netwire | e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1

Virtualization/Sandbox Evasion

Processes:

e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exeSystemBooster.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	SystemBooster.exe

Executes dropped EXE 1 IoCs

Processes:

SystemBooster.exe

pid process

1676 SystemBooster.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exeSystemBooster.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	SystemBooster.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

Processes:

SystemBooster.exee65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SystemBooster.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SystemBooster.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

Loads dropped DLL 1 IoCs

Processes:

e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

pid process

1972 e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

pid	process
1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exeSystemBooster.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SystemBooster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	SystemBooster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

Drops file in System32 directory 2 IoCs

Processes:

e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\SystemBooster.exe	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe
File opened for modification	C:\Windows\SysWOW64\SystemBooster.exe	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

SystemBooster.exe

description	pid	process	target process
PID 1676 set thread context of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 set thread context of 700	1676	SystemBooster.exe	RegAsm.exe

Drops file in Windows directory 2 IoCs

Processes:

RegAsm.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	RegAsm.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1328 schtasks.exe

pid	process
1328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

SystemBooster.exe

pid	process
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe
1676	SystemBooster.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exeSystemBooster.exe

description	pid	process
Token: SeDebugPrivilege	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe
Token: SeDebugPrivilege	1676	SystemBooster.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exeSystemBooster.exe

description	pid	process	target process
PID 1972 wrote to memory of 1676	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	SystemBooster.exe
PID 1972 wrote to memory of 1676	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	SystemBooster.exe
PID 1972 wrote to memory of 1676	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	SystemBooster.exe
PID 1972 wrote to memory of 1676	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	SystemBooster.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 1796	1676	SystemBooster.exe	RegAsm.exe
PID 1676 wrote to memory of 700	1676	SystemBooster.exe	RegAsm.exe
PID 1972 wrote to memory of 1328	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	schtasks.exe
PID 1972 wrote to memory of 1328	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	schtasks.exe
PID 1972 wrote to memory of 1328	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	schtasks.exe
PID 1972 wrote to memory of 1328	1972	e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe
"C:\Users\Admin\AppData\Local\Temp\e65a63374804040e16bbc0027f16f1863e292071f80883915e2521ea7d2c13a1.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\SystemBooster.exe
"C:\Windows\system32\SystemBooster.exe"
2⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
3⤵
- Drops file in Windows directory
PID:1796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
3⤵
PID:700

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /SC MINUTE /TN Booster /TR C:\Windows\system32\SystemBooster.exe
2⤵
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\taskeng.exe
taskeng.exe {1C066531-28C6-4E51-95C0-47D5BCFF0532} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

Credential Access

Discovery

Query Registry

4

Virtualization/Sandbox Evasion

2

System Information Discovery

3

T1082

Peripheral Device Discovery