blacknet | c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

5397.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	5397.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	5397.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	5397.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	5397.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4508-191-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

4473.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4473.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4473.exe

Executes dropped EXE 16 IoCs

Processes:

C374.exeC4DC.exeC6A2.exeC374.exeC888.exeCC32.exeCE85.exeC374.exeC374.exebuild2.exebuild3.exebuild2.exe3E48.exe4473.exe5397.exe5397.exe

pid	process
1984	C374.exe
1912	C4DC.exe
4544	C6A2.exe
4036	C374.exe
208	C888.exe
5024	CC32.exe
2144	CE85.exe
4808	C374.exe
2488	C374.exe
4644	build2.exe
4072	build3.exe
456	build2.exe
3136	3E48.exe
3140	4473.exe
3128	5397.exe
1088	5397.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

4473.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4473.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4473.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

C374.exeC374.exebuild2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	C374.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	C374.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	build2.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exebuild2.exe

pid process

3664 regsvr32.exe
3664 regsvr32.exe
456 build2.exe
456 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

2556 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
3664	regsvr32.exe
3664	regsvr32.exe
456	build2.exe
456	build2.exe

pid	process
2556	icacls.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

5397.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	5397.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	5397.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

C374.exe5397.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7328d590-3f12-423a-a1fb-87369e167f59\\C374.exe\" --AutoStart"	C374.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MyClient\\GPUpdate.exe"	5397.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

4473.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4473.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 api.2ip.ua
13 api.2ip.ua
14 api.2ip.ua
35 api.2ip.ua
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4473.exe

pid process

3140 4473.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4473.exe

flow	ioc
36	api.2ip.ua
13	api.2ip.ua
14	api.2ip.ua
35	api.2ip.ua

pid	process
3140	4473.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

C374.exeC4DC.exeC374.exebuild2.exe5397.exe

description	pid	process	target process
PID 1984 set thread context of 4036	1984	C374.exe	C374.exe
PID 1912 set thread context of 4508	1912	C4DC.exe	vbc.exe
PID 4808 set thread context of 2488	4808	C374.exe	C374.exe
PID 4644 set thread context of 456	4644	build2.exe	build2.exe
PID 3128 set thread context of 1088	3128	5397.exe	5397.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4012	208	WerFault.exe	C888.exe
4020	5024	WerFault.exe	CC32.exe
2848	2144	WerFault.exe	CE85.exe
2100	1912	WerFault.exe	C4DC.exe
4796	1088	WerFault.exe	5397.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exeC6A2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C6A2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C6A2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C6A2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4304 schtasks.exe
636 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2720 timeout.exe

pid	process
4304	schtasks.exe
636	schtasks.exe

pid	process
2720	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe

pid	process
3756	c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe
3756	c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748
2748

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2748
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exeC6A2.exe

pid process

3756 c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe
2748
2748
2748
2748
4544 C6A2.exe

pid	process
2748

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

vbc.exe3E48.exe5397.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeDebugPrivilege	4508	vbc.exe
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeDebugPrivilege	3136	3E48.exe
Token: SeShutdownPrivilege	2748
Token: SeCreatePagefilePrivilege	2748
Token: SeDebugPrivilege	1088	5397.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5397.exe

pid process

1088 5397.exe
1088 5397.exe

pid	process
1088	5397.exe
1088	5397.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

C374.exeregsvr32.exeC374.exeC4DC.exeC374.exeC374.exe

description	pid	process	target process
PID 2748 wrote to memory of 1984	2748		C374.exe
PID 2748 wrote to memory of 1984	2748		C374.exe
PID 2748 wrote to memory of 1984	2748		C374.exe
PID 2748 wrote to memory of 1912	2748		C4DC.exe
PID 2748 wrote to memory of 1912	2748		C4DC.exe
PID 2748 wrote to memory of 1912	2748		C4DC.exe
PID 2748 wrote to memory of 4544	2748		C6A2.exe
PID 2748 wrote to memory of 4544	2748		C6A2.exe
PID 2748 wrote to memory of 4544	2748		C6A2.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 1984 wrote to memory of 4036	1984	C374.exe	C374.exe
PID 2748 wrote to memory of 208	2748		C888.exe
PID 2748 wrote to memory of 208	2748		C888.exe
PID 2748 wrote to memory of 208	2748		C888.exe
PID 2748 wrote to memory of 5024	2748		CC32.exe
PID 2748 wrote to memory of 5024	2748		CC32.exe
PID 2748 wrote to memory of 5024	2748		CC32.exe
PID 2748 wrote to memory of 2144	2748		CE85.exe
PID 2748 wrote to memory of 2144	2748		CE85.exe
PID 2748 wrote to memory of 2144	2748		CE85.exe
PID 2748 wrote to memory of 5060	2748		regsvr32.exe
PID 2748 wrote to memory of 5060	2748		regsvr32.exe
PID 2748 wrote to memory of 3972	2748		explorer.exe
PID 2748 wrote to memory of 3972	2748		explorer.exe
PID 2748 wrote to memory of 3972	2748		explorer.exe
PID 2748 wrote to memory of 3972	2748		explorer.exe
PID 5060 wrote to memory of 3664	5060	regsvr32.exe	regsvr32.exe
PID 5060 wrote to memory of 3664	5060	regsvr32.exe	regsvr32.exe
PID 5060 wrote to memory of 3664	5060	regsvr32.exe	regsvr32.exe
PID 2748 wrote to memory of 1288	2748		explorer.exe
PID 2748 wrote to memory of 1288	2748		explorer.exe
PID 2748 wrote to memory of 1288	2748		explorer.exe
PID 4036 wrote to memory of 2556	4036	C374.exe	icacls.exe
PID 4036 wrote to memory of 2556	4036	C374.exe	icacls.exe
PID 4036 wrote to memory of 2556	4036	C374.exe	icacls.exe
PID 1912 wrote to memory of 4508	1912	C4DC.exe	vbc.exe
PID 1912 wrote to memory of 4508	1912	C4DC.exe	vbc.exe
PID 1912 wrote to memory of 4508	1912	C4DC.exe	vbc.exe
PID 1912 wrote to memory of 4508	1912	C4DC.exe	vbc.exe
PID 1912 wrote to memory of 4508	1912	C4DC.exe	vbc.exe
PID 4036 wrote to memory of 4808	4036	C374.exe	C374.exe
PID 4036 wrote to memory of 4808	4036	C374.exe	C374.exe
PID 4036 wrote to memory of 4808	4036	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 4808 wrote to memory of 2488	4808	C374.exe	C374.exe
PID 2488 wrote to memory of 4644	2488	C374.exe	build2.exe
PID 2488 wrote to memory of 4644	2488	C374.exe	build2.exe
PID 2488 wrote to memory of 4644	2488	C374.exe	build2.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe
"C:\Users\Admin\AppData\Local\Temp\c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3756

C:\Users\Admin\AppData\Local\Temp\C374.exe
C:\Users\Admin\AppData\Local\Temp\C374.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\AppData\Local\Temp\C374.exe
C:\Users\Admin\AppData\Local\Temp\C374.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\7328d590-3f12-423a-a1fb-87369e167f59" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2556

C:\Users\Admin\AppData\Local\Temp\C374.exe
"C:\Users\Admin\AppData\Local\Temp\C374.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4808

C:\Users\Admin\AppData\Local\Temp\C374.exe
"C:\Users\Admin\AppData\Local\Temp\C374.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2488

C:\Users\Admin\AppData\Local\8fe5aa2e-5612-44b5-9ed6-9c814fb3374f\build2.exe
"C:\Users\Admin\AppData\Local\8fe5aa2e-5612-44b5-9ed6-9c814fb3374f\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4644

C:\Users\Admin\AppData\Local\8fe5aa2e-5612-44b5-9ed6-9c814fb3374f\build2.exe
"C:\Users\Admin\AppData\Local\8fe5aa2e-5612-44b5-9ed6-9c814fb3374f\build2.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\8fe5aa2e-5612-44b5-9ed6-9c814fb3374f\build2.exe" & exit
7⤵
PID:2504

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:2720

C:\Users\Admin\AppData\Local\8fe5aa2e-5612-44b5-9ed6-9c814fb3374f\build3.exe
"C:\Users\Admin\AppData\Local\8fe5aa2e-5612-44b5-9ed6-9c814fb3374f\build3.exe"
5⤵
- Executes dropped EXE
PID:4072

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:4304

C:\Users\Admin\AppData\Local\Temp\C4DC.exe
C:\Users\Admin\AppData\Local\Temp\C4DC.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 148
2⤵
- Program crash
PID:2100

C:\Users\Admin\AppData\Local\Temp\C6A2.exe
C:\Users\Admin\AppData\Local\Temp\C6A2.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4544

C:\Users\Admin\AppData\Local\Temp\C888.exe
C:\Users\Admin\AppData\Local\Temp\C888.exe
1⤵
- Executes dropped EXE
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 344
2⤵
- Program crash
PID:4012

C:\Users\Admin\AppData\Local\Temp\CC32.exe
C:\Users\Admin\AppData\Local\Temp\CC32.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 340
2⤵
- Program crash
PID:4020

C:\Users\Admin\AppData\Local\Temp\CE85.exe
C:\Users\Admin\AppData\Local\Temp\CE85.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 344
2⤵
- Program crash
PID:2848

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D145.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\D145.dll
2⤵
- Loads dropped DLL
PID:3664

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 208 -ip 208
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5024 -ip 5024
1⤵
PID:4524

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2144 -ip 2144
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1912 -ip 1912
1⤵
PID:3476

C:\Users\Admin\AppData\Local\Temp\3E48.exe
C:\Users\Admin\AppData\Local\Temp\3E48.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Users\Admin\AppData\Local\Temp\4473.exe
C:\Users\Admin\AppData\Local\Temp\4473.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3140

C:\Users\Admin\AppData\Local\Temp\5397.exe
C:\Users\Admin\AppData\Local\Temp\5397.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3128

C:\Users\Admin\AppData\Local\Temp\5397.exe
"C:\Users\Admin\AppData\Local\Temp\5397.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 2676
3⤵
- Program crash
PID:4796

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\RegStart"
2⤵
PID:3432

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe'" /f
2⤵
PID:4092

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe'" /f
3⤵
- Creates scheduled task(s)
PID:636

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\5397.exe" "C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe"
2⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1088 -ip 1088
1⤵
PID:4320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery