bitrat | a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07

Virtualization/Sandbox Evasion

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

Executes dropped EXE 2 IoCs

Processes:

Bypass.exeDefender.exe

pid process

1384 Bypass.exe
1988 Defender.exe

pid	process
1384	Bypass.exe
1988	Defender.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

MSBuild.exe

pid process

176 MSBuild.exe
176 MSBuild.exe
176 MSBuild.exe
176 MSBuild.exe

pid	process
176	MSBuild.exe
176	MSBuild.exe
176	MSBuild.exe
176	MSBuild.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exeMSBuild.exe

description	pid	process	target process
PID 844 set thread context of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 3992 set thread context of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 set thread context of 176	3992	MSBuild.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2168 1384 WerFault.exe Bypass.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

636 schtasks.exe

pid	pid_target	process	target process
2168	1384	WerFault.exe	Bypass.exe

pid	process
636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

pid	process
844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe
844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe
844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe
Token: SeShutdownPrivilege	176	MSBuild.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSBuild.exe

pid process

176 MSBuild.exe
176 MSBuild.exe

pid	process
176	MSBuild.exe
176	MSBuild.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exeMSBuild.exeMSBuild.execmd.exeBypass.exe

description	pid	process	target process
PID 844 wrote to memory of 636	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	schtasks.exe
PID 844 wrote to memory of 636	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	schtasks.exe
PID 844 wrote to memory of 636	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	schtasks.exe
PID 844 wrote to memory of 4044	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 4044	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 4044	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 844 wrote to memory of 3992	844	a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 236	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 3992 wrote to memory of 176	3992	MSBuild.exe	MSBuild.exe
PID 236 wrote to memory of 2664	236	MSBuild.exe	cmd.exe
PID 236 wrote to memory of 2664	236	MSBuild.exe	cmd.exe
PID 2664 wrote to memory of 1384	2664	cmd.exe	Bypass.exe
PID 2664 wrote to memory of 1384	2664	cmd.exe	Bypass.exe
PID 2664 wrote to memory of 1384	2664	cmd.exe	Bypass.exe
PID 1384 wrote to memory of 1988	1384	Bypass.exe	Defender.exe
PID 1384 wrote to memory of 1988	1384	Bypass.exe	Defender.exe
PID 1384 wrote to memory of 1988	1384	Bypass.exe	Defender.exe
PID 1384 wrote to memory of 2168	1384	Bypass.exe	WerFault.exe
PID 1384 wrote to memory of 2168	1384	Bypass.exe	WerFault.exe
PID 1384 wrote to memory of 2168	1384	Bypass.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe
"C:\Users\Admin\AppData\Local\Temp\a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uskPBklHAI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5186.tmp"
2⤵
- Creates scheduled task(s)
PID:636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:4044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:236

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\85B5.tmp\85C6.tmp\85C7.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\85B5.tmp\Bypass.exe
Bypass.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384

C:\Users\Admin\AppData\Local\Temp\Defender.exe
"C:\Users\Admin\AppData\Local\Temp\Defender.exe" /D
6⤵
- Executes dropped EXE
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 832
6⤵
- Program crash
PID:2168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1384 -ip 1384
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

Virtualization/Sandbox Evasion

2