betabot | 2750d82acc17245fb3f34ceb34d12d50090626ce0bb28902dd2dcc5db924dd48

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe

Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe
Executes dropped EXE 7 IoCs

Processes:

key.exedata.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exeputtty.exeereds.exe

pid process

1560 key.exe
780 data.dat
1068 Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1724 bb.exe
316 bb.exe
1776 puttty.exe
1152 ereds.exe
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

pid	process
1560	key.exe
780	data.dat
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1724	bb.exe
316	bb.exe
1776	puttty.exe
1152	ereds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Loads dropped DLL 14 IoCs

Processes:

cmd.execmd.exedata.datbb.exedw20.exedw20.exe

pid	process
1244	cmd.exe
1004	cmd.exe
1244	cmd.exe
1244	cmd.exe
780	data.dat
1244	cmd.exe
1244	cmd.exe
1724	bb.exe
1244	cmd.exe
1244	cmd.exe
1244	cmd.exe
1244	cmd.exe
1700	dw20.exe
1604	dw20.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

explorer.exedata.dat

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\7wmi1gyquw39c1.exe\""	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	data.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\7wmi1gyquw39c1.exe\""	data.dat
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\7wmi1gyquw39c1.exe"	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

Processes:

key.exebb.exedata.datputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exeereds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	key.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	data.dat
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	puttty.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ereds.exe

Maps connected drives based on registry 3 TTPs 14 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

data.datereds.exekey.exeputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedw20.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	data.dat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	ereds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	puttty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ereds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

Processes:

bb.exeexplorer.exedata.datputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exeereds.exedw20.exekey.exedw20.exe

pid	process
316	bb.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
780	data.dat
780	data.dat
780	data.dat
780	data.dat
1776	puttty.exe
1776	puttty.exe
1776	puttty.exe
1776	puttty.exe
324	explorer.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1152	ereds.exe
1152	ereds.exe
1152	ereds.exe
1152	ereds.exe
1700	dw20.exe
1700	dw20.exe
1700	dw20.exe
1700	dw20.exe
1560	key.exe
1560	key.exe
1560	key.exe
1560	key.exe
1604	dw20.exe
1604	dw20.exe
1604	dw20.exe
1604	dw20.exe
324	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb.exe

description pid process target process

PID 1724 set thread context of 316 1724 bb.exe bb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1724 set thread context of 316	1724	bb.exe	bb.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorer.exebb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

1576 timeout.exe
1952 timeout.exe
1296 timeout.exe
1872 timeout.exe

pid	process
1576	timeout.exe
1952	timeout.exe
1296	timeout.exe
1872	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

Processes:

data.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exeexplorer.exe

pid	process
780	data.dat
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
324	explorer.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
324	explorer.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
324	explorer.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

dw20.exedw20.exe

pid process

1700 dw20.exe
1604 dw20.exe

pid	process
1700	dw20.exe
1604	dw20.exe

Suspicious behavior: MapViewOfSection 17 IoCs

Processes:

bb.exeexplorer.exeputtty.exeereds.exe

pid	process
316	bb.exe
316	bb.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
324	explorer.exe
1776	puttty.exe
1152	ereds.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exewmic.exeAUDIODG.EXEbb.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Token: SeIncreaseQuotaPrivilege	888	wmic.exe
Token: SeSecurityPrivilege	888	wmic.exe
Token: SeTakeOwnershipPrivilege	888	wmic.exe
Token: SeLoadDriverPrivilege	888	wmic.exe
Token: SeSystemProfilePrivilege	888	wmic.exe
Token: SeSystemtimePrivilege	888	wmic.exe
Token: SeProfSingleProcessPrivilege	888	wmic.exe
Token: SeIncBasePriorityPrivilege	888	wmic.exe
Token: SeCreatePagefilePrivilege	888	wmic.exe
Token: SeBackupPrivilege	888	wmic.exe
Token: SeRestorePrivilege	888	wmic.exe
Token: SeShutdownPrivilege	888	wmic.exe
Token: SeDebugPrivilege	888	wmic.exe
Token: SeSystemEnvironmentPrivilege	888	wmic.exe
Token: SeRemoteShutdownPrivilege	888	wmic.exe
Token: SeUndockPrivilege	888	wmic.exe
Token: SeManageVolumePrivilege	888	wmic.exe
Token: 33	888	wmic.exe
Token: 34	888	wmic.exe
Token: 35	888	wmic.exe
Token: 33	1876	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1876	AUDIODG.EXE
Token: 33	1876	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1876	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	888	wmic.exe
Token: SeSecurityPrivilege	888	wmic.exe
Token: SeTakeOwnershipPrivilege	888	wmic.exe
Token: SeLoadDriverPrivilege	888	wmic.exe
Token: SeSystemProfilePrivilege	888	wmic.exe
Token: SeSystemtimePrivilege	888	wmic.exe
Token: SeProfSingleProcessPrivilege	888	wmic.exe
Token: SeIncBasePriorityPrivilege	888	wmic.exe
Token: SeCreatePagefilePrivilege	888	wmic.exe
Token: SeBackupPrivilege	888	wmic.exe
Token: SeRestorePrivilege	888	wmic.exe
Token: SeShutdownPrivilege	888	wmic.exe
Token: SeDebugPrivilege	888	wmic.exe
Token: SeSystemEnvironmentPrivilege	888	wmic.exe
Token: SeRemoteShutdownPrivilege	888	wmic.exe
Token: SeUndockPrivilege	888	wmic.exe
Token: SeManageVolumePrivilege	888	wmic.exe
Token: 33	888	wmic.exe
Token: 34	888	wmic.exe
Token: 35	888	wmic.exe
Token: SeDebugPrivilege	316	bb.exe
Token: SeRestorePrivilege	316	bb.exe
Token: SeBackupPrivilege	316	bb.exe
Token: SeLoadDriverPrivilege	316	bb.exe
Token: SeCreatePagefilePrivilege	316	bb.exe
Token: SeShutdownPrivilege	316	bb.exe
Token: SeTakeOwnershipPrivilege	316	bb.exe
Token: SeChangeNotifyPrivilege	316	bb.exe
Token: SeCreateTokenPrivilege	316	bb.exe
Token: SeMachineAccountPrivilege	316	bb.exe
Token: SeSecurityPrivilege	316	bb.exe
Token: SeAssignPrimaryTokenPrivilege	316	bb.exe
Token: SeCreateGlobalPrivilege	316	bb.exe
Token: 33	316	bb.exe
Token: SeDebugPrivilege	324	explorer.exe
Token: SeRestorePrivilege	324	explorer.exe
Token: SeBackupPrivilege	324	explorer.exe
Token: SeLoadDriverPrivilege	324	explorer.exe
Token: SeCreatePagefilePrivilege	324	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

data.dat

pid process

780 data.dat

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.execmd.exekey.execmd.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exe

description	pid	process	target process
PID 520 wrote to memory of 1244	520	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe	cmd.exe
PID 520 wrote to memory of 1244	520	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe	cmd.exe
PID 520 wrote to memory of 1244	520	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe	cmd.exe
PID 520 wrote to memory of 1244	520	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe	cmd.exe
PID 1244 wrote to memory of 1560	1244	cmd.exe	key.exe
PID 1244 wrote to memory of 1560	1244	cmd.exe	key.exe
PID 1244 wrote to memory of 1560	1244	cmd.exe	key.exe
PID 1244 wrote to memory of 1560	1244	cmd.exe	key.exe
PID 1244 wrote to memory of 1576	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1576	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1576	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1576	1244	cmd.exe	timeout.exe
PID 1560 wrote to memory of 1004	1560	key.exe	cmd.exe
PID 1560 wrote to memory of 1004	1560	key.exe	cmd.exe
PID 1560 wrote to memory of 1004	1560	key.exe	cmd.exe
PID 1560 wrote to memory of 1004	1560	key.exe	cmd.exe
PID 1004 wrote to memory of 796	1004	cmd.exe	attrib.exe
PID 1004 wrote to memory of 796	1004	cmd.exe	attrib.exe
PID 1004 wrote to memory of 796	1004	cmd.exe	attrib.exe
PID 1004 wrote to memory of 796	1004	cmd.exe	attrib.exe
PID 1004 wrote to memory of 240	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 240	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 240	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 240	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 324	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 324	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 324	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 324	1004	cmd.exe	find.exe
PID 1004 wrote to memory of 780	1004	cmd.exe	data.dat
PID 1004 wrote to memory of 780	1004	cmd.exe	data.dat
PID 1004 wrote to memory of 780	1004	cmd.exe	data.dat
PID 1004 wrote to memory of 780	1004	cmd.exe	data.dat
PID 1244 wrote to memory of 1068	1244	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1244 wrote to memory of 1068	1244	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1244 wrote to memory of 1068	1244	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1244 wrote to memory of 1068	1244	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1244 wrote to memory of 1952	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1952	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1952	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1952	1244	cmd.exe	timeout.exe
PID 1068 wrote to memory of 888	1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1068 wrote to memory of 888	1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1068 wrote to memory of 888	1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1068 wrote to memory of 888	1068	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1244 wrote to memory of 1724	1244	cmd.exe	bb.exe
PID 1244 wrote to memory of 1724	1244	cmd.exe	bb.exe
PID 1244 wrote to memory of 1724	1244	cmd.exe	bb.exe
PID 1244 wrote to memory of 1724	1244	cmd.exe	bb.exe
PID 1244 wrote to memory of 1296	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1296	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1296	1244	cmd.exe	timeout.exe
PID 1244 wrote to memory of 1296	1244	cmd.exe	timeout.exe
PID 1724 wrote to memory of 316	1724	bb.exe	bb.exe
PID 1724 wrote to memory of 316	1724	bb.exe	bb.exe
PID 1724 wrote to memory of 316	1724	bb.exe	bb.exe
PID 1724 wrote to memory of 316	1724	bb.exe	bb.exe
PID 1724 wrote to memory of 316	1724	bb.exe	bb.exe
PID 1724 wrote to memory of 316	1724	bb.exe	bb.exe
PID 316 wrote to memory of 324	316	bb.exe	explorer.exe
PID 316 wrote to memory of 324	316	bb.exe	explorer.exe
PID 316 wrote to memory of 324	316	bb.exe	explorer.exe
PID 316 wrote to memory of 324	316	bb.exe	explorer.exe
PID 316 wrote to memory of 324	316	bb.exe	explorer.exe
PID 316 wrote to memory of 324	316	bb.exe	explorer.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

796 attrib.exe

pid	process
796	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe
"C:\Users\Admin\AppData\Local\Temp\1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\624C.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\624C.tmp\key.exe
key.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t12667.bat" "C:\Users\Admin\AppData\Local\Temp\624C.tmp\key.exe" "
5⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
6⤵
- Views/modifies file attributes
PID:796

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
6⤵
PID:240

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
6⤵
PID:324

C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:780

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1
4⤵
- Delays execution with timeout.exe
PID:1576

C:\Users\Admin\AppData\Local\Temp\624C.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get Caption /format:list
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2
4⤵
- Delays execution with timeout.exe
PID:1952

C:\Users\Admin\AppData\Local\Temp\624C.tmp\bb.exe
bb.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\624C.tmp\bb.exe
"C:\Users\Admin\AppData\Local\Temp\624C.tmp\bb.exe"
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
6⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:324

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3
4⤵
- Delays execution with timeout.exe
PID:1296

C:\Users\Admin\AppData\Local\Temp\624C.tmp\puttty.exe
puttty.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1072
5⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:1700

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 4
4⤵
- Delays execution with timeout.exe
PID:1872

C:\Users\Admin\AppData\Local\Temp\624C.tmp\ereds.exe
ereds.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1152

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 852
5⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:1604

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11098641073790893561013574446-5836042-1470728442108660730915304296341759808603"
1⤵
PID:1312

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1636854565373510870-1965922754-557489954120530030018711853661765826816-1756970573"
1⤵
PID:1572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x570
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery