a2afda47f4169023bca3c730a48e58d6c40e84236b959a871e883ded3304d5fb

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

AECOM General Presentation.exeAECOM General Presentation.exeiexplore.exe

description	pid	process	target process
PID 240 set thread context of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 1780 set thread context of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1396 set thread context of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 set thread context of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 set thread context of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 set thread context of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 set thread context of 1592	1396	iexplore.exe	iexplore.exe
PID 1396 set thread context of 1656	1396	iexplore.exe	iexplore.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1128-16-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1128-18-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1128-19-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1592-29-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1592-31-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1592-32-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

AECOM General Presentation.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	AECOM General Presentation.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AECOM General Presentation.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	AECOM General Presentation.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	AECOM General Presentation.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AECOM General Presentation.exe

pid process

1780 AECOM General Presentation.exe
1780 AECOM General Presentation.exe

pid	process
1780	AECOM General Presentation.exe
1780	AECOM General Presentation.exe

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

Processes:

AECOM General Presentation.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AECOM General Presentation.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AECOM General Presentation.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

AECOM General Presentation.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AECOM General Presentation.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 79 IoCs

Processes:

AECOM General Presentation.exeAECOM General Presentation.exeiexplore.exe

description	pid	process	target process
PID 240 wrote to memory of 1696	240	AECOM General Presentation.exe	schtasks.exe
PID 240 wrote to memory of 1696	240	AECOM General Presentation.exe	schtasks.exe
PID 240 wrote to memory of 1696	240	AECOM General Presentation.exe	schtasks.exe
PID 240 wrote to memory of 1696	240	AECOM General Presentation.exe	schtasks.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 240 wrote to memory of 1780	240	AECOM General Presentation.exe	AECOM General Presentation.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1780 wrote to memory of 1396	1780	AECOM General Presentation.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1128	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1948	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1828	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1748	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1592	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1592	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1592	1396	iexplore.exe	iexplore.exe
PID 1396 wrote to memory of 1592	1396	iexplore.exe	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AECOM General Presentation.exeiexplore.exe

pid process

1780 AECOM General Presentation.exe
1396 iexplore.exe

pid	process
1780	AECOM General Presentation.exe
1396	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

AECOM General Presentation.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AECOM General Presentation.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

AECOM General Presentation.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions AECOM General Presentation.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1696 schtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	AECOM General Presentation.exe

pid	process
1696	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\AECOM General Presentation.exe
"C:\Users\Admin\AppData\Local\Temp\AECOM General Presentation.exe"
1⤵
- Looks for VMWare Tools registry key
- Suspicious use of SetThreadContext
- Maps connected drives based on registry
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
- Looks for VirtualBox Guest Additions in registry
PID:240

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GRTVcNltimCq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F98.tmp"
2⤵
- Creates scheduled task(s)
PID:1696

C:\Users\Admin\AppData\Local\Temp\AECOM General Presentation.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Windows security bypass
- Suspicious behavior: EnumeratesProcesses
- UAC bypass
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:1780

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\AECOM General Presentation.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious use of SetThreadContext
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\xclynmsdd0.txt"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\xclynmsdd1.txt"
4⤵
PID:1948

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\xclynmsdd1.txt"
4⤵
PID:1828

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\xclynmsdd2.txt"
4⤵
PID:1748

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\xclynmsdd3.txt"
4⤵
PID:1592

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\xclynmsdd4.txt"
4⤵
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

2

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

4

Disabling Security Tools

2

T1089

Bypass User Account Control

T1088

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

4

T1012

System Information Discovery

5

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System