01a59c3b95fae20abe2ad7b39b60bde2d66dcdc7a955b3db2972aa9f33e26b9a

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExtremeUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExtremeUI.exe

Disables taskbar notifications via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 49 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
4308	ExtremeUI.exe
4576	KeyAuthEmu1.3.exe
3288	KeyAuthEmu1.3.exe
2596	ExtremeUI.exe
4744	ExtremeUI.exe

Loads dropped DLL 2 IoCs

pid	Process
4576	KeyAuthEmu1.3.exe
3288	KeyAuthEmu1.3.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2756	takeown.exe
3764	takeown.exe
3832	takeown.exe
3824	takeown.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ExtremeUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExtremeUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ExtremeUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExtremeUI.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4908	powershell.exe
3692	powershell.exe
2804	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 49 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 18 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
528	cmd.exe
4076	control.exe
3336	powercfg.exe
3540	cmd.exe
1144	powercfg.exe
4720	cmd.exe
1260	rundll32.exe
3100	cmd.exe
3756	powercfg.exe
4224	cmd.exe
2880	control.exe
3768	cmd.exe
2344	powercfg.exe
640	cmd.exe
3048	powercfg.exe
956	rundll32.exe
2128	cmd.exe
112	powercfg.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4920	cscript.exe
2900	cscript.exe
2604	cscript.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
4908	powershell.exe
2272	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 38 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1068	cmd.exe
4224	cmd.exe
4264	cmd.exe
3860	cmd.exe
3272	cmd.exe
4564	cmd.exe
2344	cmd.exe
3704	cmd.exe
2228	cmd.exe
1116	cmd.exe
2820	cmd.exe
3700	cmd.exe
2452	cmd.exe
2024	cmd.exe
956	cmd.exe
4280	cmd.exe
4728	cmd.exe
1524	cmd.exe
1788	cmd.exe
4328	cmd.exe
4620	cmd.exe
4380	cmd.exe
2080	cmd.exe
612	cmd.exe
1264	cmd.exe
4400	cmd.exe
868	cmd.exe
1520	cmd.exe
2576	cmd.exe
3360	cmd.exe
1748	cmd.exe
1060	cmd.exe
1448	cmd.exe
3536	cmd.exe
4724	cmd.exe
4596	cmd.exe
3524	cmd.exe
3168	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
2944	ipconfig.exe

Modifies Control Panel 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\User Profile\HttpAcceptLanguageOptOut = "1"	ExtremeUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\FontSmoothing = "2"	ExtremeUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\HungAppTimeout = "1000"	ExtremeUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000"	ExtremeUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\MenuShowDelay = "0"	ExtremeUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\FontSmoothingType = "2"	ExtremeUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\AutoEndTasks = "1"	ExtremeUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	ExtremeUI.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 0c0001008421de39020000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 1e0071800000000000000000000037595a02bea68646a84436fe4bec8b6d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "3"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2724	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3692	powershell.exe
3692	powershell.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
2596	ExtremeUI.exe
2596	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe
4744	ExtremeUI.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4772	7zFM.exe
2384	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeRestorePrivilege	4772	7zFM.exe
Token: 35	4772	7zFM.exe
Token: SeSecurityPrivilege	4772	7zFM.exe
Token: SeDebugPrivilege	4308	ExtremeUI.exe
Token: SeDebugPrivilege	2596	ExtremeUI.exe
Token: SeDebugPrivilege	4744	ExtremeUI.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2384	taskmgr.exe
Token: SeSystemProfilePrivilege	2384	taskmgr.exe
Token: SeCreateGlobalPrivilege	2384	taskmgr.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeShutdownPrivilege	3048	powercfg.exe
Token: SeCreatePagefilePrivilege	3048	powercfg.exe
Token: SeShutdownPrivilege	3048	powercfg.exe
Token: SeCreatePagefilePrivilege	3048	powercfg.exe
Token: SeShutdownPrivilege	3756	powercfg.exe
Token: SeCreatePagefilePrivilege	3756	powercfg.exe
Token: SeShutdownPrivilege	3336	powercfg.exe
Token: SeCreatePagefilePrivilege	3336	powercfg.exe
Token: SeShutdownPrivilege	2344	powercfg.exe
Token: SeCreatePagefilePrivilege	2344	powercfg.exe
Token: SeShutdownPrivilege	112	powercfg.exe
Token: SeCreatePagefilePrivilege	112	powercfg.exe
Token: SeShutdownPrivilege	2724	explorer.exe
Token: SeCreatePagefilePrivilege	2724	explorer.exe
Token: SeShutdownPrivilege	2724	explorer.exe
Token: SeCreatePagefilePrivilege	2724	explorer.exe
Token: SeShutdownPrivilege	2724	explorer.exe
Token: SeCreatePagefilePrivilege	2724	explorer.exe
Token: SeShutdownPrivilege	1144	powercfg.exe
Token: SeCreatePagefilePrivilege	1144	powercfg.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4772	7zFM.exe
4772	7zFM.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2724	explorer.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe
2384	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1520	2596	ExtremeUI.exe	109
PID 1520 wrote to memory of 4328	1520	cmd.exe	111
PID 2596 wrote to memory of 3704	2596	ExtremeUI.exe	112
PID 2596 wrote to memory of 2576	2596	ExtremeUI.exe	114
PID 2576 wrote to memory of 4920	2576	cmd.exe	116
PID 2596 wrote to memory of 5044	2596	ExtremeUI.exe	117
PID 2596 wrote to memory of 3360	2596	ExtremeUI.exe	119
PID 3360 wrote to memory of 3692	3360	cmd.exe	121
PID 2596 wrote to memory of 1748	2596	ExtremeUI.exe	124
PID 2596 wrote to memory of 1068	2596	ExtremeUI.exe	126
PID 1068 wrote to memory of 1236	1068	cmd.exe	128
PID 4744 wrote to memory of 2228	4744	ExtremeUI.exe	133
PID 2228 wrote to memory of 1796	2228	cmd.exe	135
PID 4744 wrote to memory of 4280	4744	ExtremeUI.exe	136
PID 4744 wrote to memory of 2080	4744	ExtremeUI.exe	138
PID 2080 wrote to memory of 2900	2080	cmd.exe	140
PID 4744 wrote to memory of 4180	4744	ExtremeUI.exe	141
PID 4744 wrote to memory of 4328	4744	ExtremeUI.exe	143
PID 4328 wrote to memory of 2804	4328	cmd.exe	145
PID 4744 wrote to memory of 4724	4744	ExtremeUI.exe	147
PID 4744 wrote to memory of 4596	4744	ExtremeUI.exe	149
PID 4596 wrote to memory of 60	4596	cmd.exe	151
PID 4744 wrote to memory of 4224	4744	ExtremeUI.exe	153
PID 4744 wrote to memory of 4728	4744	ExtremeUI.exe	155
PID 4728 wrote to memory of 4908	4728	cmd.exe	157
PID 4744 wrote to memory of 3728	4744	ExtremeUI.exe	158
PID 3728 wrote to memory of 2272	3728	cmd.exe	160
PID 4744 wrote to memory of 1116	4744	ExtremeUI.exe	161
PID 1116 wrote to memory of 2944	1116	cmd.exe	163
PID 4744 wrote to memory of 1060	4744	ExtremeUI.exe	164
PID 1060 wrote to memory of 904	1060	cmd.exe	166
PID 4744 wrote to memory of 2820	4744	ExtremeUI.exe	167
PID 2820 wrote to memory of 3496	2820	cmd.exe	169
PID 4744 wrote to memory of 640	4744	ExtremeUI.exe	170
PID 640 wrote to memory of 3048	640	cmd.exe	172
PID 4744 wrote to memory of 4264	4744	ExtremeUI.exe	173
PID 4744 wrote to memory of 3524	4744	ExtremeUI.exe	175
PID 4744 wrote to memory of 3700	4744	ExtremeUI.exe	177
PID 4744 wrote to memory of 2024	4744	ExtremeUI.exe	179
PID 2024 wrote to memory of 2604	2024	cmd.exe	181
PID 4744 wrote to memory of 3100	4744	ExtremeUI.exe	182
PID 3100 wrote to memory of 3756	3100	cmd.exe	184
PID 4744 wrote to memory of 4224	4744	ExtremeUI.exe	185
PID 4224 wrote to memory of 2880	4224	cmd.exe	187
PID 2880 wrote to memory of 956	2880	control.exe	188
PID 4744 wrote to memory of 3768	4744	ExtremeUI.exe	190
PID 4744 wrote to memory of 3540	4744	ExtremeUI.exe	193
PID 3540 wrote to memory of 2344	3540	cmd.exe	195
PID 4744 wrote to memory of 2128	4744	ExtremeUI.exe	196
PID 2128 wrote to memory of 112	2128	cmd.exe	198
PID 4744 wrote to memory of 612	4744	ExtremeUI.exe	199
PID 4744 wrote to memory of 1448	4744	ExtremeUI.exe	201
PID 1448 wrote to memory of 4256	1448	cmd.exe	204
PID 4744 wrote to memory of 528	4744	ExtremeUI.exe	205
PID 528 wrote to memory of 1144	528	cmd.exe	207
PID 4744 wrote to memory of 4720	4744	ExtremeUI.exe	208
PID 4720 wrote to memory of 4076	4720	cmd.exe	210
PID 4076 wrote to memory of 1260	4076	control.exe	211
PID 4744 wrote to memory of 1676	4744	ExtremeUI.exe	213
PID 4744 wrote to memory of 3700	4744	ExtremeUI.exe	215
PID 4744 wrote to memory of 2740	4744	ExtremeUI.exe	217
PID 4744 wrote to memory of 3456	4744	ExtremeUI.exe	219
PID 4744 wrote to memory of 3860	4744	ExtremeUI.exe	221
PID 3860 wrote to memory of 2944	3860	cmd.exe	223

System policy modification 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExtremeUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExtremeUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	ExtremeUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn = "1"	ExtremeUI.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Yeni WinRAR arşivi.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3764

C:\Users\Admin\Desktop\Risxn Cracked Tweak\ExtremeUI.exe
"C:\Users\Admin\Desktop\Risxn Cracked Tweak\ExtremeUI.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Users\Admin\Desktop\Risxn Cracked Tweak\emu\KeyAuthEmu1.3.exe
"C:\Users\Admin\Desktop\Risxn Cracked Tweak\emu\KeyAuthEmu1.3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4576

C:\Users\Admin\Desktop\Risxn Cracked Tweak\emu\KeyAuthEmu1.3.exe
"C:\Users\Admin\Desktop\Risxn Cracked Tweak\emu\KeyAuthEmu1.3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3288

C:\Users\Admin\Desktop\Risxn Cracked Tweak\ExtremeUI.exe
"C:\Users\Admin\Desktop\Risxn Cracked Tweak\ExtremeUI.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2596
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mode 160,125
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\mode.com
    mode 160,125
    3⤵
    PID:4328
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c color 0C
  2⤵
  - Executes a command shell one-liner
  PID:3704
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cscript //nologo "C:\temp\popup.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\temp\popup.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4920
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c del "C:\temp\popup.vbs"
  2⤵
  PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'>nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c color 0B
  2⤵
  - Executes a command shell one-liner
  PID:1748
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mode 160,125
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\mode.com
    mode 160,125
    3⤵
    PID:1236

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Risxn Cracked Tweak\readme.txt
1⤵
PID:2332

C:\Users\Admin\Desktop\Risxn Cracked Tweak\ExtremeUI.exe
"C:\Users\Admin\Desktop\Risxn Cracked Tweak\ExtremeUI.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mode 160,125
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\system32\mode.com
    mode 160,125
    3⤵
    PID:1796
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c color 0C
  2⤵
  - Executes a command shell one-liner
  PID:4280
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cscript //nologo "C:\temp\popup.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\temp\popup.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2900
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c del "C:\temp\popup.vbs"
  2⤵
  PID:4180
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'>nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c color 0B
  2⤵
  - Executes a command shell one-liner
  PID:4724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mode 160,125
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\mode.com
    mode 160,125
    3⤵
    PID:60
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c FOR /F "eol=E" %%a in ('Reg.exe QUERY "HKLM\System\CurrentControlSet\Services" /S /F "IoLatencyCap"^| FINDSTR /V "IoLatencyCap"') DO ( FOR /F "tokens=*" %%z IN ("%%a") DO ( FOR /F "eol=E" %%a in ('Reg.exe QUERY "HKLM\SYSTEM\DriverDatabase\DriverPackages" /S /F "IoLatencyCap"^| FINDSTR /V "IoLatencyCap"') DO (FOR /F "tokens=*" %%z IN ("%%a") DO ( SET STR=%%z & SET STR=!STR:HKLM\System\CurrentControlSet\services\=! & SET STR=!STR:\Parameters=! ))
  2⤵
  - Executes a command shell one-liner
  PID:4224
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell "ForEach($v in (Get-Command -Name \"Set-ProcessMitigation\").Parameters[\"Disable\"].Attributes.ValidValues){Set-ProcessMitigation -System -Disable $v.ToString() -ErrorAction SilentlyContinue}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "ForEach($v in (Get-Command -Name \"Set-ProcessMitigation\").Parameters[\"Disable\"].Attributes.ValidValues){Set-ProcessMitigation -System -Disable $v.ToString() -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell "Remove-Item -Path \"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*\" -Recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Remove-Item -Path \"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*\" -Recurse -ErrorAction SilentlyContinue"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Indicator Removal: Clear Persistence
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c lodctr /r
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\lodctr.exe
    lodctr /r
    3⤵
    - Drops file in System32 directory
    PID:2944
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c lodctr /r
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\system32\lodctr.exe
    lodctr /r
    3⤵
    - Drops file in System32 directory
    PID:904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c FSUTIL behavior set disablelastaccess 1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\fsutil.exe
    FSUTIL behavior set disablelastaccess 1
    3⤵
    PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c Powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\system32\powercfg.exe
    Powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c FOR /F "eol=E" %%a in ('Reg.exe QUERY "HKLM\System\CurrentControlSet\Services" /S /F "EnableHIPM"^| FINDSTR /V "EnableHIPM"') DO (
  2⤵
  - Executes a command shell one-liner
  PID:4264
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c FOR /F "tokens=*" %%z IN ("%%a") DO (
  2⤵
  - Executes a command shell one-liner
  PID:3524
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c for /f "tokens=*" %%s in ('Reg.exe query "HKLM\System\CurrentControlSet\Enum" /S /F "StorPort" ^| findstr /e "StorPort"') do Reg.exe add "%%s" /v "EnableIdlePowerManagement" /t REG_DWORD /d "0" /f
  2⤵
  - Executes a command shell one-liner
  PID:3700
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cscript //nologo "C:\temp\popup.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\temp\popup.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2604
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\powercfg.exe
    powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3756
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powercfg.cpl
  2⤵
  - Checks computer location settings
  - Power Settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\System32\control.exe
    "C:\Windows\System32\control.exe" "C:\Windows\system32\powercfg.cpl",
    3⤵
    - Power Settings
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\powercfg.cpl",
      4⤵
      Power Settings
      Modifies registry class
      PID:956
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  PID:3768
- - C:\Windows\system32\powercfg.exe
    powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\system32\powercfg.exe
    powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\powercfg.exe
    powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:112
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c md C:\risxn\PowerPlan
  2⤵
  - Executes a command shell one-liner
  PID:612
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c curl -g -k -L -# -o "C:\risxn\Powerplan\Risxn.pow" "https://files.catbox.moe/2my5ir.pow"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\risxn\Powerplan\Risxn.pow" "https://files.catbox.moe/2my5ir.pow"
    3⤵
    PID:4256
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powercfg -import "C:\risxn\Powerplan\Risxn.pow"
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\system32\powercfg.exe
    powercfg -import "C:\risxn\Powerplan\Risxn.pow"
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powercfg.cpl
  2⤵
  - Checks computer location settings
  - Power Settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\control.exe
    "C:\Windows\System32\control.exe" "C:\Windows\system32\powercfg.cpl",
    3⤵
    - Power Settings
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\powercfg.cpl",
      4⤵
      Power Settings
      Modifies registry class
      PID:1260
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c del *.log /a /s /q /f
  2⤵
  PID:1676
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c del /s /f /q c:\windows\temp\*.*
  2⤵
  PID:3700
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c del /s /f /q C:\WINDOWS\Prefetch
  2⤵
  PID:2740
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c del /s /f /q %temp%\*.*
  2⤵
  PID:3456
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /flushdns
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2944
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  PID:1264
- - C:\Windows\system32\net.exe
    net stop wuauserv
    3⤵
    PID:4352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:2132
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net stop UsoSvc
  2⤵
  - Executes a command shell one-liner
  PID:2344
- - C:\Windows\system32\net.exe
    net stop UsoSvc
    3⤵
    PID:2108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop UsoSvc
      4⤵
      PID:4132
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q C:\Windows\SoftwareDistribution
  2⤵
  - Executes a command shell one-liner
  PID:3168
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c md C:\Windows\SoftwareDistribution
  2⤵
  - Executes a command shell one-liner
  PID:4620
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c RD /S /Q %temp%
  2⤵
  - Executes a command shell one-liner
  PID:956
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c MKDIR %temp%
  2⤵
  - Executes a command shell one-liner
  PID:4400
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c takeown /f "%temp%" /r /d y
  2⤵
  - Executes a command shell one-liner
  PID:3536
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Users\Admin\AppData\Local\Temp" /r /d y
    3⤵
    - Modifies file permissions
    PID:3832
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c takeown /f "C:\Windows\Temp" /r /d y
  2⤵
  - Executes a command shell one-liner
  PID:868
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Temp" /r /d y
    3⤵
    - Modifies file permissions
    PID:3824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c RD /S /Q C:\Windows\Temp
  2⤵
  - Executes a command shell one-liner
  PID:1524
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c MKDIR C:\Windows\Temp
  2⤵
  - Executes a command shell one-liner
  PID:1788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c takeown /f "C:\Windows\Temp" /r /d y
  2⤵
  - Executes a command shell one-liner
  PID:4380
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\Temp" /r /d y
    3⤵
    - Modifies file permissions
    PID:2756
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c takeown /f %temp% /r /d y
  2⤵
  - Executes a command shell one-liner
  PID:3272
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Local\Temp /r /d y
    3⤵
    - Modifies file permissions
    PID:3764
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\tempor~1
  2⤵
  PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\temp
  2⤵
  PID:4236
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\tmp
  2⤵
  PID:2604
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\ff*.tmp
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\history
  2⤵
  PID:4984
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\cookies
  2⤵
  PID:2740
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\recent
  2⤵
  PID:3356
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c deltree /y c:\windows\spool\printers
  2⤵
  PID:1056
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c fsutil behavior set disableLastAccess 0
  2⤵
  - Executes a command shell one-liner
  PID:4564
- - C:\Windows\system32\fsutil.exe
    fsutil behavior set disableLastAccess 0
    3⤵
    PID:1476
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c fsutil behavior set disable8dot3 1
  2⤵
  - Executes a command shell one-liner
  PID:2452
- - C:\Windows\system32\fsutil.exe
    fsutil behavior set disable8dot3 1
    3⤵
    PID:3784

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4820

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2384

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2724

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery