betabot | 2750d82acc17245fb3f34ceb34d12d50090626ce0bb28902dd2dcc5db924dd48

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 6 IoCs

Processes:

WScript.exe

flow pid process

9 420 WScript.exe
34 420 WScript.exe
36 420 WScript.exe
40 420 WScript.exe
43 420 WScript.exe
44 420 WScript.exe
Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe

flow	pid	process
9	420	WScript.exe
34	420	WScript.exe
36	420	WScript.exe
40	420	WScript.exe
43	420	WScript.exe
44	420	WScript.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 8 IoCs

Processes:

amtemu.exekey.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exedata.datbb.exebb.exeputtty.exeereds.exe

pid	process
1784	amtemu.exe
3844	key.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2812	data.dat
4248	bb.exe
4296	bb.exe
4440	puttty.exe
4692	ereds.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcrobatDC.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AcrobatDC.js	WScript.exe

Loads dropped DLL 1 IoCs

Processes:

data.dat

pid process

2812 data.dat
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2812	data.dat

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

explorer.exedata.dat

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\koa35m5o79g7e.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\koa35m5o79g7e.exe\""	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	data.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\koa35m5o79g7e.exe\""	data.dat

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

Processes:

data.datputtty.execmd.exeereds.exekey.execmd.exebb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	data.dat
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	puttty.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ereds.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	key.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bb.exe

Maps connected drives based on registry 3 TTPs 16 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

data.datdw20.exekey.exeereds.execmd.exeputtty.execmd.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ereds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	puttty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	ereds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

Processes:

bb.exeexplorer.exedata.datputtty.exeereds.exedw20.exekey.execmd.exedw20.exe

pid	process
4296	bb.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
2812	data.dat
2812	data.dat
2812	data.dat
2812	data.dat
4440	puttty.exe
4440	puttty.exe
4440	puttty.exe
4440	puttty.exe
4368	explorer.exe
4368	explorer.exe
4692	ereds.exe
4692	ereds.exe
4692	ereds.exe
4692	ereds.exe
4832	dw20.exe
4832	dw20.exe
4832	dw20.exe
4832	dw20.exe
3844	key.exe
2192	cmd.exe
3844	key.exe
3844	key.exe
3844	key.exe
2192	cmd.exe
2192	cmd.exe
2192	cmd.exe
1296	dw20.exe
1296	dw20.exe
1296	dw20.exe
1296	dw20.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb.exe

description pid process target process

PID 4248 set thread context of 4296 4248 bb.exe bb.exe

description	pid	process	target process
PID 4248 set thread context of 4296	4248	bb.exe	bb.exe

Drops file in Windows directory 4 IoCs

Processes:

4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe

description	ioc	process
File opened for modification	C:\Windows\AcrobatDC.js	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
File created	C:\Windows\amtemu.exe	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
File opened for modification	C:\Windows\amtemu.exe	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
File created	C:\Windows\AcrobatDC.js	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

bb.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3516 schtasks.exe
Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

1296 timeout.exe
3400 timeout.exe
4264 timeout.exe
4456 timeout.exe

pid	process
3516	schtasks.exe

pid	process
1296	timeout.exe
3400	timeout.exe
4264	timeout.exe
4456	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 1 IoCs

Processes:

4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exedata.datexplorer.exedw20.exedw20.exe

pid	process
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2812	data.dat
2812	data.dat
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4368	explorer.exe
4368	explorer.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4368	explorer.exe
4368	explorer.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4832	dw20.exe
4832	dw20.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
1296	dw20.exe
1296	dw20.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe

Suspicious behavior: MapViewOfSection 13 IoCs

Processes:

bb.exeexplorer.exe

pid	process
4296	bb.exe
4296	bb.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exewmic.exebb.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Token: SeIncreaseQuotaPrivilege	812	wmic.exe
Token: SeSecurityPrivilege	812	wmic.exe
Token: SeTakeOwnershipPrivilege	812	wmic.exe
Token: SeLoadDriverPrivilege	812	wmic.exe
Token: SeSystemProfilePrivilege	812	wmic.exe
Token: SeSystemtimePrivilege	812	wmic.exe
Token: SeProfSingleProcessPrivilege	812	wmic.exe
Token: SeIncBasePriorityPrivilege	812	wmic.exe
Token: SeCreatePagefilePrivilege	812	wmic.exe
Token: SeBackupPrivilege	812	wmic.exe
Token: SeRestorePrivilege	812	wmic.exe
Token: SeShutdownPrivilege	812	wmic.exe
Token: SeDebugPrivilege	812	wmic.exe
Token: SeSystemEnvironmentPrivilege	812	wmic.exe
Token: SeRemoteShutdownPrivilege	812	wmic.exe
Token: SeUndockPrivilege	812	wmic.exe
Token: SeManageVolumePrivilege	812	wmic.exe
Token: 33	812	wmic.exe
Token: 34	812	wmic.exe
Token: 35	812	wmic.exe
Token: 36	812	wmic.exe
Token: SeIncreaseQuotaPrivilege	812	wmic.exe
Token: SeSecurityPrivilege	812	wmic.exe
Token: SeTakeOwnershipPrivilege	812	wmic.exe
Token: SeLoadDriverPrivilege	812	wmic.exe
Token: SeSystemProfilePrivilege	812	wmic.exe
Token: SeSystemtimePrivilege	812	wmic.exe
Token: SeProfSingleProcessPrivilege	812	wmic.exe
Token: SeIncBasePriorityPrivilege	812	wmic.exe
Token: SeCreatePagefilePrivilege	812	wmic.exe
Token: SeBackupPrivilege	812	wmic.exe
Token: SeRestorePrivilege	812	wmic.exe
Token: SeShutdownPrivilege	812	wmic.exe
Token: SeDebugPrivilege	812	wmic.exe
Token: SeSystemEnvironmentPrivilege	812	wmic.exe
Token: SeRemoteShutdownPrivilege	812	wmic.exe
Token: SeUndockPrivilege	812	wmic.exe
Token: SeManageVolumePrivilege	812	wmic.exe
Token: 33	812	wmic.exe
Token: 34	812	wmic.exe
Token: 35	812	wmic.exe
Token: 36	812	wmic.exe
Token: SeDebugPrivilege	4296	bb.exe
Token: SeRestorePrivilege	4296	bb.exe
Token: SeBackupPrivilege	4296	bb.exe
Token: SeLoadDriverPrivilege	4296	bb.exe
Token: SeCreatePagefilePrivilege	4296	bb.exe
Token: SeShutdownPrivilege	4296	bb.exe
Token: SeTakeOwnershipPrivilege	4296	bb.exe
Token: SeChangeNotifyPrivilege	4296	bb.exe
Token: SeCreateTokenPrivilege	4296	bb.exe
Token: SeMachineAccountPrivilege	4296	bb.exe
Token: SeSecurityPrivilege	4296	bb.exe
Token: SeAssignPrimaryTokenPrivilege	4296	bb.exe
Token: SeCreateGlobalPrivilege	4296	bb.exe
Token: 33	4296	bb.exe
Token: SeDebugPrivilege	4368	explorer.exe
Token: SeRestorePrivilege	4368	explorer.exe
Token: SeBackupPrivilege	4368	explorer.exe
Token: SeLoadDriverPrivilege	4368	explorer.exe
Token: SeCreatePagefilePrivilege	4368	explorer.exe
Token: SeShutdownPrivilege	4368	explorer.exe
Token: SeTakeOwnershipPrivilege	4368	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

data.dat

pid process

2812 data.dat

pid	process
2812	data.dat

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exeWScript.exeamtemu.execmd.exekey.execmd.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exeexplorer.exe

description	pid	process	target process
PID 1808 wrote to memory of 420	1808	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	WScript.exe
PID 1808 wrote to memory of 420	1808	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	WScript.exe
PID 1808 wrote to memory of 1784	1808	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	amtemu.exe
PID 1808 wrote to memory of 1784	1808	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	amtemu.exe
PID 1808 wrote to memory of 1784	1808	4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe	amtemu.exe
PID 420 wrote to memory of 3516	420	WScript.exe	schtasks.exe
PID 420 wrote to memory of 3516	420	WScript.exe	schtasks.exe
PID 1784 wrote to memory of 1632	1784	amtemu.exe	cmd.exe
PID 1784 wrote to memory of 1632	1784	amtemu.exe	cmd.exe
PID 1784 wrote to memory of 1632	1784	amtemu.exe	cmd.exe
PID 1632 wrote to memory of 3844	1632	cmd.exe	key.exe
PID 1632 wrote to memory of 3844	1632	cmd.exe	key.exe
PID 1632 wrote to memory of 3844	1632	cmd.exe	key.exe
PID 1632 wrote to memory of 1296	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 1296	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 1296	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 1640	1632	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1632 wrote to memory of 1640	1632	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 1632 wrote to memory of 1640	1632	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 3844 wrote to memory of 2192	3844	key.exe	cmd.exe
PID 3844 wrote to memory of 2192	3844	key.exe	cmd.exe
PID 3844 wrote to memory of 2192	3844	key.exe	cmd.exe
PID 1632 wrote to memory of 3400	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 3400	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 3400	1632	cmd.exe	timeout.exe
PID 2192 wrote to memory of 1972	2192	cmd.exe	attrib.exe
PID 2192 wrote to memory of 1972	2192	cmd.exe	attrib.exe
PID 2192 wrote to memory of 1972	2192	cmd.exe	attrib.exe
PID 2192 wrote to memory of 296	2192	cmd.exe	find.exe
PID 2192 wrote to memory of 296	2192	cmd.exe	find.exe
PID 2192 wrote to memory of 296	2192	cmd.exe	find.exe
PID 2192 wrote to memory of 1296	2192	cmd.exe	find.exe
PID 2192 wrote to memory of 1296	2192	cmd.exe	find.exe
PID 2192 wrote to memory of 1296	2192	cmd.exe	find.exe
PID 2192 wrote to memory of 2812	2192	cmd.exe	data.dat
PID 2192 wrote to memory of 2812	2192	cmd.exe	data.dat
PID 2192 wrote to memory of 2812	2192	cmd.exe	data.dat
PID 1640 wrote to memory of 812	1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1640 wrote to memory of 812	1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1640 wrote to memory of 812	1640	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1632 wrote to memory of 4248	1632	cmd.exe	bb.exe
PID 1632 wrote to memory of 4248	1632	cmd.exe	bb.exe
PID 1632 wrote to memory of 4248	1632	cmd.exe	bb.exe
PID 1632 wrote to memory of 4264	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 4264	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 4264	1632	cmd.exe	timeout.exe
PID 4248 wrote to memory of 4296	4248	bb.exe	bb.exe
PID 4248 wrote to memory of 4296	4248	bb.exe	bb.exe
PID 4248 wrote to memory of 4296	4248	bb.exe	bb.exe
PID 4248 wrote to memory of 4296	4248	bb.exe	bb.exe
PID 4248 wrote to memory of 4296	4248	bb.exe	bb.exe
PID 4296 wrote to memory of 4368	4296	bb.exe	explorer.exe
PID 4296 wrote to memory of 4368	4296	bb.exe	explorer.exe
PID 4296 wrote to memory of 4368	4296	bb.exe	explorer.exe
PID 1632 wrote to memory of 4440	1632	cmd.exe	puttty.exe
PID 1632 wrote to memory of 4440	1632	cmd.exe	puttty.exe
PID 1632 wrote to memory of 4440	1632	cmd.exe	puttty.exe
PID 1632 wrote to memory of 4456	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 4456	1632	cmd.exe	timeout.exe
PID 1632 wrote to memory of 4456	1632	cmd.exe	timeout.exe
PID 4368 wrote to memory of 1784	4368	explorer.exe	amtemu.exe
PID 4368 wrote to memory of 1784	4368	explorer.exe	amtemu.exe
PID 4368 wrote to memory of 1632	4368	explorer.exe	cmd.exe
PID 4368 wrote to memory of 1632	4368	explorer.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1972 attrib.exe

pid	process
1972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe
"C:\Users\Admin\AppData\Local\Temp\4f9036848d0379bbfa74759957a24b6338568baa494d90fe671c1f71d8c0d12c.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\AcrobatDC.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:420

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Windows\AcrobatDC.js
3⤵
- Creates scheduled task(s)
PID:3516

C:\Windows\amtemu.exe
"C:\Windows\amtemu.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FB04.tmp\start.bat" C:\Windows\amtemu.exe"
3⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\FB04.tmp\key.exe
key.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t7747.bat" "C:\Users\Admin\AppData\Local\Temp\FB04.tmp\key.exe" "
5⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
6⤵
- Views/modifies file attributes
PID:1972

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
6⤵
PID:296

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
6⤵
PID:1296

C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1
4⤵
- Delays execution with timeout.exe
PID:1296

C:\Users\Admin\AppData\Local\Temp\FB04.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get Caption /format:list
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:812

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2
4⤵
- Delays execution with timeout.exe
PID:3400

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3
4⤵
- Delays execution with timeout.exe
PID:4264

C:\Users\Admin\AppData\Local\Temp\FB04.tmp\bb.exe
bb.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4248

C:\Users\Admin\AppData\Local\Temp\FB04.tmp\bb.exe
"C:\Users\Admin\AppData\Local\Temp\FB04.tmp\bb.exe"
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
6⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368

C:\Users\Admin\AppData\Local\Temp\FB04.tmp\puttty.exe
puttty.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4440

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 2376
5⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4832

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 4
4⤵
- Delays execution with timeout.exe
PID:4456

C:\Users\Admin\AppData\Local\Temp\FB04.tmp\ereds.exe
ereds.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4692

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1536
5⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery