Newage.exe Color.exe Levantaito.exe NCRApp.exe sdelete.exe Promo.exe WinMonitor.exe WinMonitorCheck.exe Anydesk1.exe Identified MD5s: 2C2D16658D8DA6B389934273EF8F8E22 5F177B84F3D92AB5711BE446125FDBE3 61EECEB5F9186A0BC01DC82798CD6C5F FDA82030AE92313E94B9339EA1FC107C C04A7CB926CCBF829D0A36A91EBF91BD Associated Files and Scripts: C.dat Restaurar.bat Restauraropteva.bat Logcontrol.txt Logc.txt Borrar_beta.txt "New directories, including, but not limited to, the following" Anydesk1.exe Anydesk1.exe C:\\exe\p C:\Users\SSAuto1\AppData\Local\P\ "Remote connection applications, such as TeamViewer or AnyDesk, if unauthorized; or application logs showing connections from unexpected IP addresses" Abnormal autoruns: HKLM\Software\Microsoft\Windows\CurrentVersion\Run HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit Custom services: Custom service entries under: HKLM\SYSTEM\CurrentControlSet\Services\ Services pointing to non-standard install paths Services running under SYSTEM without vendor signature Services running with generic or deceptive names: ATM Service Dispenser Service DIEBOLDP IP addresses. USB insertion events: Event ID 2003 - "May appear with the insertion of USB storage device, or peripheral" Event ID 6416 - "The Security log records the detection of a newly connected external device when external storage auditing is enabled. This event can indicate the attachment of removable media such as USB storage devices, but does not confirm file access or execution" Event ID 4663 - "The Security log may record file access or modification activity involving removable media, provided object access auditing is enabled and appropriate system access control lists (SACLs) are configured on the target files or directories" Detection of: USB keyboards USB hubs Flash drives Physical Indicators ATM door open alerts outside of planned maintenance schedule Low/No cash indicators outside of expected use schedule Unauthorized devices plugged into the ATM Removal of hard drives from ATMs ATM unexpectedly out of service