amadey | abd8284914e8bc1309c13903e7b41b1af552c80598982c9e8fbe35e88eda9315

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updChrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updChrome.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updChrome.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	oldplayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 15 IoCs

pid	Process
4848	11796175.exe
1604	oldplayer.exe
1776	oneetx.exe
1544	setup.exe
3104	updEdge.exe
2940	notepad.exe
2252	updChrome.exe
1412	toolspub2.exe
1664	toolspub2.exe
3356	updEdge.exe
2556	notepad.exe
4824	updChrome.exe
3324	3eef203fb515bda85f514e168abb5973.exe
4300	updEdge.exe
1500	notepad.exe

Themida packer 24 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x00070000000231fa-230.dat	themida
behavioral2/files/0x00070000000231fa-241.dat	themida
behavioral2/memory/2252-244-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/2252-266-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/2252-270-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/2252-267-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/2252-273-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/2252-275-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/files/0x00070000000231fa-295.dat	themida
behavioral2/memory/4824-296-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/2252-300-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/4824-309-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/4824-340-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/4824-344-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/4824-351-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/4824-330-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/files/0x00070000000231fa-384.dat	themida
behavioral2/memory/4936-397-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/4824-545-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/memory/2252-575-0x00007FF7B50D0000-0x00007FF7B5EA6000-memory.dmp	themida
behavioral2/files/0x00070000000231fa-556.dat	themida
behavioral2/files/0x000e0000000231e5-668.dat	themida
behavioral2/files/0x000e0000000231e5-676.dat	themida
behavioral2/files/0x0021000000023208-707.dat	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	notepad.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	notepad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updChrome.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updChrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2940	notepad.exe
2252	updChrome.exe
2556	sc.exe
4824	updChrome.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 1664	1412	toolspub2.exe	107
PID 3104 set thread context of 2760	3104	updEdge.exe	119

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3936	sc.exe
4920	sc.exe
4980	sc.exe
4308	sc.exe
5064	sc.exe
3772	sc.exe
3352	sc.exe
2224	sc.exe
820	sc.exe
4480	sc.exe
2556	sc.exe
4560	sc.exe
2960	sc.exe
4748	sc.exe
1176	sc.exe
2252	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4436	1544	WerFault.exe	97
4996	1544	WerFault.exe	97
3056	1544	WerFault.exe	97
4780	1544	WerFault.exe	97
3084	1544	WerFault.exe	97
4648	1544	WerFault.exe	97
4620	1544	WerFault.exe	97
4972	1544	WerFault.exe	97
3656	1544	WerFault.exe	97

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	11796175.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	11796175.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	11796175.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4792	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	37	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
1536	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4848	11796175.exe
4848	11796175.exe
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4848	11796175.exe
1664	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	664	Process not Found
Token: SeCreatePagefilePrivilege	664	Process not Found
Token: SeShutdownPrivilege	664	Process not Found
Token: SeCreatePagefilePrivilege	664	Process not Found
Token: SeShutdownPrivilege	664	Process not Found
Token: SeCreatePagefilePrivilege	664	Process not Found
Token: SeShutdownPrivilege	664	Process not Found
Token: SeCreatePagefilePrivilege	664	Process not Found
Token: SeDebugPrivilege	3104	updEdge.exe
Token: SeDebugPrivilege	3356	updEdge.exe
Token: SeShutdownPrivilege	664	Process not Found
Token: SeCreatePagefilePrivilege	664	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1604	oldplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4848	3380	file.exe	84
PID 3380 wrote to memory of 4848	3380	file.exe	84
PID 3380 wrote to memory of 4848	3380	file.exe	84
PID 3380 wrote to memory of 1604	3380	file.exe	85
PID 3380 wrote to memory of 1604	3380	file.exe	85
PID 3380 wrote to memory of 1604	3380	file.exe	85
PID 1604 wrote to memory of 1776	1604	oldplayer.exe	86
PID 1604 wrote to memory of 1776	1604	oldplayer.exe	86
PID 1604 wrote to memory of 1776	1604	oldplayer.exe	86
PID 1776 wrote to memory of 4792	1776	oneetx.exe	87
PID 1776 wrote to memory of 4792	1776	oneetx.exe	87
PID 1776 wrote to memory of 4792	1776	oneetx.exe	87
PID 1776 wrote to memory of 4564	1776	oneetx.exe	89
PID 1776 wrote to memory of 4564	1776	oneetx.exe	89
PID 1776 wrote to memory of 4564	1776	oneetx.exe	89
PID 4564 wrote to memory of 964	4564	cmd.exe	91
PID 4564 wrote to memory of 964	4564	cmd.exe	91
PID 4564 wrote to memory of 964	4564	cmd.exe	91
PID 4564 wrote to memory of 4932	4564	cmd.exe	92
PID 4564 wrote to memory of 4932	4564	cmd.exe	92
PID 4564 wrote to memory of 4932	4564	cmd.exe	92
PID 4564 wrote to memory of 2268	4564	cmd.exe	93
PID 4564 wrote to memory of 2268	4564	cmd.exe	93
PID 4564 wrote to memory of 2268	4564	cmd.exe	93
PID 4564 wrote to memory of 1688	4564	cmd.exe	94
PID 4564 wrote to memory of 1688	4564	cmd.exe	94
PID 4564 wrote to memory of 1688	4564	cmd.exe	94
PID 4564 wrote to memory of 1836	4564	cmd.exe	95
PID 4564 wrote to memory of 1836	4564	cmd.exe	95
PID 4564 wrote to memory of 1836	4564	cmd.exe	95
PID 4564 wrote to memory of 3196	4564	cmd.exe	96
PID 4564 wrote to memory of 3196	4564	cmd.exe	96
PID 4564 wrote to memory of 3196	4564	cmd.exe	96
PID 1776 wrote to memory of 1544	1776	oneetx.exe	97
PID 1776 wrote to memory of 1544	1776	oneetx.exe	97
PID 1776 wrote to memory of 1544	1776	oneetx.exe	97
PID 1776 wrote to memory of 3104	1776	oneetx.exe	101
PID 1776 wrote to memory of 3104	1776	oneetx.exe	101
PID 1776 wrote to memory of 3104	1776	oneetx.exe	101
PID 1776 wrote to memory of 2940	1776	oneetx.exe	102
PID 1776 wrote to memory of 2940	1776	oneetx.exe	102
PID 1776 wrote to memory of 2252	1776	oneetx.exe	105
PID 1776 wrote to memory of 2252	1776	oneetx.exe	105
PID 1776 wrote to memory of 1412	1776	oneetx.exe	106
PID 1776 wrote to memory of 1412	1776	oneetx.exe	106
PID 1776 wrote to memory of 1412	1776	oneetx.exe	106
PID 1412 wrote to memory of 1664	1412	toolspub2.exe	107
PID 1412 wrote to memory of 1664	1412	toolspub2.exe	107
PID 1412 wrote to memory of 1664	1412	toolspub2.exe	107
PID 1412 wrote to memory of 1664	1412	toolspub2.exe	107
PID 1412 wrote to memory of 1664	1412	toolspub2.exe	107
PID 1412 wrote to memory of 1664	1412	toolspub2.exe	107
PID 1776 wrote to memory of 3356	1776	oneetx.exe	109
PID 1776 wrote to memory of 3356	1776	oneetx.exe	109
PID 1776 wrote to memory of 3356	1776	oneetx.exe	109
PID 1776 wrote to memory of 2556	1776	oneetx.exe	113
PID 1776 wrote to memory of 2556	1776	oneetx.exe	113
PID 1776 wrote to memory of 4824	1776	oneetx.exe	115
PID 1776 wrote to memory of 4824	1776	oneetx.exe	115
PID 1776 wrote to memory of 3324	1776	oneetx.exe	116
PID 1776 wrote to memory of 3324	1776	oneetx.exe	116
PID 1776 wrote to memory of 3324	1776	oneetx.exe	116
PID 1776 wrote to memory of 4300	1776	oneetx.exe	117
PID 1776 wrote to memory of 4300	1776	oneetx.exe	117

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\11796175.exe
  "C:\Users\Admin\AppData\Local\Temp\11796175.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
  "C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:964
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4932
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:2268
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:N"
        5⤵
        
        PID:1836
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:R" /E
        5⤵
        
        PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\1000240001\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\1000240001\setup.exe"
      4⤵
      Executes dropped EXE
      PID:1544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 620
        5⤵
        Program crash
        
        PID:4436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 880
        5⤵
        Program crash
        
        PID:4996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 888
        5⤵
        Program crash
        
        PID:3056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 932
        5⤵
        Program crash
        
        PID:4780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 976
        5⤵
        Program crash
        
        PID:3084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1104
        5⤵
        Program crash
        
        PID:4648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1136
        5⤵
        Program crash
        
        PID:4620
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1460
        5⤵
        Program crash
        
        PID:4972
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000240001\setup.exe" & exit
        5⤵
        
        PID:2480
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        6⤵
        Kills process with taskkill
        
        PID:1536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 648
        5⤵
        Program crash
        
        PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe
      "C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:3104
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\chrome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
        6⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe
      "C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2940
    - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        5⤵
        
        PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe
      "C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe
      "C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3356
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe
      "C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"
      4⤵
      Executes dropped EXE
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe
      "C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe
      "C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe"
      4⤵
      Executes dropped EXE
      PID:3324
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe"
        5⤵
        
        PID:2204
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe
      "C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"
      4⤵
      Executes dropped EXE
      PID:4300
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\chrome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
        6⤵
        
        PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe
      "C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"
      4⤵
      Executes dropped EXE
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe
      "C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"
      4⤵
      PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1544 -ip 1544
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1544 -ip 1544
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1544 -ip 1544
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1544 -ip 1544
1⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1544 -ip 1544
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1544 -ip 1544
1⤵
PID:2956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1544 -ip 1544
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1544 -ip 1544
1⤵
PID:4244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1544 -ip 1544
1⤵
PID:4048

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
PID:2640

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:436
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3772
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3352
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3936
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:4748
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:2224

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:8
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:388
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:4472
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:3208
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gzjter#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:4244

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:2596
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4920
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1176
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4560
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:4308
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:4480

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:2592
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4980
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:820
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2960
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:5064
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Launches sc.exe
  PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gzjter#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:3164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gzjter#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:3620

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:4024

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:1152
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:3124
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:3040
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:3376
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:716

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:3256
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:2428
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:3808
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:3944
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1952

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:4148

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:1128

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:1148

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
PID:884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:3600

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:1656
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery