nymaim | c7fa25f2c9d0c1edb55b3a214b69da8f1ae8515cdb2b15412133a6fcb643f0f6

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oobeldr.exe

Downloads MZ/PE file

Executes dropped EXE 25 IoCs

pid	Process
1624	zFaDmy1ZEQpNGLQ1NvQrsQ6a.exe
4412	xRdoH4bXqSPlf14b0j3JXSty.exe
4516	pPEIa_s1mjy6mWm3hDNOuOe7.exe
4796	HmZiVMeiNp9Nth24pSHRei5U.exe
4500	DCBqgMJ2BSpNJOD7kNyebjeu.exe
2712	s5CdHsKtiWppoBaYPcz5dBLv.exe
764	G8aT5BRYlRyAiOejLK89zIyT.exe
3684	Bwbi5NLxOYWRl4wcEAtE9FxL.exe
908	x4wxeL5cGHf3oCWkcImeKtlC.exe
688	BgSjDe78_CZFNR51ZgRu06Wv.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
4332	P3GQfwQoz87T_VmdbDvHxtC7.exe
4788	Bg71bDNIpDgbj2wakyQW33US.exe
2104	_daMAV552mCUH3njcohuTIPy.exe
3216	y8i96m2AN_ckIqquswPiH1PB.exe
1804	JBOzf5zVK9l8eFSbj3YO7LBq.exe
4248	Vype4Wwh0MZXmjWVMTmkJDVd.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
5068	frkvIm29L2O7c2zG5wFDO8yj.exe
4832	fk3rt74cHNEg_lOuLE32EPif.exe
4092	xRdoH4bXqSPlf14b0j3JXSty.exe
102824	_daMAV552mCUH3njcohuTIPy.exe
110032	build.exe
16492	Updater.exe
24040	oobeldr.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral4/files/0x0006000000022e5a-156.dat	vmprotect
behavioral4/files/0x0006000000022e5a-157.dat	vmprotect
behavioral4/memory/764-199-0x0000000140000000-0x0000000140608000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oobeldr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oobeldr.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	fk3rt74cHNEg_lOuLE32EPif.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DCBqgMJ2BSpNJOD7kNyebjeu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	_daMAV552mCUH3njcohuTIPy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Bg71bDNIpDgbj2wakyQW33US.exe

Loads dropped DLL 6 IoCs

pid	Process
74148	rundll32.exe
6952	rundll32.exe
110032	build.exe
110032	build.exe
55344	rundll32.exe
55344	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oobeldr.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
16	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	Install.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
16492	Updater.exe
24040	oobeldr.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115
PID 688 set thread context of 108332	688	BgSjDe78_CZFNR51ZgRu06Wv.exe	122
PID 908 set thread context of 110564	908	x4wxeL5cGHf3oCWkcImeKtlC.exe	124
PID 2712 set thread context of 58212	2712	s5CdHsKtiWppoBaYPcz5dBLv.exe	154
PID 1804 set thread context of 198016	1804	JBOzf5zVK9l8eFSbj3YO7LBq.exe	157
PID 4332 set thread context of 3664	4332	P3GQfwQoz87T_VmdbDvHxtC7.exe	158
PID 4788 set thread context of 6544	4788	Bg71bDNIpDgbj2wakyQW33US.exe	128

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
40888	764	WerFault.exe	104
6712	1624	WerFault.exe	92
7136	6952	WerFault.exe	132
7640	1624	WerFault.exe	92
8020	1624	WerFault.exe	92
40992	1624	WerFault.exe	92
41264	1624	WerFault.exe	92
55400	1624	WerFault.exe	92
55696	1624	WerFault.exe	92

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
24288	schtasks.exe
58200	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
56688	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
56348	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Install.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DCBqgMJ2BSpNJOD7kNyebjeu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	_daMAV552mCUH3njcohuTIPy.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	180	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4980	Install.exe
4980	Install.exe
4980	Install.exe
4980	Install.exe
4980	Install.exe
4980	Install.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
4788	Bg71bDNIpDgbj2wakyQW33US.exe
4788	Bg71bDNIpDgbj2wakyQW33US.exe
4788	Bg71bDNIpDgbj2wakyQW33US.exe
4832	fk3rt74cHNEg_lOuLE32EPif.exe
4832	fk3rt74cHNEg_lOuLE32EPif.exe
4832	fk3rt74cHNEg_lOuLE32EPif.exe
4788	Bg71bDNIpDgbj2wakyQW33US.exe
4788	Bg71bDNIpDgbj2wakyQW33US.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
2668	oN8_RQ2PKfttPRLRndykRc0j.exe
110564	AppLaunch.exe
110564	AppLaunch.exe
110564	AppLaunch.exe
108332	AppLaunch.exe
108332	AppLaunch.exe
108332	AppLaunch.exe
110032	build.exe
110032	build.exe
4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
4248	Vype4Wwh0MZXmjWVMTmkJDVd.exe
4248	Vype4Wwh0MZXmjWVMTmkJDVd.exe
4248	Vype4Wwh0MZXmjWVMTmkJDVd.exe
16492	Updater.exe
16492	Updater.exe
58212	RegAsm.exe
198016	AppLaunch.exe
3664	AppLaunch.exe
3664	AppLaunch.exe
198016	AppLaunch.exe
24040	oobeldr.exe
24040	oobeldr.exe
6544	InstallUtil.exe
6544	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	y8i96m2AN_ckIqquswPiH1PB.exe
Token: SeDebugPrivilege	5068	frkvIm29L2O7c2zG5wFDO8yj.exe
Token: SeDebugPrivilege	4788	Bg71bDNIpDgbj2wakyQW33US.exe
Token: SeDebugPrivilege	4832	fk3rt74cHNEg_lOuLE32EPif.exe
Token: SeDebugPrivilege	4692	05Wv19rL9bPKeJjLfxmcFhVC.exe
Token: SeDebugPrivilege	2668	oN8_RQ2PKfttPRLRndykRc0j.exe
Token: SeDebugPrivilege	110564	AppLaunch.exe
Token: SeDebugPrivilege	108332	AppLaunch.exe
Token: SeDebugPrivilege	4248	Vype4Wwh0MZXmjWVMTmkJDVd.exe
Token: SeDebugPrivilege	56348	taskkill.exe
Token: SeDebugPrivilege	2712	s5CdHsKtiWppoBaYPcz5dBLv.exe
Token: SeDebugPrivilege	58212	RegAsm.exe
Token: SeDebugPrivilege	198016	AppLaunch.exe
Token: SeDebugPrivilege	3664	AppLaunch.exe
Token: SeDebugPrivilege	6544	InstallUtil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1624	4980	Install.exe	92
PID 4980 wrote to memory of 1624	4980	Install.exe	92
PID 4980 wrote to memory of 1624	4980	Install.exe	92
PID 4980 wrote to memory of 4412	4980	Install.exe	91
PID 4980 wrote to memory of 4412	4980	Install.exe	91
PID 4980 wrote to memory of 4412	4980	Install.exe	91
PID 4980 wrote to memory of 4796	4980	Install.exe	90
PID 4980 wrote to memory of 4796	4980	Install.exe	90
PID 4980 wrote to memory of 4796	4980	Install.exe	90
PID 4980 wrote to memory of 4516	4980	Install.exe	89
PID 4980 wrote to memory of 4516	4980	Install.exe	89
PID 4980 wrote to memory of 4516	4980	Install.exe	89
PID 4980 wrote to memory of 2712	4980	Install.exe	88
PID 4980 wrote to memory of 2712	4980	Install.exe	88
PID 4980 wrote to memory of 2712	4980	Install.exe	88
PID 4980 wrote to memory of 4500	4980	Install.exe	87
PID 4980 wrote to memory of 4500	4980	Install.exe	87
PID 4980 wrote to memory of 4500	4980	Install.exe	87
PID 4980 wrote to memory of 764	4980	Install.exe	104
PID 4980 wrote to memory of 764	4980	Install.exe	104
PID 4980 wrote to memory of 3684	4980	Install.exe	103
PID 4980 wrote to memory of 3684	4980	Install.exe	103
PID 4980 wrote to memory of 3684	4980	Install.exe	103
PID 4980 wrote to memory of 908	4980	Install.exe	102
PID 4980 wrote to memory of 908	4980	Install.exe	102
PID 4980 wrote to memory of 908	4980	Install.exe	102
PID 4980 wrote to memory of 688	4980	Install.exe	101
PID 4980 wrote to memory of 688	4980	Install.exe	101
PID 4980 wrote to memory of 688	4980	Install.exe	101
PID 4980 wrote to memory of 4692	4980	Install.exe	100
PID 4980 wrote to memory of 4692	4980	Install.exe	100
PID 4980 wrote to memory of 4692	4980	Install.exe	100
PID 4980 wrote to memory of 4788	4980	Install.exe	99
PID 4980 wrote to memory of 4788	4980	Install.exe	99
PID 4980 wrote to memory of 4788	4980	Install.exe	99
PID 4980 wrote to memory of 3216	4980	Install.exe	97
PID 4980 wrote to memory of 3216	4980	Install.exe	97
PID 4980 wrote to memory of 2104	4980	Install.exe	98
PID 4980 wrote to memory of 2104	4980	Install.exe	98
PID 4980 wrote to memory of 2104	4980	Install.exe	98
PID 4980 wrote to memory of 4332	4980	Install.exe	96
PID 4980 wrote to memory of 4332	4980	Install.exe	96
PID 4980 wrote to memory of 4332	4980	Install.exe	96
PID 4980 wrote to memory of 1804	4980	Install.exe	95
PID 4980 wrote to memory of 1804	4980	Install.exe	95
PID 4980 wrote to memory of 1804	4980	Install.exe	95
PID 4980 wrote to memory of 4248	4980	Install.exe	94
PID 4980 wrote to memory of 4248	4980	Install.exe	94
PID 4980 wrote to memory of 4248	4980	Install.exe	94
PID 4980 wrote to memory of 2668	4980	Install.exe	93
PID 4980 wrote to memory of 2668	4980	Install.exe	93
PID 4980 wrote to memory of 2668	4980	Install.exe	93
PID 4980 wrote to memory of 5068	4980	Install.exe	109
PID 4980 wrote to memory of 5068	4980	Install.exe	109
PID 4980 wrote to memory of 4832	4980	Install.exe	108
PID 4980 wrote to memory of 4832	4980	Install.exe	108
PID 4980 wrote to memory of 4832	4980	Install.exe	108
PID 4412 wrote to memory of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115
PID 4412 wrote to memory of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115
PID 4412 wrote to memory of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115
PID 4412 wrote to memory of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115
PID 4412 wrote to memory of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115
PID 4412 wrote to memory of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115
PID 4412 wrote to memory of 4092	4412	xRdoH4bXqSPlf14b0j3JXSty.exe	115

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\Pictures\Minor Policy\DCBqgMJ2BSpNJOD7kNyebjeu.exe
  "C:\Users\Admin\Pictures\Minor Policy\DCBqgMJ2BSpNJOD7kNyebjeu.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  PID:4500
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\KD1pMY.cpL",
    3⤵
    PID:34364
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KD1pMY.cpL",
      4⤵
      Loads dropped DLL
      PID:74148
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KD1pMY.cpL",
        5⤵
        
        PID:55252
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\KD1pMY.cpL",
        6⤵
        Loads dropped DLL
        
        PID:55344
- C:\Users\Admin\Pictures\Minor Policy\s5CdHsKtiWppoBaYPcz5dBLv.exe
  "C:\Users\Admin\Pictures\Minor Policy\s5CdHsKtiWppoBaYPcz5dBLv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:58212
- C:\Users\Admin\Pictures\Minor Policy\pPEIa_s1mjy6mWm3hDNOuOe7.exe
  "C:\Users\Admin\Pictures\Minor Policy\pPEIa_s1mjy6mWm3hDNOuOe7.exe"
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Users\Admin\Pictures\Minor Policy\HmZiVMeiNp9Nth24pSHRei5U.exe
  "C:\Users\Admin\Pictures\Minor Policy\HmZiVMeiNp9Nth24pSHRei5U.exe"
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Users\Admin\Pictures\Minor Policy\xRdoH4bXqSPlf14b0j3JXSty.exe
  "C:\Users\Admin\Pictures\Minor Policy\xRdoH4bXqSPlf14b0j3JXSty.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\Pictures\Minor Policy\xRdoH4bXqSPlf14b0j3JXSty.exe
    "C:\Users\Admin\Pictures\Minor Policy\xRdoH4bXqSPlf14b0j3JXSty.exe"
    3⤵
    - Executes dropped EXE
    PID:4092
- C:\Users\Admin\Pictures\Minor Policy\zFaDmy1ZEQpNGLQ1NvQrsQ6a.exe
  "C:\Users\Admin\Pictures\Minor Policy\zFaDmy1ZEQpNGLQ1NvQrsQ6a.exe"
  2⤵
  - Executes dropped EXE
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 456
    3⤵
    - Program crash
    PID:6712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 764
    3⤵
    - Program crash
    PID:7640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 784
    3⤵
    - Program crash
    PID:8020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 816
    3⤵
    - Program crash
    PID:40992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 824
    3⤵
    - Program crash
    PID:41264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 984
    3⤵
    - Program crash
    PID:55400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 1016
    3⤵
    - Program crash
    PID:55696
- C:\Users\Admin\Pictures\Minor Policy\oN8_RQ2PKfttPRLRndykRc0j.exe
  "C:\Users\Admin\Pictures\Minor Policy\oN8_RQ2PKfttPRLRndykRc0j.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Users\Admin\Pictures\Minor Policy\Vype4Wwh0MZXmjWVMTmkJDVd.exe
  "C:\Users\Admin\Pictures\Minor Policy\Vype4Wwh0MZXmjWVMTmkJDVd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Users\Admin\Pictures\Minor Policy\JBOzf5zVK9l8eFSbj3YO7LBq.exe
  "C:\Users\Admin\Pictures\Minor Policy\JBOzf5zVK9l8eFSbj3YO7LBq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:198016
- C:\Users\Admin\Pictures\Minor Policy\P3GQfwQoz87T_VmdbDvHxtC7.exe
  "C:\Users\Admin\Pictures\Minor Policy\P3GQfwQoz87T_VmdbDvHxtC7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4332
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Users\Admin\Pictures\Minor Policy\y8i96m2AN_ckIqquswPiH1PB.exe
  "C:\Users\Admin\Pictures\Minor Policy\y8i96m2AN_ckIqquswPiH1PB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3216
- C:\Users\Admin\Pictures\Minor Policy\_daMAV552mCUH3njcohuTIPy.exe
  "C:\Users\Admin\Pictures\Minor Policy\_daMAV552mCUH3njcohuTIPy.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  PID:2104
- - C:\Users\Admin\Pictures\Minor Policy\_daMAV552mCUH3njcohuTIPy.exe
    "C:\Users\Admin\Pictures\Minor Policy\_daMAV552mCUH3njcohuTIPy.exe" -h
    3⤵
    - Executes dropped EXE
    PID:102824
- C:\Users\Admin\Pictures\Minor Policy\Bg71bDNIpDgbj2wakyQW33US.exe
  "C:\Users\Admin\Pictures\Minor Policy\Bg71bDNIpDgbj2wakyQW33US.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:110032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" à<Þ/c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe" & del C:\PrograData\*.dll & exit
      4⤵
      PID:55992
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:56348
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:56688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:110372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6544
- C:\Users\Admin\Pictures\Minor Policy\05Wv19rL9bPKeJjLfxmcFhVC.exe
  "C:\Users\Admin\Pictures\Minor Policy\05Wv19rL9bPKeJjLfxmcFhVC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Users\Admin\Pictures\Minor Policy\BgSjDe78_CZFNR51ZgRu06Wv.exe
  "C:\Users\Admin\Pictures\Minor Policy\BgSjDe78_CZFNR51ZgRu06Wv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:108332
- C:\Users\Admin\Pictures\Minor Policy\x4wxeL5cGHf3oCWkcImeKtlC.exe
  "C:\Users\Admin\Pictures\Minor Policy\x4wxeL5cGHf3oCWkcImeKtlC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:110564
- C:\Users\Admin\Pictures\Minor Policy\Bwbi5NLxOYWRl4wcEAtE9FxL.exe
  "C:\Users\Admin\Pictures\Minor Policy\Bwbi5NLxOYWRl4wcEAtE9FxL.exe"
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Users\Admin\Pictures\Minor Policy\G8aT5BRYlRyAiOejLK89zIyT.exe
  "C:\Users\Admin\Pictures\Minor Policy\G8aT5BRYlRyAiOejLK89zIyT.exe"
  2⤵
  - Executes dropped EXE
  PID:764
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 764 -s 476
    3⤵
    - Program crash
    PID:40888
- C:\Users\Admin\Pictures\Minor Policy\fk3rt74cHNEg_lOuLE32EPif.exe
  "C:\Users\Admin\Pictures\Minor Policy\fk3rt74cHNEg_lOuLE32EPif.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Updater.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:16492
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      4⤵
      Creates scheduled task(s)
      PID:58200
- C:\Users\Admin\Pictures\Minor Policy\frkvIm29L2O7c2zG5wFDO8yj.exe
  "C:\Users\Admin\Pictures\Minor Policy\frkvIm29L2O7c2zG5wFDO8yj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2192

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 764 -ip 764
1⤵
PID:31432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1624 -ip 1624
1⤵
PID:6636

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:6912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:6952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6952 -s 200
    3⤵
    - Program crash
    PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6952 -ip 6952
1⤵
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1624 -ip 1624
1⤵
PID:7592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1624 -ip 1624
1⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1624 -ip 1624
1⤵
PID:40924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1624 -ip 1624
1⤵
PID:41196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1624 -ip 1624
1⤵
PID:55336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1624 -ip 1624
1⤵
PID:55656

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:24040
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:24288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery