memory of 1584	2408	svchost.exe	36
PID 2408 wrote to memory of 2296	2408	svchost.exe	38
PID 2408 wrote to memory of 2296	2408	svchost.exe	38
PID 2408 wrote to memory of 2296	2408	svchost.exe	38
PID 2408 wrote to memory of 2296	2408	svchost.exe	38
PID 1584 wrote to memory of 1048	1584	cmd.exe	40
PID 1584 wrote to memory of 1048	1584	cmd.exe	40
PID 1584 wrote to memory of 1048	1584	cmd.exe	40
PID 1584 wrote to memory of 1048	1584	cmd.exe	40
PID 2296 wrote to memory of 896	2296	cmd.exe	41
PID 2296 wrote to memory of 896	2296	cmd.exe	41
PID 2296 wrote to memory of 896	2296	cmd.exe	41
PID 2296 wrote to memory of 896	2296	cmd.exe	41
PID 2296 wrote to memory of 1524	2296	cmd.exe	42
PID 2296 wrote to memory of 1524	2296	cmd.exe	42
PID 2296 wrote to memory of 1524	2296	cmd.exe	42
PID 2296 wrote to memory of 1524	2296	cmd.exe	42
PID 2096 wrote to memory of 308	2096	Windows Help.exe	44
PID 2096 wrote to memory of 308	2096	Windows Help.exe	44
PID 2096 wrote to memory of 308	2096	Windows Help.exe	44
PID 2096 wrote to memory of 308	2096	Windows Help.exe	44
PID 2096 wrote to memory of 1764	2096	Windows Help.exe	45
PID 2096 wrote to memory of 1764	2096	Windows Help.exe	45
PID 2096 wrote to memory of 1764	2096	Windows Help.exe	45
PID 2096 wrote to memory of 1764	2096	Windows Help.exe	45
PID 2096 wrote to memory of 1740	2096	Windows Help.exe	46
PID 2096 wrote to memory of 1740	2096	Windows Help.exe	46
PID 2096 wrote to memory of 1740	2096	Windows Help.exe	46
PID 2096 wrote to memory of 1740	2096	Windows Help.exe	46
PID 2096 wrote to memory of 1740	2096	Windows Help.exe	46
PID 2096 wrote to memory of 1740	2096	Windows Help.exe	46

C:\Users\Admin\AppData\Local\Temp\CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe
"C:\Users\Admin\AppData\Local\Temp\CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Roaming\Service Host.exe
  "C:\Users\Admin\AppData\Roaming\Service Host.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Roaming\Service Host.exe
    "C:\Users\Admin\AppData\Roaming\Service Host.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Microsoft" /tr '"C:\Users\Admin\AppData\Roaming\Windows Microsoft.exe"' & exit
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Windows Microsoft" /tr '"C:\Users\Admin\AppData\Roaming\Windows Microsoft.exe"'
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD78A.tmp.bat""
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:896
    - - C:\Users\Admin\AppData\Roaming\Windows Microsoft.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Microsoft.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1524
      - C:\Users\Admin\AppData\Roaming\Windows Microsoft.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Microsoft.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
- C:\Users\Admin\AppData\Roaming\Windows Help.exe
  "C:\Users\Admin\AppData\Roaming\Windows Help.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Roaming\Windows Help.exe
    "C:\Users\Admin\AppData\Roaming\Windows Help.exe"
    3⤵
    - Executes dropped EXE
    PID:308
- - C:\Users\Admin\AppData\Roaming\Windows Help.exe
    "C:\Users\Admin\AppData\Roaming\Windows Help.exe"
    3⤵
    - Executes dropped EXE
    PID:1764
- - C:\Users\Admin\AppData\Roaming\Windows Help.exe
    "C:\Users\Admin\AppData\Roaming\Windows Help.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Microsoft Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Help.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2772
  - - C:\Users\Admin\AppData\Roaming\Windows Update\Windows Service.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update\Windows Service.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1720
    - - C:\Users\Admin\AppData\Roaming\Windows Update\Windows Service.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Update\Windows Service.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2380
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Update\Windows Service.exe" /rl HIGHEST /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2488
- C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\WinOptimizer.18.00.18.Portable.exe
  "C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\WinOptimizer.18.00.18.Portable.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe
    "C:\Program Files (x86)\Ashampoo GmbH & Co. KG\WinOptimizer Portable\Ashampoo WinOptimizer 18\local\stubexe\0x27455F3DAFB1B6BB\WO18.exe" /864A627C-C6B2-464A-AA13-25D62F282BD8
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Maps connected drives based on registry
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery