betabot | 458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe

Executes dropped EXE 2 IoCs

Processes:

my_pc.exemy_pc.exe

pid process

4196 my_pc.exe
4468 my_pc.exe

pid	process
4196	my_pc.exe
4468	my_pc.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

my_pc.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\53c39moyi.exe	my_pc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\53c39moyi.exe\DisableExceptionChainValidation	my_pc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "dwugitqzq.exe"	explorer.exe

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe

Loads dropped DLL 1 IoCs

Processes:

my_pc.exe

pid process

4196 my_pc.exe

pid	process
4196	my_pc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.0 = "C:\\ProgramData\\Google Updater 2.0\\53c39moyi.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.0 = "\"C:\\ProgramData\\Google Updater 2.0\\53c39moyi.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

my_pc.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA my_pc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	my_pc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

my_pc.exeexplorer.exe

pid	process
4468	my_pc.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

my_pc.exe

description pid process target process

PID 4196 set thread context of 4468 4196 my_pc.exe my_pc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4196 set thread context of 4468	4196	my_pc.exe	my_pc.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\my_pc.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\my_pc.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\my_pc.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\my_pc.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\my_pc.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\my_pc.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

my_pc.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	my_pc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	my_pc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main explorer.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

3432 PING.EXE
3000 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

pid	process
3432	PING.EXE
3000	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exeexplorer.exe

pid	process
3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

my_pc.exemy_pc.exe

pid process

4196 my_pc.exe
4468 my_pc.exe
4468 my_pc.exe

pid	process
4196	my_pc.exe
4468	my_pc.exe
4468	my_pc.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exemy_pc.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe
Token: SeDebugPrivilege	4468	my_pc.exe
Token: SeRestorePrivilege	4468	my_pc.exe
Token: SeBackupPrivilege	4468	my_pc.exe
Token: SeLoadDriverPrivilege	4468	my_pc.exe
Token: SeCreatePagefilePrivilege	4468	my_pc.exe
Token: SeShutdownPrivilege	4468	my_pc.exe
Token: SeTakeOwnershipPrivilege	4468	my_pc.exe
Token: SeChangeNotifyPrivilege	4468	my_pc.exe
Token: SeCreateTokenPrivilege	4468	my_pc.exe
Token: SeMachineAccountPrivilege	4468	my_pc.exe
Token: SeSecurityPrivilege	4468	my_pc.exe
Token: SeAssignPrimaryTokenPrivilege	4468	my_pc.exe
Token: SeCreateGlobalPrivilege	4468	my_pc.exe
Token: 33	4468	my_pc.exe
Token: SeDebugPrivilege	2168	explorer.exe
Token: SeRestorePrivilege	2168	explorer.exe
Token: SeBackupPrivilege	2168	explorer.exe
Token: SeLoadDriverPrivilege	2168	explorer.exe
Token: SeCreatePagefilePrivilege	2168	explorer.exe
Token: SeShutdownPrivilege	2168	explorer.exe
Token: SeTakeOwnershipPrivilege	2168	explorer.exe
Token: SeChangeNotifyPrivilege	2168	explorer.exe
Token: SeCreateTokenPrivilege	2168	explorer.exe
Token: SeMachineAccountPrivilege	2168	explorer.exe
Token: SeSecurityPrivilege	2168	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	2168	explorer.exe
Token: SeCreateGlobalPrivilege	2168	explorer.exe
Token: 33	2168	explorer.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.execmd.exemy_pc.exemy_pc.exe

description	pid	process	target process
PID 3232 wrote to memory of 4196	3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe	my_pc.exe
PID 3232 wrote to memory of 4196	3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe	my_pc.exe
PID 3232 wrote to memory of 4196	3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe	my_pc.exe
PID 3232 wrote to memory of 3428	3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe	cmd.exe
PID 3232 wrote to memory of 3428	3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe	cmd.exe
PID 3232 wrote to memory of 3428	3232	458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe	cmd.exe
PID 3428 wrote to memory of 3432	3428	cmd.exe	PING.EXE
PID 3428 wrote to memory of 3432	3428	cmd.exe	PING.EXE
PID 3428 wrote to memory of 3432	3428	cmd.exe	PING.EXE
PID 3428 wrote to memory of 3000	3428	cmd.exe	PING.EXE
PID 3428 wrote to memory of 3000	3428	cmd.exe	PING.EXE
PID 3428 wrote to memory of 3000	3428	cmd.exe	PING.EXE
PID 4196 wrote to memory of 4468	4196	my_pc.exe	my_pc.exe
PID 4196 wrote to memory of 4468	4196	my_pc.exe	my_pc.exe
PID 4196 wrote to memory of 4468	4196	my_pc.exe	my_pc.exe
PID 4196 wrote to memory of 4468	4196	my_pc.exe	my_pc.exe
PID 4468 wrote to memory of 2168	4468	my_pc.exe	explorer.exe
PID 4468 wrote to memory of 2168	4468	my_pc.exe	explorer.exe
PID 4468 wrote to memory of 2168	4468	my_pc.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe
"C:\Users\Admin\AppData\Local\Temp\458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232

C:\Users\Admin\AppData\Local\Temp\my_pc.exe
"C:\Users\Admin\AppData\Local\Temp\my_pc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4196

C:\Users\Admin\AppData\Local\Temp\my_pc.exe
"C:\Users\Admin\AppData\Local\Temp\my_pc.exe"
3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\458412e9c3954cb35d433c1347dd2349f823f6b92e0f63b19407527c81c5173a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 100
3⤵
- Runs ping.exe
PID:3432

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 900
3⤵
- Runs ping.exe
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

Credential Access

Discovery

Query Registry

4

System Information Discovery

6