betabot | 2750d82acc17245fb3f34ceb34d12d50090626ce0bb28902dd2dcc5db924dd48

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe

Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe
Executes dropped EXE 7 IoCs

Processes:

key.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedata.datbb.exebb.exeputtty.exeereds.exe

pid process

1248 key.exe
2912 Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3584 data.dat
4092 bb.exe
744 bb.exe
2892 puttty.exe
4084 ereds.exe
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe
Loads dropped DLL 1 IoCs

Processes:

data.dat

pid process

3584 data.dat
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

pid	process
1248	key.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3584	data.dat
4092	bb.exe
744	bb.exe
2892	puttty.exe
4084	ereds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

explorer.exedata.dat

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\w5s55ko173cea3.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\w5s55ko173cea3.exe\""	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	data.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\w5s55ko173cea3.exe\""	data.dat

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

Processes:

bb.exedata.datputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exeereds.exekey.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	data.dat
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	puttty.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ereds.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	key.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe

Maps connected drives based on registry 3 TTPs 16 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

cmd.exedw20.exeputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedw20.exedata.datereds.exekey.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	data.dat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ereds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	ereds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 39 IoCs

Processes:

bb.exeexplorer.exedata.datputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exeereds.exedw20.exekey.execmd.exedw20.exe

pid	process
744	bb.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
3584	data.dat
3584	data.dat
3584	data.dat
3584	data.dat
2892	puttty.exe
2892	puttty.exe
2892	puttty.exe
2892	puttty.exe
4064	explorer.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4064	explorer.exe
4084	ereds.exe
4084	ereds.exe
4084	ereds.exe
4084	ereds.exe
4104	dw20.exe
4104	dw20.exe
4104	dw20.exe
4104	dw20.exe
1248	key.exe
1248	key.exe
1248	key.exe
1248	key.exe
2616	cmd.exe
2616	cmd.exe
2616	cmd.exe
2616	cmd.exe
4200	dw20.exe
4200	dw20.exe
4200	dw20.exe
4200	dw20.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb.exe

description pid process target process

PID 4092 set thread context of 744 4092 bb.exe bb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4092 set thread context of 744	4092	bb.exe	bb.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

bb.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

212 timeout.exe
940 timeout.exe
580 timeout.exe
2300 timeout.exe

pid	process
212	timeout.exe
940	timeout.exe
580	timeout.exe
2300	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

data.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exeexplorer.exedw20.exedw20.exe

pid	process
3584	data.dat
3584	data.dat
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4064	explorer.exe
4064	explorer.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4064	explorer.exe
4064	explorer.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4064	explorer.exe
4064	explorer.exe
2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4104	dw20.exe
4104	dw20.exe
4064	explorer.exe
4064	explorer.exe
4200	dw20.exe
4200	dw20.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe

Suspicious behavior: MapViewOfSection 13 IoCs

Processes:

bb.exeexplorer.exe

pid	process
744	bb.exe
744	bb.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe
4064	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exewmic.exebb.exeAUDIODG.EXEexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Token: SeIncreaseQuotaPrivilege	3904	wmic.exe
Token: SeSecurityPrivilege	3904	wmic.exe
Token: SeTakeOwnershipPrivilege	3904	wmic.exe
Token: SeLoadDriverPrivilege	3904	wmic.exe
Token: SeSystemProfilePrivilege	3904	wmic.exe
Token: SeSystemtimePrivilege	3904	wmic.exe
Token: SeProfSingleProcessPrivilege	3904	wmic.exe
Token: SeIncBasePriorityPrivilege	3904	wmic.exe
Token: SeCreatePagefilePrivilege	3904	wmic.exe
Token: SeBackupPrivilege	3904	wmic.exe
Token: SeRestorePrivilege	3904	wmic.exe
Token: SeShutdownPrivilege	3904	wmic.exe
Token: SeDebugPrivilege	3904	wmic.exe
Token: SeSystemEnvironmentPrivilege	3904	wmic.exe
Token: SeRemoteShutdownPrivilege	3904	wmic.exe
Token: SeUndockPrivilege	3904	wmic.exe
Token: SeManageVolumePrivilege	3904	wmic.exe
Token: 33	3904	wmic.exe
Token: 34	3904	wmic.exe
Token: 35	3904	wmic.exe
Token: 36	3904	wmic.exe
Token: SeDebugPrivilege	744	bb.exe
Token: SeRestorePrivilege	744	bb.exe
Token: SeBackupPrivilege	744	bb.exe
Token: SeLoadDriverPrivilege	744	bb.exe
Token: SeCreatePagefilePrivilege	744	bb.exe
Token: SeShutdownPrivilege	744	bb.exe
Token: SeTakeOwnershipPrivilege	744	bb.exe
Token: SeChangeNotifyPrivilege	744	bb.exe
Token: SeCreateTokenPrivilege	744	bb.exe
Token: SeMachineAccountPrivilege	744	bb.exe
Token: SeSecurityPrivilege	744	bb.exe
Token: SeAssignPrimaryTokenPrivilege	744	bb.exe
Token: SeCreateGlobalPrivilege	744	bb.exe
Token: 33	744	bb.exe
Token: 33	2260	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2260	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	3904	wmic.exe
Token: SeSecurityPrivilege	3904	wmic.exe
Token: SeTakeOwnershipPrivilege	3904	wmic.exe
Token: SeLoadDriverPrivilege	3904	wmic.exe
Token: SeSystemProfilePrivilege	3904	wmic.exe
Token: SeSystemtimePrivilege	3904	wmic.exe
Token: SeProfSingleProcessPrivilege	3904	wmic.exe
Token: SeIncBasePriorityPrivilege	3904	wmic.exe
Token: SeCreatePagefilePrivilege	3904	wmic.exe
Token: SeBackupPrivilege	3904	wmic.exe
Token: SeRestorePrivilege	3904	wmic.exe
Token: SeShutdownPrivilege	3904	wmic.exe
Token: SeDebugPrivilege	3904	wmic.exe
Token: SeSystemEnvironmentPrivilege	3904	wmic.exe
Token: SeRemoteShutdownPrivilege	3904	wmic.exe
Token: SeUndockPrivilege	3904	wmic.exe
Token: SeManageVolumePrivilege	3904	wmic.exe
Token: 33	3904	wmic.exe
Token: 34	3904	wmic.exe
Token: 35	3904	wmic.exe
Token: 36	3904	wmic.exe
Token: SeDebugPrivilege	4064	explorer.exe
Token: SeRestorePrivilege	4064	explorer.exe
Token: SeBackupPrivilege	4064	explorer.exe
Token: SeLoadDriverPrivilege	4064	explorer.exe
Token: SeCreatePagefilePrivilege	4064	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

data.dat

pid process

3584 data.dat

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.execmd.exekey.execmd.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exeexplorer.exe

description	pid	process	target process
PID 852 wrote to memory of 3832	852	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe	cmd.exe
PID 852 wrote to memory of 3832	852	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe	cmd.exe
PID 852 wrote to memory of 3832	852	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe	cmd.exe
PID 3832 wrote to memory of 1248	3832	cmd.exe	key.exe
PID 3832 wrote to memory of 1248	3832	cmd.exe	key.exe
PID 3832 wrote to memory of 1248	3832	cmd.exe	key.exe
PID 3832 wrote to memory of 212	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 212	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 212	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 2912	3832	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 3832 wrote to memory of 2912	3832	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 3832 wrote to memory of 2912	3832	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 3832 wrote to memory of 940	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 940	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 940	3832	cmd.exe	timeout.exe
PID 1248 wrote to memory of 2616	1248	key.exe	cmd.exe
PID 1248 wrote to memory of 2616	1248	key.exe	cmd.exe
PID 1248 wrote to memory of 2616	1248	key.exe	cmd.exe
PID 2616 wrote to memory of 2260	2616	cmd.exe	attrib.exe
PID 2616 wrote to memory of 2260	2616	cmd.exe	attrib.exe
PID 2616 wrote to memory of 2260	2616	cmd.exe	attrib.exe
PID 2616 wrote to memory of 2204	2616	cmd.exe	find.exe
PID 2616 wrote to memory of 2204	2616	cmd.exe	find.exe
PID 2616 wrote to memory of 2204	2616	cmd.exe	find.exe
PID 2616 wrote to memory of 3392	2616	cmd.exe	find.exe
PID 2616 wrote to memory of 3392	2616	cmd.exe	find.exe
PID 2616 wrote to memory of 3392	2616	cmd.exe	find.exe
PID 2616 wrote to memory of 3584	2616	cmd.exe	data.dat
PID 2616 wrote to memory of 3584	2616	cmd.exe	data.dat
PID 2616 wrote to memory of 3584	2616	cmd.exe	data.dat
PID 2912 wrote to memory of 3904	2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 2912 wrote to memory of 3904	2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 2912 wrote to memory of 3904	2912	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 3832 wrote to memory of 4092	3832	cmd.exe	bb.exe
PID 3832 wrote to memory of 4092	3832	cmd.exe	bb.exe
PID 3832 wrote to memory of 4092	3832	cmd.exe	bb.exe
PID 3832 wrote to memory of 580	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 580	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 580	3832	cmd.exe	timeout.exe
PID 4092 wrote to memory of 744	4092	bb.exe	bb.exe
PID 4092 wrote to memory of 744	4092	bb.exe	bb.exe
PID 4092 wrote to memory of 744	4092	bb.exe	bb.exe
PID 4092 wrote to memory of 744	4092	bb.exe	bb.exe
PID 4092 wrote to memory of 744	4092	bb.exe	bb.exe
PID 744 wrote to memory of 4064	744	bb.exe	explorer.exe
PID 744 wrote to memory of 4064	744	bb.exe	explorer.exe
PID 744 wrote to memory of 4064	744	bb.exe	explorer.exe
PID 3832 wrote to memory of 2892	3832	cmd.exe	puttty.exe
PID 3832 wrote to memory of 2892	3832	cmd.exe	puttty.exe
PID 3832 wrote to memory of 2892	3832	cmd.exe	puttty.exe
PID 3832 wrote to memory of 2300	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 2300	3832	cmd.exe	timeout.exe
PID 3832 wrote to memory of 2300	3832	cmd.exe	timeout.exe
PID 4064 wrote to memory of 852	4064	explorer.exe	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe
PID 4064 wrote to memory of 852	4064	explorer.exe	1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe
PID 4064 wrote to memory of 3832	4064	explorer.exe	cmd.exe
PID 4064 wrote to memory of 3832	4064	explorer.exe	cmd.exe
PID 4064 wrote to memory of 1248	4064	explorer.exe	key.exe
PID 4064 wrote to memory of 1248	4064	explorer.exe	key.exe
PID 4064 wrote to memory of 2912	4064	explorer.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 4064 wrote to memory of 2912	4064	explorer.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 4064 wrote to memory of 2616	4064	explorer.exe	cmd.exe
PID 4064 wrote to memory of 2616	4064	explorer.exe	cmd.exe
PID 4064 wrote to memory of 3584	4064	explorer.exe	data.dat

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2260 attrib.exe

pid	process
2260	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe
"C:\Users\Admin\AppData\Local\Temp\1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\95FC.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3832

C:\Users\Admin\AppData\Local\Temp\95FC.tmp\key.exe
key.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t8885.bat" "C:\Users\Admin\AppData\Local\Temp\95FC.tmp\key.exe" "
4⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
5⤵
- Views/modifies file attributes
PID:2260

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
5⤵
PID:2204

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
5⤵
PID:3392

C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3584

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1
3⤵
- Delays execution with timeout.exe
PID:212

C:\Users\Admin\AppData\Local\Temp\95FC.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get Caption /format:list
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2
3⤵
- Delays execution with timeout.exe
PID:940

C:\Users\Admin\AppData\Local\Temp\95FC.tmp\bb.exe
bb.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092

C:\Users\Admin\AppData\Local\Temp\95FC.tmp\bb.exe
"C:\Users\Admin\AppData\Local\Temp\95FC.tmp\bb.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3
3⤵
- Delays execution with timeout.exe
PID:580

C:\Users\Admin\AppData\Local\Temp\95FC.tmp\puttty.exe
puttty.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2892

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1428
4⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4104

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 4
3⤵
- Delays execution with timeout.exe
PID:2300

C:\Users\Admin\AppData\Local\Temp\95FC.tmp\ereds.exe
ereds.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4084

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1256
4⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery