betabot | 003d956c79e94020bd1c15c118ed6533a76cc1932ed5c05dd303d3b7564739e3

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe

Executes dropped EXE 3 IoCs

Processes:

Gozip.exemiktotik.exemiktotik.exe

pid process

2400 Gozip.exe
3804 miktotik.exe
4176 miktotik.exe

pid	process
2400	Gozip.exe
3804	miktotik.exe
4176	miktotik.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

miktotik.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agao3ew5akqy7k9.exe\DisableExceptionChainValidation	miktotik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "bqbhvllvhp.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agao3ew5akqy7k9.exe	miktotik.exe

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1060 attrib.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

pid	process
1060	attrib.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

WScript.exeCFDI_826271_53535.exeWScript.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	CFDI_826271_53535.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\agao3ew5akqy7k9.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\agao3ew5akqy7k9.exe\""	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

miktotik.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA miktotik.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

miktotik.exeexplorer.exe

pid process

4176 miktotik.exe
1540 explorer.exe
1540 explorer.exe
1540 explorer.exe
1540 explorer.exe
1540 explorer.exe
1540 explorer.exe
1540 explorer.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

miktotik.exe

description pid process target process

PID 3804 set thread context of 4176 3804 miktotik.exe miktotik.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5108 1540 WerFault.exe explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	miktotik.exe

pid	process
4176	miktotik.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe

description	pid	process	target process
PID 3804 set thread context of 4176	3804	miktotik.exe	miktotik.exe

pid	pid_target	process	target process
5108	1540	WerFault.exe	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

miktotik.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	miktotik.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	miktotik.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Delays execution with timeout.exe 5 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

1972 timeout.exe
1068 timeout.exe
3988 timeout.exe
4604 timeout.exe
736 timeout.exe

pid	process
1972	timeout.exe
1068	timeout.exe
3988	timeout.exe
4604	timeout.exe
736	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3960 taskkill.exe
1244 taskkill.exe

pid	process
3960	taskkill.exe
1244	taskkill.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 2 IoCs

Processes:

CFDI_826271_53535.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	CFDI_826271_53535.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

explorer.exe

pid process

1540 explorer.exe
1540 explorer.exe
1540 explorer.exe
1540 explorer.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

miktotik.exeexplorer.exe

pid process

4176 miktotik.exe
4176 miktotik.exe
1540 explorer.exe
1540 explorer.exe

pid	process
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe

pid	process
4176	miktotik.exe
4176	miktotik.exe
1540	explorer.exe
1540	explorer.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

taskkill.exemiktotik.exetaskkill.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	4176	miktotik.exe
Token: SeRestorePrivilege	4176	miktotik.exe
Token: SeBackupPrivilege	4176	miktotik.exe
Token: SeLoadDriverPrivilege	4176	miktotik.exe
Token: SeCreatePagefilePrivilege	4176	miktotik.exe
Token: SeShutdownPrivilege	4176	miktotik.exe
Token: SeTakeOwnershipPrivilege	4176	miktotik.exe
Token: SeChangeNotifyPrivilege	4176	miktotik.exe
Token: SeCreateTokenPrivilege	4176	miktotik.exe
Token: SeMachineAccountPrivilege	4176	miktotik.exe
Token: SeSecurityPrivilege	4176	miktotik.exe
Token: SeAssignPrimaryTokenPrivilege	4176	miktotik.exe
Token: SeCreateGlobalPrivilege	4176	miktotik.exe
Token: 33	4176	miktotik.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	1540	explorer.exe
Token: SeRestorePrivilege	1540	explorer.exe
Token: SeBackupPrivilege	1540	explorer.exe
Token: SeLoadDriverPrivilege	1540	explorer.exe
Token: SeCreatePagefilePrivilege	1540	explorer.exe
Token: SeShutdownPrivilege	1540	explorer.exe
Token: SeTakeOwnershipPrivilege	1540	explorer.exe
Token: SeChangeNotifyPrivilege	1540	explorer.exe
Token: SeCreateTokenPrivilege	1540	explorer.exe
Token: SeMachineAccountPrivilege	1540	explorer.exe
Token: SeSecurityPrivilege	1540	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	1540	explorer.exe
Token: SeCreateGlobalPrivilege	1540	explorer.exe
Token: 33	1540	explorer.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

CFDI_826271_53535.exeWScript.execmd.exeWScript.execmd.exemiktotik.exemiktotik.exeexplorer.exe

description	pid	process	target process
PID 4812 wrote to memory of 672	4812	CFDI_826271_53535.exe	WScript.exe
PID 4812 wrote to memory of 672	4812	CFDI_826271_53535.exe	WScript.exe
PID 4812 wrote to memory of 672	4812	CFDI_826271_53535.exe	WScript.exe
PID 672 wrote to memory of 2504	672	WScript.exe	cmd.exe
PID 672 wrote to memory of 2504	672	WScript.exe	cmd.exe
PID 672 wrote to memory of 2504	672	WScript.exe	cmd.exe
PID 2504 wrote to memory of 736	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 736	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 736	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 2400	2504	cmd.exe	Gozip.exe
PID 2504 wrote to memory of 2400	2504	cmd.exe	Gozip.exe
PID 2504 wrote to memory of 2400	2504	cmd.exe	Gozip.exe
PID 2504 wrote to memory of 1972	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 1972	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 1972	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 2568	2504	cmd.exe	WScript.exe
PID 2504 wrote to memory of 2568	2504	cmd.exe	WScript.exe
PID 2504 wrote to memory of 2568	2504	cmd.exe	WScript.exe
PID 2504 wrote to memory of 1068	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 1068	2504	cmd.exe	timeout.exe
PID 2504 wrote to memory of 1068	2504	cmd.exe	timeout.exe
PID 2568 wrote to memory of 4696	2568	WScript.exe	cmd.exe
PID 2568 wrote to memory of 4696	2568	WScript.exe	cmd.exe
PID 2568 wrote to memory of 4696	2568	WScript.exe	cmd.exe
PID 4696 wrote to memory of 1060	4696	cmd.exe	attrib.exe
PID 4696 wrote to memory of 1060	4696	cmd.exe	attrib.exe
PID 4696 wrote to memory of 1060	4696	cmd.exe	attrib.exe
PID 4696 wrote to memory of 3988	4696	cmd.exe	timeout.exe
PID 4696 wrote to memory of 3988	4696	cmd.exe	timeout.exe
PID 4696 wrote to memory of 3988	4696	cmd.exe	timeout.exe
PID 4696 wrote to memory of 3804	4696	cmd.exe	miktotik.exe
PID 4696 wrote to memory of 3804	4696	cmd.exe	miktotik.exe
PID 4696 wrote to memory of 3804	4696	cmd.exe	miktotik.exe
PID 3804 wrote to memory of 4176	3804	miktotik.exe	miktotik.exe
PID 3804 wrote to memory of 4176	3804	miktotik.exe	miktotik.exe
PID 3804 wrote to memory of 4176	3804	miktotik.exe	miktotik.exe
PID 3804 wrote to memory of 4176	3804	miktotik.exe	miktotik.exe
PID 3804 wrote to memory of 4176	3804	miktotik.exe	miktotik.exe
PID 4696 wrote to memory of 3960	4696	cmd.exe	taskkill.exe
PID 4696 wrote to memory of 3960	4696	cmd.exe	taskkill.exe
PID 4696 wrote to memory of 3960	4696	cmd.exe	taskkill.exe
PID 4696 wrote to memory of 1244	4696	cmd.exe	taskkill.exe
PID 4696 wrote to memory of 1244	4696	cmd.exe	taskkill.exe
PID 4696 wrote to memory of 1244	4696	cmd.exe	taskkill.exe
PID 4696 wrote to memory of 4180	4696	cmd.exe	attrib.exe
PID 4696 wrote to memory of 4180	4696	cmd.exe	attrib.exe
PID 4696 wrote to memory of 4180	4696	cmd.exe	attrib.exe
PID 4696 wrote to memory of 4604	4696	cmd.exe	timeout.exe
PID 4696 wrote to memory of 4604	4696	cmd.exe	timeout.exe
PID 4696 wrote to memory of 4604	4696	cmd.exe	timeout.exe
PID 4176 wrote to memory of 1540	4176	miktotik.exe	explorer.exe
PID 4176 wrote to memory of 1540	4176	miktotik.exe	explorer.exe
PID 4176 wrote to memory of 1540	4176	miktotik.exe	explorer.exe
PID 1540 wrote to memory of 2504	1540	explorer.exe	cmd.exe
PID 1540 wrote to memory of 2504	1540	explorer.exe	cmd.exe
PID 1540 wrote to memory of 1068	1540	explorer.exe	timeout.exe
PID 1540 wrote to memory of 1068	1540	explorer.exe	timeout.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1060 attrib.exe
4180 attrib.exe

pid	process
1060	attrib.exe
4180	attrib.exe

C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe
"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4812

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat" "
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\timeout.exe
timeout 7
4⤵
- Delays execution with timeout.exe
PID:736

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
"Gozip.exe" e -p398FsVBddjkd8cwr nmh3745.rar
4⤵
- Executes dropped EXE
PID:2400

C:\Windows\SysWOW64\timeout.exe
timeout 6
4⤵
- Delays execution with timeout.exe
PID:1972

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Users\Admin\AppData\Roaming\controllevel"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1060

C:\Windows\SysWOW64\timeout.exe
timeout 1
6⤵
- Delays execution with timeout.exe
PID:3988

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
miktotik.exe /start
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3804

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
miktotik.exe /start
7⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
8⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1060
9⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gozip.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gozip.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\SysWOW64\attrib.exe
attrib -s -h "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef"
6⤵
- Views/modifies file attributes
PID:4180

C:\Windows\SysWOW64\timeout.exe
timeout 4
6⤵
- Delays execution with timeout.exe
PID:4604

C:\Windows\SysWOW64\timeout.exe
timeout 8
4⤵
- Delays execution with timeout.exe
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1540 -ip 1540
1⤵
PID:2372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

System Information Discovery