betabot | 2750d82acc17245fb3f34ceb34d12d50090626ce0bb28902dd2dcc5db924dd48

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe

Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 8 IoCs

Processes:

setup.exekey.exedata.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exeputtty.exeereds.exe

pid	process
1148	setup.exe
3644	key.exe
1460	data.dat
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4196	bb.exe
4244	bb.exe
4444	puttty.exe
4628	ereds.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Loads dropped DLL 4 IoCs

Processes:

d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exedata.dat

pid	process
4024	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe
4024	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe
4024	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe
1460	data.dat

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

explorer.exedata.dat

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\g31ssg513s51.exe\""	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	data.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\g31ssg513s51.exe\""	data.dat
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\g31ssg513s51.exe"	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

Processes:

cmd.exebb.exedata.datputtty.execmd.exeereds.exekey.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	data.dat
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	puttty.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ereds.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	key.exe

Maps connected drives based on registry 3 TTPs 16 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

cmd.exedw20.exedw20.exedata.datputtty.execmd.exekey.exeereds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	data.dat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	puttty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ereds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	ereds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs

Processes:

bb.exeexplorer.exedata.datputtty.exeereds.exedw20.exekey.execmd.exedw20.exe

pid	process
4244	bb.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
1460	data.dat
1460	data.dat
1460	data.dat
1460	data.dat
4444	puttty.exe
4444	puttty.exe
4444	puttty.exe
4444	puttty.exe
4312	explorer.exe
4312	explorer.exe
4628	ereds.exe
4628	ereds.exe
4628	ereds.exe
4628	ereds.exe
4760	dw20.exe
4760	dw20.exe
4760	dw20.exe
4760	dw20.exe
3644	key.exe
2088	cmd.exe
3644	key.exe
3644	key.exe
3644	key.exe
2088	cmd.exe
2088	cmd.exe
2088	cmd.exe
5084	dw20.exe
5084	dw20.exe
5084	dw20.exe
5084	dw20.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb.exe

description pid process target process

PID 4196 set thread context of 4244 4196 bb.exe bb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4196 set thread context of 4244	4196	bb.exe	bb.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorer.exebb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bb.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

2344 timeout.exe
2984 timeout.exe
4216 timeout.exe
4472 timeout.exe

pid	process
2344	timeout.exe
2984	timeout.exe
4216	timeout.exe
4472	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

data.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exeexplorer.exedw20.exe

pid	process
1460	data.dat
1460	data.dat
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4312	explorer.exe
4312	explorer.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4312	explorer.exe
4312	explorer.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4760	dw20.exe
4760	dw20.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4312	explorer.exe
4312	explorer.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe

Suspicious behavior: MapViewOfSection 14 IoCs

Processes:

bb.exeexplorer.exe

pid	process
4244	bb.exe
4244	bb.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Microsoft.VisualStudio.Package.LanguageService.11.0.exewmic.exebb.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Token: SeIncreaseQuotaPrivilege	392	wmic.exe
Token: SeSecurityPrivilege	392	wmic.exe
Token: SeTakeOwnershipPrivilege	392	wmic.exe
Token: SeLoadDriverPrivilege	392	wmic.exe
Token: SeSystemProfilePrivilege	392	wmic.exe
Token: SeSystemtimePrivilege	392	wmic.exe
Token: SeProfSingleProcessPrivilege	392	wmic.exe
Token: SeIncBasePriorityPrivilege	392	wmic.exe
Token: SeCreatePagefilePrivilege	392	wmic.exe
Token: SeBackupPrivilege	392	wmic.exe
Token: SeRestorePrivilege	392	wmic.exe
Token: SeShutdownPrivilege	392	wmic.exe
Token: SeDebugPrivilege	392	wmic.exe
Token: SeSystemEnvironmentPrivilege	392	wmic.exe
Token: SeRemoteShutdownPrivilege	392	wmic.exe
Token: SeUndockPrivilege	392	wmic.exe
Token: SeManageVolumePrivilege	392	wmic.exe
Token: 33	392	wmic.exe
Token: 34	392	wmic.exe
Token: 35	392	wmic.exe
Token: 36	392	wmic.exe
Token: SeIncreaseQuotaPrivilege	392	wmic.exe
Token: SeSecurityPrivilege	392	wmic.exe
Token: SeTakeOwnershipPrivilege	392	wmic.exe
Token: SeLoadDriverPrivilege	392	wmic.exe
Token: SeSystemProfilePrivilege	392	wmic.exe
Token: SeSystemtimePrivilege	392	wmic.exe
Token: SeProfSingleProcessPrivilege	392	wmic.exe
Token: SeIncBasePriorityPrivilege	392	wmic.exe
Token: SeCreatePagefilePrivilege	392	wmic.exe
Token: SeBackupPrivilege	392	wmic.exe
Token: SeRestorePrivilege	392	wmic.exe
Token: SeShutdownPrivilege	392	wmic.exe
Token: SeDebugPrivilege	392	wmic.exe
Token: SeSystemEnvironmentPrivilege	392	wmic.exe
Token: SeRemoteShutdownPrivilege	392	wmic.exe
Token: SeUndockPrivilege	392	wmic.exe
Token: SeManageVolumePrivilege	392	wmic.exe
Token: 33	392	wmic.exe
Token: 34	392	wmic.exe
Token: 35	392	wmic.exe
Token: 36	392	wmic.exe
Token: SeDebugPrivilege	4244	bb.exe
Token: SeRestorePrivilege	4244	bb.exe
Token: SeBackupPrivilege	4244	bb.exe
Token: SeLoadDriverPrivilege	4244	bb.exe
Token: SeCreatePagefilePrivilege	4244	bb.exe
Token: SeShutdownPrivilege	4244	bb.exe
Token: SeTakeOwnershipPrivilege	4244	bb.exe
Token: SeChangeNotifyPrivilege	4244	bb.exe
Token: SeCreateTokenPrivilege	4244	bb.exe
Token: SeMachineAccountPrivilege	4244	bb.exe
Token: SeSecurityPrivilege	4244	bb.exe
Token: SeAssignPrimaryTokenPrivilege	4244	bb.exe
Token: SeCreateGlobalPrivilege	4244	bb.exe
Token: 33	4244	bb.exe
Token: SeDebugPrivilege	4312	explorer.exe
Token: SeRestorePrivilege	4312	explorer.exe
Token: SeBackupPrivilege	4312	explorer.exe
Token: SeLoadDriverPrivilege	4312	explorer.exe
Token: SeCreatePagefilePrivilege	4312	explorer.exe
Token: SeShutdownPrivilege	4312	explorer.exe
Token: SeTakeOwnershipPrivilege	4312	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

data.dat

pid process

1460 data.dat

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exesetup.execmd.exekey.execmd.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exeexplorer.exe

description	pid	process	target process
PID 4024 wrote to memory of 1148	4024	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe	setup.exe
PID 4024 wrote to memory of 1148	4024	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe	setup.exe
PID 4024 wrote to memory of 1148	4024	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe	setup.exe
PID 1148 wrote to memory of 2160	1148	setup.exe	cmd.exe
PID 1148 wrote to memory of 2160	1148	setup.exe	cmd.exe
PID 1148 wrote to memory of 2160	1148	setup.exe	cmd.exe
PID 2160 wrote to memory of 3644	2160	cmd.exe	key.exe
PID 2160 wrote to memory of 3644	2160	cmd.exe	key.exe
PID 2160 wrote to memory of 3644	2160	cmd.exe	key.exe
PID 2160 wrote to memory of 2344	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2344	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2344	2160	cmd.exe	timeout.exe
PID 3644 wrote to memory of 2088	3644	key.exe	cmd.exe
PID 3644 wrote to memory of 2088	3644	key.exe	cmd.exe
PID 3644 wrote to memory of 2088	3644	key.exe	cmd.exe
PID 2088 wrote to memory of 3660	2088	cmd.exe	attrib.exe
PID 2088 wrote to memory of 3660	2088	cmd.exe	attrib.exe
PID 2088 wrote to memory of 3660	2088	cmd.exe	attrib.exe
PID 2088 wrote to memory of 632	2088	cmd.exe	find.exe
PID 2088 wrote to memory of 632	2088	cmd.exe	find.exe
PID 2088 wrote to memory of 632	2088	cmd.exe	find.exe
PID 2088 wrote to memory of 392	2088	cmd.exe	find.exe
PID 2088 wrote to memory of 392	2088	cmd.exe	find.exe
PID 2088 wrote to memory of 392	2088	cmd.exe	find.exe
PID 2088 wrote to memory of 1460	2088	cmd.exe	data.dat
PID 2088 wrote to memory of 1460	2088	cmd.exe	data.dat
PID 2088 wrote to memory of 1460	2088	cmd.exe	data.dat
PID 2160 wrote to memory of 1452	2160	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 2160 wrote to memory of 1452	2160	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 2160 wrote to memory of 1452	2160	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 2160 wrote to memory of 2984	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2984	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 2984	2160	cmd.exe	timeout.exe
PID 1452 wrote to memory of 392	1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1452 wrote to memory of 392	1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 1452 wrote to memory of 392	1452	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 2160 wrote to memory of 4196	2160	cmd.exe	bb.exe
PID 2160 wrote to memory of 4196	2160	cmd.exe	bb.exe
PID 2160 wrote to memory of 4196	2160	cmd.exe	bb.exe
PID 2160 wrote to memory of 4216	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 4216	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 4216	2160	cmd.exe	timeout.exe
PID 4196 wrote to memory of 4244	4196	bb.exe	bb.exe
PID 4196 wrote to memory of 4244	4196	bb.exe	bb.exe
PID 4196 wrote to memory of 4244	4196	bb.exe	bb.exe
PID 4196 wrote to memory of 4244	4196	bb.exe	bb.exe
PID 4196 wrote to memory of 4244	4196	bb.exe	bb.exe
PID 4244 wrote to memory of 4312	4244	bb.exe	explorer.exe
PID 4244 wrote to memory of 4312	4244	bb.exe	explorer.exe
PID 4244 wrote to memory of 4312	4244	bb.exe	explorer.exe
PID 2160 wrote to memory of 4444	2160	cmd.exe	puttty.exe
PID 2160 wrote to memory of 4444	2160	cmd.exe	puttty.exe
PID 2160 wrote to memory of 4444	2160	cmd.exe	puttty.exe
PID 2160 wrote to memory of 4472	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 4472	2160	cmd.exe	timeout.exe
PID 2160 wrote to memory of 4472	2160	cmd.exe	timeout.exe
PID 4312 wrote to memory of 4024	4312	explorer.exe	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe
PID 4312 wrote to memory of 4024	4312	explorer.exe	d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe
PID 4312 wrote to memory of 1148	4312	explorer.exe	setup.exe
PID 4312 wrote to memory of 1148	4312	explorer.exe	setup.exe
PID 4312 wrote to memory of 2160	4312	explorer.exe	cmd.exe
PID 4312 wrote to memory of 2160	4312	explorer.exe	cmd.exe
PID 4312 wrote to memory of 3644	4312	explorer.exe	key.exe
PID 4312 wrote to memory of 3644	4312	explorer.exe	key.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

3660 attrib.exe

pid	process
3660	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe
"C:\Users\Admin\AppData\Local\Temp\d33647e9d09ffe352d2d6c6db4d48c11f2c04c4aab3deb0fd4c48a65cb47385a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4024

C:\Users\Admin\AppData\Local\Temp\nsz69E.tmp\setup.exe
C:\Users\Admin\AppData\Local\Temp\nsz69E.tmp\setup.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8DF.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\nsz69E.tmp\setup.exe"
3⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:2160

C:\Users\Admin\AppData\Local\Temp\8DF.tmp\key.exe
key.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t18921.bat" "C:\Users\Admin\AppData\Local\Temp\8DF.tmp\key.exe" "
5⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
6⤵
- Views/modifies file attributes
PID:3660

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
6⤵
PID:632

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
6⤵
PID:392

C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1
4⤵
- Delays execution with timeout.exe
PID:2344

C:\Users\Admin\AppData\Local\Temp\8DF.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get Caption /format:list
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2
4⤵
- Delays execution with timeout.exe
PID:2984

C:\Users\Admin\AppData\Local\Temp\8DF.tmp\bb.exe
bb.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4196

C:\Users\Admin\AppData\Local\Temp\8DF.tmp\bb.exe
"C:\Users\Admin\AppData\Local\Temp\8DF.tmp\bb.exe"
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
6⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3
4⤵
- Delays execution with timeout.exe
PID:4216

C:\Users\Admin\AppData\Local\Temp\8DF.tmp\puttty.exe
puttty.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4444

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 2396
5⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4760

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 4
4⤵
- Delays execution with timeout.exe
PID:4472

C:\Users\Admin\AppData\Local\Temp\8DF.tmp\ereds.exe
ereds.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1584
5⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery