9a20052af80b563ce9cf9181e25ad5686bf3d606a7d6eda0db508cf13893f7a4

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	CHEATS.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CHEATS.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	CHEATS.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	CHEATS.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	CHEATS.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	CHEATS.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4948	netsh.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CHEATS.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
2288	Process not Found
5544	M1004NUS.exe
1400	M1004NUS.exe
2700	BootExecutor.exe
2408	BootExecutor.exe
4548	BootExecutor.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	CHEATS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CHEATS.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	CHEATS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	CHEATS.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	CHEATS.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	CHEATS.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	CHEATS.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	CHEATS.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4256	sc.exe
1600	sc.exe
4448	sc.exe
1648	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
936	cmd.exe
828	cmd.exe
2116	CMD.exe
2548	cmd.exe
2608	cmd.exe
2720	cmd.exe
1644	cmd.exe
4656	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CHEATS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CHEATS.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	CHEATS.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	CHEATS.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3600	schtasks.exe
3356	schtasks.exe
2524	schtasks.exe
2600	schtasks.exe
4112	schtasks.exe
1628	schtasks.exe
1844	schtasks.exe
2144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
4376	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
5420	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe
4376	CHEATS.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2288	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5420	CHEATS.exe
Token: SeDebugPrivilege	4376	CHEATS.exe
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeDebugPrivilege	5420	CHEATS.exe
Token: SeTakeOwnershipPrivilege	5420	CHEATS.exe
Token: SeRestorePrivilege	5420	CHEATS.exe
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found
Token: SeCreatePagefilePrivilege	2288	Process not Found
Token: SeShutdownPrivilege	2288	Process not Found

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 936	5420	CHEATS.exe	90
PID 936 wrote to memory of 4948	936	cmd.exe	92
PID 5420 wrote to memory of 4256	5420	CHEATS.exe	93
PID 5420 wrote to memory of 1600	5420	CHEATS.exe	95
PID 5420 wrote to memory of 4448	5420	CHEATS.exe	97
PID 5420 wrote to memory of 2272	5420	CHEATS.exe	100
PID 5420 wrote to memory of 4112	5420	CHEATS.exe	104
PID 5420 wrote to memory of 828	5420	CHEATS.exe	106
PID 828 wrote to memory of 1628	828	cmd.exe	108
PID 5420 wrote to memory of 1648	5420	CHEATS.exe	109
PID 5420 wrote to memory of 1060	5420	CHEATS.exe	111
PID 5420 wrote to memory of 2116	5420	CHEATS.exe	112
PID 5420 wrote to memory of 4084	5420	CHEATS.exe	113
PID 5420 wrote to memory of 2548	5420	CHEATS.exe	114
PID 5420 wrote to memory of 2608	5420	CHEATS.exe	116
PID 5420 wrote to memory of 2720	5420	CHEATS.exe	117
PID 5420 wrote to memory of 1644	5420	CHEATS.exe	122
PID 5420 wrote to memory of 4656	5420	CHEATS.exe	124
PID 2608 wrote to memory of 1844	2608	cmd.exe	127
PID 2548 wrote to memory of 2144	2548	cmd.exe	128
PID 2116 wrote to memory of 1440	2116	CMD.exe	129
PID 5420 wrote to memory of 3600	5420	CHEATS.exe	130
PID 2720 wrote to memory of 3356	2720	cmd.exe	132
PID 1644 wrote to memory of 2524	1644	cmd.exe	133
PID 4656 wrote to memory of 2600	4656	cmd.exe	134
PID 5420 wrote to memory of 5544	5420	CHEATS.exe	135
PID 2288 wrote to memory of 1788	2288	Process not Found
PID 2288 wrote to memory of 1788	2288	Process not Found
PID 2288 wrote to memory of 4176	2288	Process not Found
PID 2288 wrote to memory of 4176	2288	Process not Found

System policy modification 1 TTPs 6 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CHEATS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	CHEATS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CHEATS.exe
"C:\Users\Admin\AppData\Local\Temp\CHEATS.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5420
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\CHEATS.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\CHEATS.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4948
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4256
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\CHEATS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1600
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4448
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_9c85c6f6" /F
  2⤵
  PID:2272
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_9c85c6f6" /XML "C:\Users\Admin\AppData\Local\Temp\bbfdc18f-e487-411a-949b-2f2f5c1c7060.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 6 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 6 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SYSTEM32\sc.exe
  "sc" start TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:1648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:1060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "svchost" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "svchost"
    3⤵
    PID:1440
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_e0f4fc1a" /F
  2⤵
  PID:4084
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2144
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1844
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3356
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_e0f4fc1a" /XML "C:\Users\Admin\AppData\Local\Temp\566c2c1a-91f8-4a96-9e4a-a255101c9336.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3600
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Executes dropped EXE
  PID:5544

C:\Users\Admin\AppData\Local\Temp\CHEATS.exe
C:\Users\Admin\AppData\Local\Temp\CHEATS.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Windows\System32\BootFiles\BootExecutor.exe
C:\Windows\System32\BootFiles\BootExecutor.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\System32\BootFiles\BootExecutor.exe
"C:\Windows\System32\BootFiles\BootExecutor.exe"
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4052

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3416

C:\Windows\System32\BootFiles\BootExecutor.exe
"C:\Windows\System32\BootFiles\BootExecutor.exe"
1⤵
- Executes dropped EXE
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion