betabot | 2750d82acc17245fb3f34ceb34d12d50090626ce0bb28902dd2dcc5db924dd48

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 8 IoCs

Processes:

amtemu.exekey.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedata.datbb.exebb.exeputtty.exeereds.exe

pid	process
1928	amtemu.exe
852	key.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1920	data.dat
1708	bb.exe
516	bb.exe
1288	puttty.exe
2132	ereds.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcrobatDC.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcrobatDC.js	WScript.exe

Loads dropped DLL 14 IoCs

Processes:

cmd.execmd.exedata.datbb.exedw20.exedw20.exe

pid	process
1588	cmd.exe
1588	cmd.exe
1588	cmd.exe
1328	cmd.exe
1588	cmd.exe
1588	cmd.exe
1920	data.dat
1708	bb.exe
1588	cmd.exe
1588	cmd.exe
1588	cmd.exe
1588	cmd.exe
2300	dw20.exe
2436	dw20.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

explorer.exedata.dat

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\53mk17a1.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\53mk17a1.exe\""	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	data.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\53mk17a1.exe\""	data.dat

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

Processes:

ereds.exekey.exebb.exedata.datputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ereds.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	key.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	data.dat
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	puttty.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Microsoft.VisualStudio.Package.LanguageService.11.0.exe

Maps connected drives based on registry 3 TTPs 14 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

data.datereds.exedw20.exekey.exeputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ereds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	data.dat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	ereds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	key.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

Processes:

bb.exeexplorer.exedata.datputtty.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedw20.exeereds.exedw20.exekey.exe

pid	process
516	bb.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1920	data.dat
1920	data.dat
1920	data.dat
1920	data.dat
1288	puttty.exe
1288	puttty.exe
1288	puttty.exe
1288	puttty.exe
1840	explorer.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2300	dw20.exe
2300	dw20.exe
2300	dw20.exe
2300	dw20.exe
2132	ereds.exe
2132	ereds.exe
2132	ereds.exe
2132	ereds.exe
2436	dw20.exe
852	key.exe
2436	dw20.exe
2436	dw20.exe
2436	dw20.exe
852	key.exe
852	key.exe
852	key.exe
1840	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb.exe

description pid process target process

PID 1708 set thread context of 516 1708 bb.exe bb.exe

description	pid	process	target process
PID 1708 set thread context of 516	1708	bb.exe	bb.exe

Drops file in Windows directory 4 IoCs

Processes:

4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe

description	ioc	process
File created	C:\Windows\AcrobatDC.js	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
File opened for modification	C:\Windows\AcrobatDC.js	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
File created	C:\Windows\amtemu.exe	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
File opened for modification	C:\Windows\amtemu.exe	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

bb.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1252 schtasks.exe
Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

1656 timeout.exe
432 timeout.exe
1016 timeout.exe
1360 timeout.exe

pid	process
1252	schtasks.exe

pid	process
1656	timeout.exe
432	timeout.exe
1016	timeout.exe
1360	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exedata.datexplorer.exe

pid	process
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1920	data.dat
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1840	explorer.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1840	explorer.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1840	explorer.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

dw20.exedw20.exe

pid process

2300 dw20.exe
2436 dw20.exe

pid	process
2300	dw20.exe
2436	dw20.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

bb.exeexplorer.exeputtty.exeereds.exe

pid	process
516	bb.exe
516	bb.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1840	explorer.exe
1288	puttty.exe
2132	ereds.exe
1840	explorer.exe
1840	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exewmic.exeAUDIODG.EXEbb.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Token: SeIncreaseQuotaPrivilege	660	wmic.exe
Token: SeSecurityPrivilege	660	wmic.exe
Token: SeTakeOwnershipPrivilege	660	wmic.exe
Token: SeLoadDriverPrivilege	660	wmic.exe
Token: SeSystemProfilePrivilege	660	wmic.exe
Token: SeSystemtimePrivilege	660	wmic.exe
Token: SeProfSingleProcessPrivilege	660	wmic.exe
Token: SeIncBasePriorityPrivilege	660	wmic.exe
Token: SeCreatePagefilePrivilege	660	wmic.exe
Token: SeBackupPrivilege	660	wmic.exe
Token: SeRestorePrivilege	660	wmic.exe
Token: SeShutdownPrivilege	660	wmic.exe
Token: SeDebugPrivilege	660	wmic.exe
Token: SeSystemEnvironmentPrivilege	660	wmic.exe
Token: SeRemoteShutdownPrivilege	660	wmic.exe
Token: SeUndockPrivilege	660	wmic.exe
Token: SeManageVolumePrivilege	660	wmic.exe
Token: 33	660	wmic.exe
Token: 34	660	wmic.exe
Token: 35	660	wmic.exe
Token: SeIncreaseQuotaPrivilege	660	wmic.exe
Token: SeSecurityPrivilege	660	wmic.exe
Token: SeTakeOwnershipPrivilege	660	wmic.exe
Token: SeLoadDriverPrivilege	660	wmic.exe
Token: SeSystemProfilePrivilege	660	wmic.exe
Token: SeSystemtimePrivilege	660	wmic.exe
Token: SeProfSingleProcessPrivilege	660	wmic.exe
Token: SeIncBasePriorityPrivilege	660	wmic.exe
Token: SeCreatePagefilePrivilege	660	wmic.exe
Token: SeBackupPrivilege	660	wmic.exe
Token: SeRestorePrivilege	660	wmic.exe
Token: SeShutdownPrivilege	660	wmic.exe
Token: SeDebugPrivilege	660	wmic.exe
Token: SeSystemEnvironmentPrivilege	660	wmic.exe
Token: SeRemoteShutdownPrivilege	660	wmic.exe
Token: SeUndockPrivilege	660	wmic.exe
Token: SeManageVolumePrivilege	660	wmic.exe
Token: 33	660	wmic.exe
Token: 34	660	wmic.exe
Token: 35	660	wmic.exe
Token: 33	1548	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1548	AUDIODG.EXE
Token: SeDebugPrivilege	516	bb.exe
Token: SeRestorePrivilege	516	bb.exe
Token: SeBackupPrivilege	516	bb.exe
Token: SeLoadDriverPrivilege	516	bb.exe
Token: SeCreatePagefilePrivilege	516	bb.exe
Token: SeShutdownPrivilege	516	bb.exe
Token: SeTakeOwnershipPrivilege	516	bb.exe
Token: SeChangeNotifyPrivilege	516	bb.exe
Token: SeCreateTokenPrivilege	516	bb.exe
Token: SeMachineAccountPrivilege	516	bb.exe
Token: SeSecurityPrivilege	516	bb.exe
Token: SeAssignPrimaryTokenPrivilege	516	bb.exe
Token: SeCreateGlobalPrivilege	516	bb.exe
Token: 33	516	bb.exe
Token: 33	1548	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1548	AUDIODG.EXE
Token: SeDebugPrivilege	1840	explorer.exe
Token: SeRestorePrivilege	1840	explorer.exe
Token: SeBackupPrivilege	1840	explorer.exe
Token: SeLoadDriverPrivilege	1840	explorer.exe
Token: SeCreatePagefilePrivilege	1840	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

data.dat

pid process

1920 data.dat

pid	process
1920	data.dat

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exeamtemu.execmd.exeWScript.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exekey.execmd.exebb.exe

description	pid	process	target process
PID 1052 wrote to memory of 1740	1052	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	WScript.exe
PID 1052 wrote to memory of 1740	1052	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	WScript.exe
PID 1052 wrote to memory of 1740	1052	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	WScript.exe
PID 1052 wrote to memory of 1928	1052	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	amtemu.exe
PID 1052 wrote to memory of 1928	1052	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	amtemu.exe
PID 1052 wrote to memory of 1928	1052	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	amtemu.exe
PID 1052 wrote to memory of 1928	1052	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	amtemu.exe
PID 1928 wrote to memory of 1588	1928	amtemu.exe	cmd.exe
PID 1928 wrote to memory of 1588	1928	amtemu.exe	cmd.exe
PID 1928 wrote to memory of 1588	1928	amtemu.exe	cmd.exe
PID 1928 wrote to memory of 1588	1928	amtemu.exe	cmd.exe
PID 1588 wrote to memory of 852	1588	cmd.exe	key.exe
PID 1588 wrote to memory of 852	1588	cmd.exe	key.exe
PID 1588 wrote to memory of 852	1588	cmd.exe	key.exe
PID 1588 wrote to memory of 852	1588	cmd.exe	key.exe
PID 1588 wrote to memory of 1656	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1656	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1656	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1656	1588	cmd.exe	timeout.exe
PID 1740 wrote to memory of 1252	1740	WScript.exe	schtasks.exe
PID 1740 wrote to memory of 1252	1740	WScript.exe	schtasks.exe
PID 1740 wrote to memory of 1252	1740	WScript.exe	schtasks.exe
PID 1588 wrote to memory of 1828	1588	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1588 wrote to memory of 1828	1588	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1588 wrote to memory of 1828	1588	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1588 wrote to memory of 1828	1588	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1588 wrote to memory of 432	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 432	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 432	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 432	1588	cmd.exe	timeout.exe
PID 1828 wrote to memory of 660	1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1828 wrote to memory of 660	1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1828 wrote to memory of 660	1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1828 wrote to memory of 660	1828	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 852 wrote to memory of 1328	852	key.exe	cmd.exe
PID 852 wrote to memory of 1328	852	key.exe	cmd.exe
PID 852 wrote to memory of 1328	852	key.exe	cmd.exe
PID 852 wrote to memory of 1328	852	key.exe	cmd.exe
PID 1328 wrote to memory of 1956	1328	cmd.exe	attrib.exe
PID 1328 wrote to memory of 1956	1328	cmd.exe	attrib.exe
PID 1328 wrote to memory of 1956	1328	cmd.exe	attrib.exe
PID 1328 wrote to memory of 1956	1328	cmd.exe	attrib.exe
PID 1328 wrote to memory of 944	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 944	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 944	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 944	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 900	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 900	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 900	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 900	1328	cmd.exe	find.exe
PID 1328 wrote to memory of 1920	1328	cmd.exe	data.dat
PID 1328 wrote to memory of 1920	1328	cmd.exe	data.dat
PID 1328 wrote to memory of 1920	1328	cmd.exe	data.dat
PID 1328 wrote to memory of 1920	1328	cmd.exe	data.dat
PID 1588 wrote to memory of 1708	1588	cmd.exe	bb.exe
PID 1588 wrote to memory of 1708	1588	cmd.exe	bb.exe
PID 1588 wrote to memory of 1708	1588	cmd.exe	bb.exe
PID 1588 wrote to memory of 1708	1588	cmd.exe	bb.exe
PID 1588 wrote to memory of 1016	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1016	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1016	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1016	1588	cmd.exe	timeout.exe
PID 1708 wrote to memory of 516	1708	bb.exe	bb.exe
PID 1708 wrote to memory of 516	1708	bb.exe	bb.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1956 attrib.exe

pid	process
1956	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
"C:\Users\Admin\AppData\Local\Temp\4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe"
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\AcrobatDC.js"
3⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Windows\AcrobatDC.js
4⤵
- Creates scheduled task(s)
PID:1252

C:\Windows\amtemu.exe
"C:\Windows\amtemu.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\F882.tmp\start.bat" C:\Windows\amtemu.exe"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\F882.tmp\key.exe
key.exe
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t27408.bat" "C:\Users\Admin\AppData\Local\Temp\F882.tmp\key.exe" "
6⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
7⤵
- Views/modifies file attributes
PID:1956

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
7⤵
PID:944

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
7⤵
PID:900

C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1
5⤵
- Delays execution with timeout.exe
PID:1656

C:\Users\Admin\AppData\Local\Temp\F882.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Microsoft.VisualStudio.Package.LanguageService.11.0.exe
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get Caption /format:list
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2
5⤵
- Delays execution with timeout.exe
PID:432

C:\Users\Admin\AppData\Local\Temp\F882.tmp\bb.exe
bb.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\F882.tmp\bb.exe
"C:\Users\Admin\AppData\Local\Temp\F882.tmp\bb.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
7⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3
5⤵
- Delays execution with timeout.exe
PID:1016

C:\Users\Admin\AppData\Local\Temp\F882.tmp\puttty.exe
puttty.exe
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1288

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1036
6⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:2300

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 4
5⤵
- Delays execution with timeout.exe
PID:1360

C:\Users\Admin\AppData\Local\Temp\F882.tmp\ereds.exe
ereds.exe
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:2132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 844
6⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:2436

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-732837619-1410552359-2104853307-22034894-1661349562-12314096762062640880-844609066"
1⤵
PID:1676

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1305804963-2003508894-10576758041146480427-664449230-596923050-719630763394335139"
1⤵
PID:1484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1864

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery