hawkeye | 1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

description	pid	process	target process
PID 1812 set thread context of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1920 set thread context of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 set thread context of 2548	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1812 set thread context of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 2700 set thread context of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 set thread context of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 set thread context of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 set thread context of 3912	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

pid	process
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exedw20.exe1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

description	pid	process
Token: SeDebugPrivilege	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
Token: SeDebugPrivilege	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
Token: SeRestorePrivilege	2744	dw20.exe
Token: SeBackupPrivilege	2744	dw20.exe
Token: SeBackupPrivilege	2744	dw20.exe
Token: SeBackupPrivilege	2744	dw20.exe
Token: SeBackupPrivilege	2744	dw20.exe
Token: SeDebugPrivilege	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe

description	pid	process	target process
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 1920	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1920 wrote to memory of 2548	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 2548	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 2548	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 4996	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 2548	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 2548	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 1920 wrote to memory of 2744	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	dw20.exe
PID 1920 wrote to memory of 2744	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	dw20.exe
PID 1920 wrote to memory of 2744	1920	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	dw20.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 1812 wrote to memory of 2700	1812	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3592	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 4832	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 544	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3912	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3912	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3912	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe
PID 2700 wrote to memory of 3912	2700	1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
"C:\Users\Admin\AppData\Local\Temp\1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\AppData\Local\Temp\1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
"C:\Users\Admin\AppData\Local\Temp\1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
PID:2548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt" /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:4996

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1992
3⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Users\Admin\AppData\Local\Temp\1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe
"C:\Users\Admin\AppData\Local\Temp\1716fcc758acb8523dc23fd6c36cd301dc302882066640d8ed278a533f1275bc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:3592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
PID:4832

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"
3⤵
PID:544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"
3⤵
PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

3

Peripheral Device Discovery

T1120

System Information Discovery

3

Lateral Movement

Collection

Email Collection