betabot | 2750d82acc17245fb3f34ceb34d12d50090626ce0bb28902dd2dcc5db924dd48

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe

Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe
Executes dropped EXE 7 IoCs

Processes:

key.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedata.datbb.exebb.exeputtty.exeereds.exe

pid process

2600 key.exe
3480 Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3428 data.dat
3088 bb.exe
1272 bb.exe
2120 puttty.exe
4200 ereds.exe
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe
Loads dropped DLL 1 IoCs

Processes:

data.dat

pid process

3428 data.dat
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

pid	process
2600	key.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3428	data.dat
3088	bb.exe
1272	bb.exe
2120	puttty.exe
4200	ereds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

data.datexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	data.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\73951kqs1.exe\""	data.dat
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\73951kqs1.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\73951kqs1.exe\""	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

Processes:

key.execmd.exeereds.exebb.exedata.datputtty.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	key.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ereds.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	data.dat
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	puttty.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe

Maps connected drives based on registry 3 TTPs 14 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

data.datputtty.execmd.exeereds.exedw20.exekey.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	puttty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	ereds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ereds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	data.dat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	puttty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

Processes:

bb.exeexplorer.exedata.datputtty.exedw20.exekey.execmd.exeereds.exedw20.exe

pid	process
1272	bb.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3428	data.dat
3428	data.dat
3428	data.dat
3428	data.dat
2120	puttty.exe
2120	puttty.exe
2120	puttty.exe
2120	puttty.exe
3148	explorer.exe
3148	explorer.exe
4292	dw20.exe
4292	dw20.exe
4292	dw20.exe
4292	dw20.exe
2600	key.exe
2600	key.exe
2600	key.exe
2600	key.exe
184	cmd.exe
184	cmd.exe
184	cmd.exe
184	cmd.exe
4200	ereds.exe
4200	ereds.exe
4200	ereds.exe
4200	ereds.exe
4564	dw20.exe
4564	dw20.exe
4564	dw20.exe
4564	dw20.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb.exe

description pid process target process

PID 3088 set thread context of 1272 3088 bb.exe bb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 3088 set thread context of 1272	3088	bb.exe	bb.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

bb.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

3568 timeout.exe
2156 timeout.exe
2692 timeout.exe
2976 timeout.exe

pid	process
3568	timeout.exe
2156	timeout.exe
2692	timeout.exe
2976	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

data.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exeexplorer.exedw20.exedw20.exe

pid	process
3428	data.dat
3428	data.dat
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3148	explorer.exe
3148	explorer.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3148	explorer.exe
3148	explorer.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4292	dw20.exe
4292	dw20.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3148	explorer.exe
3148	explorer.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
4564	dw20.exe
4564	dw20.exe
3148	explorer.exe
3148	explorer.exe

Suspicious behavior: MapViewOfSection 13 IoCs

Processes:

bb.exeexplorer.exe

pid	process
1272	bb.exe
1272	bb.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe
3148	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exewmic.exebb.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Token: SeIncreaseQuotaPrivilege	3828	wmic.exe
Token: SeSecurityPrivilege	3828	wmic.exe
Token: SeTakeOwnershipPrivilege	3828	wmic.exe
Token: SeLoadDriverPrivilege	3828	wmic.exe
Token: SeSystemProfilePrivilege	3828	wmic.exe
Token: SeSystemtimePrivilege	3828	wmic.exe
Token: SeProfSingleProcessPrivilege	3828	wmic.exe
Token: SeIncBasePriorityPrivilege	3828	wmic.exe
Token: SeCreatePagefilePrivilege	3828	wmic.exe
Token: SeBackupPrivilege	3828	wmic.exe
Token: SeRestorePrivilege	3828	wmic.exe
Token: SeShutdownPrivilege	3828	wmic.exe
Token: SeDebugPrivilege	3828	wmic.exe
Token: SeSystemEnvironmentPrivilege	3828	wmic.exe
Token: SeRemoteShutdownPrivilege	3828	wmic.exe
Token: SeUndockPrivilege	3828	wmic.exe
Token: SeManageVolumePrivilege	3828	wmic.exe
Token: 33	3828	wmic.exe
Token: 34	3828	wmic.exe
Token: 35	3828	wmic.exe
Token: 36	3828	wmic.exe
Token: SeIncreaseQuotaPrivilege	3828	wmic.exe
Token: SeSecurityPrivilege	3828	wmic.exe
Token: SeTakeOwnershipPrivilege	3828	wmic.exe
Token: SeLoadDriverPrivilege	3828	wmic.exe
Token: SeSystemProfilePrivilege	3828	wmic.exe
Token: SeSystemtimePrivilege	3828	wmic.exe
Token: SeProfSingleProcessPrivilege	3828	wmic.exe
Token: SeIncBasePriorityPrivilege	3828	wmic.exe
Token: SeCreatePagefilePrivilege	3828	wmic.exe
Token: SeBackupPrivilege	3828	wmic.exe
Token: SeRestorePrivilege	3828	wmic.exe
Token: SeShutdownPrivilege	3828	wmic.exe
Token: SeDebugPrivilege	3828	wmic.exe
Token: SeSystemEnvironmentPrivilege	3828	wmic.exe
Token: SeRemoteShutdownPrivilege	3828	wmic.exe
Token: SeUndockPrivilege	3828	wmic.exe
Token: SeManageVolumePrivilege	3828	wmic.exe
Token: 33	3828	wmic.exe
Token: 34	3828	wmic.exe
Token: 35	3828	wmic.exe
Token: 36	3828	wmic.exe
Token: SeDebugPrivilege	1272	bb.exe
Token: SeRestorePrivilege	1272	bb.exe
Token: SeBackupPrivilege	1272	bb.exe
Token: SeLoadDriverPrivilege	1272	bb.exe
Token: SeCreatePagefilePrivilege	1272	bb.exe
Token: SeShutdownPrivilege	1272	bb.exe
Token: SeTakeOwnershipPrivilege	1272	bb.exe
Token: SeChangeNotifyPrivilege	1272	bb.exe
Token: SeCreateTokenPrivilege	1272	bb.exe
Token: SeMachineAccountPrivilege	1272	bb.exe
Token: SeSecurityPrivilege	1272	bb.exe
Token: SeAssignPrimaryTokenPrivilege	1272	bb.exe
Token: SeCreateGlobalPrivilege	1272	bb.exe
Token: 33	1272	bb.exe
Token: SeDebugPrivilege	3148	explorer.exe
Token: SeRestorePrivilege	3148	explorer.exe
Token: SeBackupPrivilege	3148	explorer.exe
Token: SeLoadDriverPrivilege	3148	explorer.exe
Token: SeCreatePagefilePrivilege	3148	explorer.exe
Token: SeShutdownPrivilege	3148	explorer.exe
Token: SeTakeOwnershipPrivilege	3148	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

data.dat

pid process

3428 data.dat

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.execmd.exekey.execmd.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exeexplorer.exe

description	pid	process	target process
PID 4044 wrote to memory of 1700	4044	3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe	cmd.exe
PID 4044 wrote to memory of 1700	4044	3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe	cmd.exe
PID 4044 wrote to memory of 1700	4044	3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe	cmd.exe
PID 1700 wrote to memory of 2600	1700	cmd.exe	key.exe
PID 1700 wrote to memory of 2600	1700	cmd.exe	key.exe
PID 1700 wrote to memory of 2600	1700	cmd.exe	key.exe
PID 1700 wrote to memory of 2692	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 2692	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 2692	1700	cmd.exe	timeout.exe
PID 2600 wrote to memory of 184	2600	key.exe	cmd.exe
PID 2600 wrote to memory of 184	2600	key.exe	cmd.exe
PID 2600 wrote to memory of 184	2600	key.exe	cmd.exe
PID 184 wrote to memory of 1276	184	cmd.exe	attrib.exe
PID 184 wrote to memory of 1276	184	cmd.exe	attrib.exe
PID 184 wrote to memory of 1276	184	cmd.exe	attrib.exe
PID 184 wrote to memory of 1840	184	cmd.exe	find.exe
PID 184 wrote to memory of 1840	184	cmd.exe	find.exe
PID 184 wrote to memory of 1840	184	cmd.exe	find.exe
PID 184 wrote to memory of 3720	184	cmd.exe	find.exe
PID 184 wrote to memory of 3720	184	cmd.exe	find.exe
PID 184 wrote to memory of 3720	184	cmd.exe	find.exe
PID 1700 wrote to memory of 3480	1700	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1700 wrote to memory of 3480	1700	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1700 wrote to memory of 3480	1700	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 184 wrote to memory of 3428	184	cmd.exe	data.dat
PID 184 wrote to memory of 3428	184	cmd.exe	data.dat
PID 184 wrote to memory of 3428	184	cmd.exe	data.dat
PID 1700 wrote to memory of 2976	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 2976	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 2976	1700	cmd.exe	timeout.exe
PID 3480 wrote to memory of 3828	3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 3480 wrote to memory of 3828	3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 3480 wrote to memory of 3828	3480	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1700 wrote to memory of 3088	1700	cmd.exe	bb.exe
PID 1700 wrote to memory of 3088	1700	cmd.exe	bb.exe
PID 1700 wrote to memory of 3088	1700	cmd.exe	bb.exe
PID 1700 wrote to memory of 3568	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 3568	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 3568	1700	cmd.exe	timeout.exe
PID 3088 wrote to memory of 1272	3088	bb.exe	bb.exe
PID 3088 wrote to memory of 1272	3088	bb.exe	bb.exe
PID 3088 wrote to memory of 1272	3088	bb.exe	bb.exe
PID 3088 wrote to memory of 1272	3088	bb.exe	bb.exe
PID 3088 wrote to memory of 1272	3088	bb.exe	bb.exe
PID 1272 wrote to memory of 3148	1272	bb.exe	explorer.exe
PID 1272 wrote to memory of 3148	1272	bb.exe	explorer.exe
PID 1272 wrote to memory of 3148	1272	bb.exe	explorer.exe
PID 1700 wrote to memory of 2120	1700	cmd.exe	puttty.exe
PID 1700 wrote to memory of 2120	1700	cmd.exe	puttty.exe
PID 1700 wrote to memory of 2120	1700	cmd.exe	puttty.exe
PID 1700 wrote to memory of 2156	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 2156	1700	cmd.exe	timeout.exe
PID 1700 wrote to memory of 2156	1700	cmd.exe	timeout.exe
PID 3148 wrote to memory of 4044	3148	explorer.exe	3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe
PID 3148 wrote to memory of 4044	3148	explorer.exe	3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe
PID 3148 wrote to memory of 1700	3148	explorer.exe	cmd.exe
PID 3148 wrote to memory of 1700	3148	explorer.exe	cmd.exe
PID 3148 wrote to memory of 2600	3148	explorer.exe	key.exe
PID 3148 wrote to memory of 2600	3148	explorer.exe	key.exe
PID 3148 wrote to memory of 184	3148	explorer.exe	cmd.exe
PID 3148 wrote to memory of 184	3148	explorer.exe	cmd.exe
PID 3148 wrote to memory of 3480	3148	explorer.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 3148 wrote to memory of 3480	3148	explorer.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 3148 wrote to memory of 3428	3148	explorer.exe	data.dat

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1276 attrib.exe

pid	process
1276	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe
"C:\Users\Admin\AppData\Local\Temp\3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\3be0e1472ad786cfb4a11fb88470d92873d916eacb651d49e8a520ce8206e4c1.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\key.exe
key.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t953.bat" "C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\key.exe" "
4⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:184

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
5⤵
- Views/modifies file attributes
PID:1276

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
5⤵
PID:1840

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
5⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3428

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1
3⤵
- Delays execution with timeout.exe
PID:2692

C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get Caption /format:list
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2
3⤵
- Delays execution with timeout.exe
PID:2976

C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\bb.exe
bb.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3088

C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\bb.exe
"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\bb.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3
3⤵
- Delays execution with timeout.exe
PID:3568

C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\puttty.exe
puttty.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2120

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1800
4⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4292

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 4
3⤵
- Delays execution with timeout.exe
PID:2156

C:\Users\Admin\AppData\Local\Temp\1AF0.tmp\ereds.exe
ereds.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 804
4⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery