asyncrat | 7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7

Modify Existing Service

T1031

Disabling Security Tools

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3284-194-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

Modify Registry

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe = "0"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4524-177-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

Executes dropped EXE 10 IoCs

Processes:

DD8989123MD.exeK8MN9DA.exeLunaInjector.exeSHA90123M17.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exe

pid	process
2724	DD8989123MD.exe
1348	K8MN9DA.exe
4660	LunaInjector.exe
1332	SHA90123M17.exe
4524	K8MN9DA.exe
4720	DD8989123MD.exe
2352	SHA90123M17.exe
5048	SHA90123M17.exe
3644	SHA90123M17.exe
3284	SHA90123M17.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

SHA90123M17.exe7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exeK8MN9DA.exeDD8989123MD.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHA90123M17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	K8MN9DA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DD8989123MD.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

Modify Registry

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe = "0"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

25 ip-api.com

flow	ioc
25	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 50 IoCs

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exe

pid	process
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exe

description	pid	process	target process
PID 4844 set thread context of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 1348 set thread context of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 2724 set thread context of 4720	2724	DD8989123MD.exe	DD8989123MD.exe
PID 1332 set thread context of 3284	1332	SHA90123M17.exe	SHA90123M17.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2360	4844	WerFault.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
3552	1348	WerFault.exe	K8MN9DA.exe
4412	2724	WerFault.exe	DD8989123MD.exe
4160	1332	WerFault.exe	SHA90123M17.exe
3168	3092	WerFault.exe	windows.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

5024 schtasks.exe
116 schtasks.exe
4400 schtasks.exe
Delays execution with timeout.exe 7 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

4204 timeout.exe
3224 timeout.exe
4796 timeout.exe
3608 timeout.exe
4392 timeout.exe
1768 timeout.exe
1800 timeout.exe

pid	process
5024	schtasks.exe
116	schtasks.exe
4400	schtasks.exe

pid	process
4204	timeout.exe
3224	timeout.exe
4796	timeout.exe
3608	timeout.exe
4392	timeout.exe
1768	timeout.exe
1800	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

powershell.exe7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exe

pid	process
3620	powershell.exe
3620	powershell.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
1348	K8MN9DA.exe
1348	K8MN9DA.exe
2724	DD8989123MD.exe
2724	DD8989123MD.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe
1332	SHA90123M17.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exepowershell.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exe

description	pid	process
Token: SeDebugPrivilege	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	1348	K8MN9DA.exe
Token: SeDebugPrivilege	2724	DD8989123MD.exe
Token: SeDebugPrivilege	1332	SHA90123M17.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.execmd.exe7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exeLunaInjector.exeDD8989123MD.exeK8MN9DA.execmd.execmd.execmd.exeSHA90123M17.execmd.exe

description	pid	process	target process
PID 4844 wrote to memory of 3620	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	powershell.exe
PID 4844 wrote to memory of 3620	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	powershell.exe
PID 4844 wrote to memory of 3620	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	powershell.exe
PID 4844 wrote to memory of 3336	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	cmd.exe
PID 4844 wrote to memory of 3336	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	cmd.exe
PID 4844 wrote to memory of 3336	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	cmd.exe
PID 3336 wrote to memory of 4392	3336	cmd.exe	timeout.exe
PID 3336 wrote to memory of 4392	3336	cmd.exe	timeout.exe
PID 3336 wrote to memory of 4392	3336	cmd.exe	timeout.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4844 wrote to memory of 4612	4844	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
PID 4612 wrote to memory of 2724	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	DD8989123MD.exe
PID 4612 wrote to memory of 2724	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	DD8989123MD.exe
PID 4612 wrote to memory of 2724	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	DD8989123MD.exe
PID 4612 wrote to memory of 1348	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	K8MN9DA.exe
PID 4612 wrote to memory of 1348	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	K8MN9DA.exe
PID 4612 wrote to memory of 1348	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	K8MN9DA.exe
PID 4612 wrote to memory of 4660	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	LunaInjector.exe
PID 4612 wrote to memory of 4660	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	LunaInjector.exe
PID 4612 wrote to memory of 4660	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	LunaInjector.exe
PID 4612 wrote to memory of 1332	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	SHA90123M17.exe
PID 4612 wrote to memory of 1332	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	SHA90123M17.exe
PID 4612 wrote to memory of 1332	4612	7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe	SHA90123M17.exe
PID 4660 wrote to memory of 4164	4660	LunaInjector.exe	cmd.exe
PID 4660 wrote to memory of 4164	4660	LunaInjector.exe	cmd.exe
PID 2724 wrote to memory of 5108	2724	DD8989123MD.exe	cmd.exe
PID 2724 wrote to memory of 5108	2724	DD8989123MD.exe	cmd.exe
PID 2724 wrote to memory of 5108	2724	DD8989123MD.exe	cmd.exe
PID 1348 wrote to memory of 3020	1348	K8MN9DA.exe	cmd.exe
PID 1348 wrote to memory of 3020	1348	K8MN9DA.exe	cmd.exe
PID 1348 wrote to memory of 3020	1348	K8MN9DA.exe	cmd.exe
PID 5108 wrote to memory of 1768	5108	cmd.exe	timeout.exe
PID 5108 wrote to memory of 1768	5108	cmd.exe	timeout.exe
PID 5108 wrote to memory of 1768	5108	cmd.exe	timeout.exe
PID 4164 wrote to memory of 4032	4164	cmd.exe	chcp.com
PID 4164 wrote to memory of 4032	4164	cmd.exe	chcp.com
PID 3020 wrote to memory of 1800	3020	cmd.exe	timeout.exe
PID 3020 wrote to memory of 1800	3020	cmd.exe	timeout.exe
PID 3020 wrote to memory of 1800	3020	cmd.exe	timeout.exe
PID 1332 wrote to memory of 3468	1332	SHA90123M17.exe	cmd.exe
PID 1332 wrote to memory of 3468	1332	SHA90123M17.exe	cmd.exe
PID 1332 wrote to memory of 3468	1332	SHA90123M17.exe	cmd.exe
PID 4164 wrote to memory of 4636	4164	cmd.exe	mode.com
PID 4164 wrote to memory of 4636	4164	cmd.exe	mode.com
PID 3468 wrote to memory of 4204	3468	cmd.exe	timeout.exe
PID 3468 wrote to memory of 4204	3468	cmd.exe	timeout.exe
PID 3468 wrote to memory of 4204	3468	cmd.exe	timeout.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 1348 wrote to memory of 4524	1348	K8MN9DA.exe	K8MN9DA.exe
PID 2724 wrote to memory of 4720	2724	DD8989123MD.exe	DD8989123MD.exe
PID 2724 wrote to memory of 4720	2724	DD8989123MD.exe	DD8989123MD.exe
PID 2724 wrote to memory of 4720	2724	DD8989123MD.exe	DD8989123MD.exe

C:\Users\Admin\AppData\Local\Temp\7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
"C:\Users\Admin\AppData\Local\Temp\7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:3336

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:4392

C:\Users\Admin\AppData\Local\Temp\7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe
"C:\Users\Admin\AppData\Local\Temp\7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4612

C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
"C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:1768

C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
"C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
4⤵
- Executes dropped EXE
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 984
4⤵
- Program crash
PID:4412

C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
"C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:1800

C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
"C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
4⤵
- Executes dropped EXE
PID:4524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"' & exit
5⤵
PID:848

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"'
6⤵
- Creates scheduled task(s)
PID:116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1D8A.tmp.bat""
5⤵
PID:4892

C:\Windows\SysWOW64\timeout.exe
timeout 3
6⤵
- Delays execution with timeout.exe
PID:4796

C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"
6⤵
PID:4156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
7⤵
PID:4784

C:\Windows\SysWOW64\timeout.exe
timeout 1
8⤵
- Delays execution with timeout.exe
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 1472
4⤵
- Program crash
PID:3552

C:\Users\Admin\AppData\Roaming\LunaInjector.exe
"C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F7A3.tmp\F7A4.tmp\F7A5.bat C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\system32\chcp.com
chcp 65001
5⤵
PID:4032

C:\Windows\system32\mode.com
mode 82,24
5⤵
PID:4636

C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
"C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:4204

C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
"C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
4⤵
- Executes dropped EXE
PID:2352

C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
"C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
4⤵
- Executes dropped EXE
PID:5048

C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
"C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
4⤵
- Executes dropped EXE
PID:3284

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:5024

C:\Users\Admin\AppData\Roaming\$windows\windows.exe
"C:\Users\Admin\AppData\Roaming\$windows\windows.exe"
5⤵
PID:3092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
PID:3804

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:3224

C:\Users\Admin\AppData\Roaming\$windows\windows.exe
"C:\Users\Admin\AppData\Roaming\$windows\windows.exe"
6⤵
PID:5020

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$windows\windows.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:4400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6A1F8gAdKXHS.bat" "
7⤵
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 1052
6⤵
- Program crash
PID:3168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
5⤵
PID:2064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
5⤵
PID:1284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
6⤵
PID:4932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jJv8JB4mid7E.bat" "
5⤵
PID:4388

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:3388

C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
"C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
4⤵
- Executes dropped EXE
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1188
4⤵
- Program crash
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 2212
2⤵
- Program crash
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4844 -ip 4844
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1348 -ip 1348
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2724 -ip 2724
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1332 -ip 1332
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3092 -ip 3092
1⤵
PID:3840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery