Analysis
-
max time kernel
140s -
max time network
151s -
resource
win10v191014
Task
task1
Sample
3.bin.exe
Resource
win7v191014
0 signatures
General
-
Target
3.bin
-
Sample
191111-sbsq7xbqea
-
SHA256
357b4979324e2065adc8e6bd11cd7161f830250cae30f50fb13edd70fd2b506b
Score
N/A
Malware Config
Extracted
Family
qakbot
Campaign
1573123220
C2
206.51.202.106:50003
173.3.132.17:995
75.131.72.82:443
68.238.144.55:443
100.4.185.8:443
5.182.39.156:443
24.201.68.105:2078
23.240.185.215:443
69.92.54.95:995
68.131.9.203:443
187.163.139.200:993
75.81.25.223:995
32.208.1.239:443
170.10.78.48:443
74.194.4.181:443
81.147.42.195:2222
71.30.56.170:443
174.16.234.171:993
66.214.75.176:443
47.153.115.154:443
75.175.209.163:995
72.213.98.233:443
173.22.120.11:2222
68.238.56.27:443
184.180.157.203:2222
24.203.64.26:2222
47.153.115.154:995
64.19.74.29:995
104.32.185.213:2222
104.3.91.20:995
107.12.140.181:443
67.5.33.229:2078
67.10.18.112:993
80.14.209.42:2222
184.74.101.234:995
172.78.45.13:995
181.14.188.8:443
106.51.0.228:443
67.246.16.250:995
75.110.250.89:443
50.78.93.74:995
104.175.193.24:443
209.182.122.217:443
47.23.101.26:993
12.5.37.3:995
24.30.71.200:443
72.29.181.77:2078
90.43.6.185:2222
81.149.189.61:8443
5.89.115.73:2222
71.93.60.90:443
72.46.151.196:995
105.246.77.129:995
50.246.229.50:443
65.16.241.150:443
197.86.194.53:995
75.142.59.167:443
107.12.131.249:443
70.74.159.126:2222
75.130.117.134:443
47.202.98.230:443
47.214.144.253:443
196.194.28.127:2222
182.56.87.205:995
2.50.41.185:443
217.162.149.212:443
76.116.128.81:443
107.184.252.92:443
69.170.237.82:995
75.110.90.155:443
166.62.180.194:2078
62.103.70.217:995
108.45.183.59:443
67.87.38.242:2222
117.223.144.228:995
47.153.115.154:443
186.47.208.238:50000
108.5.34.128:443
67.77.162.13:443
65.30.12.240:443
76.80.66.226:443
111.125.70.30:2222
181.197.195.138:995
173.29.144.30:443
174.130.203.235:443
162.244.224.166:443
104.34.122.18:443
199.126.92.231:995
173.178.129.3:990
12.176.32.146:443
93.177.144.236:443
108.227.161.27:443
72.16.212.107:995
205.250.79.62:443
201.152.218.64:995
200.104.249.67:443
123.252.128.47:443
73.226.220.56:443
181.126.80.118:443
88.200.217.162:21
108.160.123.244:443
67.214.201.117:2222
173.247.186.90:443
50.247.230.33:443
75.165.181.122:443
68.174.15.223:443
96.59.11.86:443
71.77.231.251:443
24.184.6.58:2222
174.131.181.120:995
207.162.184.228:443
173.178.129.3:443
47.23.101.26:465
12.5.37.3:443
206.51.202.106:50002
75.131.72.82:995
172.251.77.230:443
174.48.72.160:443
2.177.101.143:443
70.120.151.69:443
47.146.169.85:443
24.93.168.38:443
75.70.218.193:443
162.244.225.30:443
168.245.228.71:443
72.29.181.77:2083
112.171.126.153:443
75.131.72.82:2087
96.35.170.82:2222
24.27.82.216:2222
2.50.170.151:443
73.202.121.222:0
98.155.154.220:443
98.148.177.77:443
24.180.7.155:443
47.155.19.205:443
67.160.63.127:443
201.188.17.26:443
75.165.132.69:443
24.182.53.191:443
137.25.72.175:443
116.58.100.130:443
73.37.61.237:443
76.169.19.193:443
203.83.20.209:995
76.174.122.204:443
83.79.2.218:2222
71.90.241.69:443
66.51.231.183:443
45.37.57.119:2222
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
3.bin.exe3.bin.exeijsethyt.exeijsethyt.exeexplorer.exe3.bin.exeijsethyt.exeijsethyt.exepid process 4932 3.bin.exe 4976 3.bin.exe 68 ijsethyt.exe 988 ijsethyt.exe 2916 explorer.exe 4676 3.bin.exe 4824 ijsethyt.exe 3244 ijsethyt.exe -
Checks SCSI registry key(s) (likely anti-VM) 3 TTPs 18 IoCs
Processes:
3.bin.exeijsethyt.exeijsethyt.exedescription ioc pid process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 4976 3.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc 4976 3.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service 4976 3.bin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 4976 3.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc 4976 3.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service 4976 3.bin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 988 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc 988 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service 988 ijsethyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 988 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc 988 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service 988 ijsethyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 3244 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc 3244 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service 3244 ijsethyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 3244 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc 3244 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service 3244 ijsethyt.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ijsethyt.exepid process 68 ijsethyt.exe -
Processes:
reg.exedescription ioc pid process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr = "0" 4884 reg.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc pid process Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Windows\CurrentVersion\Run\swqoz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Onjpsefhpr\\ijsethyt.exe\"" 2916 explorer.exe -
Executes dropped EXE 4 IoCs
Processes:
ijsethyt.exeijsethyt.exeijsethyt.exeijsethyt.exepid process 68 ijsethyt.exe 988 ijsethyt.exe 4824 ijsethyt.exe 3244 ijsethyt.exe -
Uses Task Scheduler COM API 1 TTPs 14 IoCs
Processes:
schtasks.exedescription ioc pid process Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 4928 schtasks.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd} 4928 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs 4928 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ 4928 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 4928 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32\InprocServer32 4928 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32\ 4928 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32\ThreadingModel 4928 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 4928 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler 4928 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 4928 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\AppID 4928 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer 4928 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation 4928 schtasks.exe -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc pid process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 2036 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 2036 svchost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3.bin.exeSppExtComObj.exeijsethyt.exe3.bin.exeijsethyt.exedescription pid process target process PID 4932 wrote to memory of 4976 4932 3.bin.exe 3.bin.exe PID 5088 wrote to memory of 5116 5088 SppExtComObj.exe SLUI.exe PID 4932 wrote to memory of 68 4932 3.bin.exe ijsethyt.exe PID 4932 wrote to memory of 1676 4932 3.bin.exe schtasks.exe PID 68 wrote to memory of 988 68 ijsethyt.exe ijsethyt.exe PID 68 wrote to memory of 2916 68 ijsethyt.exe explorer.exe PID 4676 wrote to memory of 3804 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 4280 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 4240 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 3736 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 4244 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 3692 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 3740 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 4844 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 4884 4676 3.bin.exe reg.exe PID 4676 wrote to memory of 4824 4676 3.bin.exe ijsethyt.exe PID 4676 wrote to memory of 1188 4676 3.bin.exe cmd.exe PID 4676 wrote to memory of 4928 4676 3.bin.exe schtasks.exe PID 4824 wrote to memory of 3244 4824 ijsethyt.exe ijsethyt.exe -
Qakbot persistence 1 IoCs
Processes:
explorer.exedescription ioc pid process Event created 2ijsethyt2916 2916 explorer.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exesvchost.exedescription ioc pid process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" 3804 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" 4280 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 4244 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 3692 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 3740 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 4844 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 436 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 436 svchost.exe -
Drops file in system dir 5 IoCs
Processes:
svchost.exedescription ioc pid process File opened for modification C:\Windows\Debug\ESE.TXT 4448 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4448 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4448 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4448 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4448 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.bin.exe"C:\Users\Admin\AppData\Local\Temp\3.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932
-
C:\Users\Admin\AppData\Local\Temp\3.bin.exeC:\Users\Admin\AppData\Local\Temp\3.bin.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Checks SCSI registry key(s) (likely anti-VM)
PID:4976
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:5088
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:5116
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:68
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dpjequf /tr "\"C:\Users\Admin\AppData\Local\Temp\3.bin.exe\" /I dpjequf" /SC ONCE /Z /ST 11:28 /ET 11:401⤵PID:1676
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Checks SCSI registry key(s) (likely anti-VM)
- Executes dropped EXE
PID:988
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Qakbot persistence
PID:2916
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in system dir
PID:4448
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\3.bin.exeC:\Users\Admin\AppData\Local\Temp\3.bin.exe /I dpjequf1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:3804
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:4280
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵PID:4240
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵PID:3736
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:4244
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:3692
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:3740
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:4844
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr" /d "0"1⤵
- Windows security bypass
PID:4884
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\3.bin.exe"1⤵PID:1188
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN dpjequf1⤵
- Uses Task Scheduler COM API
PID:4928
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.11⤵
- Runs ping.exe
PID:3596
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:2036
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:1476
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Checks SCSI registry key(s) (likely anti-VM)
- Executes dropped EXE
PID:3244
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:436
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1089
- T1060