amadey | 1590e13b0bac57f3539e1663ac7ba290d9ef91d3b40a0b9ee8cd148f35689048

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winlog.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winlog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winlog.exe

Deletes itself 1 IoCs

pid	Process
1208	Process not Found

Executes dropped EXE 32 IoCs

pid	Process
2384	B7AB.exe
2640	BB64.exe
2732	B7AB.exe
2756	CA91.exe
2496	yiueea.exe
1052	toolspub2.exe
2596	taskhost.exe
2400	B7AB.exe
1812	DCBB.exe
2420	winlog.exe
948	E96B.exe
1876	EB50.exe
1840	20E.exe
2808	msedge.exe
2644	1273.exe
2204	yiueea.exe
616	31B7.exe
1300	38D9.exe
548	3A22.exe
2700	3CE1.exe
1312	31839b57a4f11171d6abc8bbc4451ee4.exe
3012	taskhost.exe
884	53CB.exe
2444	ntlhost.exe
1592	winlog.exe
2216	5DFB.exe
1660	msedge.exe
2816	aafg31.exe
2740	62CC.exe
2696	taskhost.exe
2688	winlog.exe
1720	msedge.exe

Loads dropped DLL 24 IoCs

pid	Process
2384	B7AB.exe
2756	CA91.exe
2496	yiueea.exe
2496	yiueea.exe
2496	yiueea.exe
2732	B7AB.exe
2732	B7AB.exe
2496	yiueea.exe
688	regsvr32.exe
2496	yiueea.exe
876	regsvr32.exe
2532	regsvr32.exe
2224	regsvr32.exe
2496	yiueea.exe
2496	yiueea.exe
2496	yiueea.exe
2420	winlog.exe
2496	yiueea.exe
2496	yiueea.exe
2496	yiueea.exe
2496	yiueea.exe
2496	yiueea.exe
2496	yiueea.exe
2496	yiueea.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1408	icacls.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	winlog.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e5c1bb69-51fb-40eb-9958-cd405e84a26a\\B7AB.exe\" --AutoStart"	B7AB.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlog.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.2ip.ua
10	api.2ip.ua
54	api.2ip.ua
60	api.2ip.ua
62	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2420	winlog.exe
1592	winlog.exe
2688	winlog.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 2732	2384	B7AB.exe	30
PID 2596 set thread context of 2736	2596	taskhost.exe	65
PID 2640 set thread context of 2824	2640	BB64.exe	67
PID 1300 set thread context of 1324	1300	38D9.exe	78
PID 548 set thread context of 1096	548	3A22.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2456	schtasks.exe
1992	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	35	Go-http-client/1.1

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	B7AB.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	B7AB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	aafg31.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	aafg31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	B7AB.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1292	file.exe
1292	file.exe
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1292	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	BB64.exe
Token: SeDebugPrivilege	2824	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2384	1208	Process not Found	28
PID 1208 wrote to memory of 2384	1208	Process not Found	28
PID 1208 wrote to memory of 2384	1208	Process not Found	28
PID 1208 wrote to memory of 2384	1208	Process not Found	28
PID 1208 wrote to memory of 2640	1208	Process not Found	29
PID 1208 wrote to memory of 2640	1208	Process not Found	29
PID 1208 wrote to memory of 2640	1208	Process not Found	29
PID 1208 wrote to memory of 2640	1208	Process not Found	29
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 2384 wrote to memory of 2732	2384	B7AB.exe	30
PID 1208 wrote to memory of 2756	1208	Process not Found	31
PID 1208 wrote to memory of 2756	1208	Process not Found	31
PID 1208 wrote to memory of 2756	1208	Process not Found	31
PID 1208 wrote to memory of 2756	1208	Process not Found	31
PID 2756 wrote to memory of 2496	2756	CA91.exe	33
PID 2756 wrote to memory of 2496	2756	CA91.exe	33
PID 2756 wrote to memory of 2496	2756	CA91.exe	33
PID 2756 wrote to memory of 2496	2756	CA91.exe	33
PID 2496 wrote to memory of 2456	2496	yiueea.exe	34
PID 2496 wrote to memory of 2456	2496	yiueea.exe	34
PID 2496 wrote to memory of 2456	2496	yiueea.exe	34
PID 2496 wrote to memory of 2456	2496	yiueea.exe	34
PID 2496 wrote to memory of 2724	2496	yiueea.exe	36
PID 2496 wrote to memory of 2724	2496	yiueea.exe	36
PID 2496 wrote to memory of 2724	2496	yiueea.exe	36
PID 2496 wrote to memory of 2724	2496	yiueea.exe	36
PID 2724 wrote to memory of 2480	2724	cmd.exe	38
PID 2724 wrote to memory of 2480	2724	cmd.exe	38
PID 2724 wrote to memory of 2480	2724	cmd.exe	38
PID 2724 wrote to memory of 2480	2724	cmd.exe	38
PID 2724 wrote to memory of 1984	2724	cmd.exe	39
PID 2724 wrote to memory of 1984	2724	cmd.exe	39
PID 2724 wrote to memory of 1984	2724	cmd.exe	39
PID 2724 wrote to memory of 1984	2724	cmd.exe	39
PID 2724 wrote to memory of 324	2724	cmd.exe	40
PID 2724 wrote to memory of 324	2724	cmd.exe	40
PID 2724 wrote to memory of 324	2724	cmd.exe	40
PID 2724 wrote to memory of 324	2724	cmd.exe	40
PID 2724 wrote to memory of 560	2724	cmd.exe	41
PID 2724 wrote to memory of 560	2724	cmd.exe	41
PID 2724 wrote to memory of 560	2724	cmd.exe	41
PID 2724 wrote to memory of 560	2724	cmd.exe	41
PID 2724 wrote to memory of 2708	2724	cmd.exe	42
PID 2724 wrote to memory of 2708	2724	cmd.exe	42
PID 2724 wrote to memory of 2708	2724	cmd.exe	42
PID 2724 wrote to memory of 2708	2724	cmd.exe	42
PID 2724 wrote to memory of 2760	2724	cmd.exe	43
PID 2724 wrote to memory of 2760	2724	cmd.exe	43
PID 2724 wrote to memory of 2760	2724	cmd.exe	43
PID 2724 wrote to memory of 2760	2724	cmd.exe	43
PID 2496 wrote to memory of 1052	2496	yiueea.exe	45
PID 2496 wrote to memory of 1052	2496	yiueea.exe	45
PID 2496 wrote to memory of 1052	2496	yiueea.exe	45
PID 2496 wrote to memory of 1052	2496	yiueea.exe	45
PID 2732 wrote to memory of 1408	2732	B7AB.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1292

C:\Users\Admin\AppData\Local\Temp\B7AB.exe
C:\Users\Admin\AppData\Local\Temp\B7AB.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\B7AB.exe
  C:\Users\Admin\AppData\Local\Temp\B7AB.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\e5c1bb69-51fb-40eb-9958-cd405e84a26a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\B7AB.exe
    "C:\Users\Admin\AppData\Local\Temp\B7AB.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\B7AB.exe
      "C:\Users\Admin\AppData\Local\Temp\B7AB.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:524
    - - C:\Users\Admin\AppData\Local\df1af36b-77fe-45dd-be19-a0935b207f20\build2.exe
        
        "C:\Users\Admin\AppData\Local\df1af36b-77fe-45dd-be19-a0935b207f20\build2.exe"
        5⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\df1af36b-77fe-45dd-be19-a0935b207f20\build3.exe
        
        "C:\Users\Admin\AppData\Local\df1af36b-77fe-45dd-be19-a0935b207f20\build3.exe"
        5⤵
        
        PID:688
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1992

C:\Users\Admin\AppData\Local\Temp\BB64.exe
C:\Users\Admin\AppData\Local\Temp\BB64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2824

C:\Users\Admin\AppData\Local\Temp\CA91.exe
C:\Users\Admin\AppData\Local\Temp\CA91.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2480
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:N"
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:R" /E
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:N"
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:R" /E
      4⤵
      PID:2760
- - C:\Users\Admin\AppData\Local\Temp\1000062001\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000062001\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\1000062001\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000062001\toolspub2.exe"
      4⤵
      PID:300
- - C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
    "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2596
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:2736
- - C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
    "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2420
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      PID:2444
- - C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
    "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
    3⤵
    - Executes dropped EXE
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\1000063001\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\1000063001\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
    "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
    3⤵
    - Executes dropped EXE
    PID:3012
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:2548
- - C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
    "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
    "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
    3⤵
    - Executes dropped EXE
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\1000064001\aafg31.exe
    "C:\Users\Admin\AppData\Local\Temp\1000064001\aafg31.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe
    "C:\Users\Admin\AppData\Local\Temp\1000397001\taskhost.exe"
    3⤵
    - Executes dropped EXE
    PID:2696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:548
- - C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe
    "C:\Users\Admin\AppData\Local\Temp\1000399001\msedge.exe"
    3⤵
    - Executes dropped EXE
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe
    "C:\Users\Admin\AppData\Local\Temp\1000398001\winlog.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2688

C:\Users\Admin\AppData\Local\Temp\DCBB.exe
C:\Users\Admin\AppData\Local\Temp\DCBB.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E0F1.dll
1⤵
PID:2352
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\E0F1.dll
  2⤵
  - Loads dropped DLL
  PID:876

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E574.dll
1⤵
PID:2172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\E574.dll
  2⤵
  - Loads dropped DLL
  PID:688

C:\Users\Admin\AppData\Local\Temp\E96B.exe
C:\Users\Admin\AppData\Local\Temp\E96B.exe
1⤵
- Executes dropped EXE
PID:948
- C:\Users\Admin\AppData\Local\Temp\E96B.exe
  C:\Users\Admin\AppData\Local\Temp\E96B.exe
  2⤵
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\E96B.exe
    "C:\Users\Admin\AppData\Local\Temp\E96B.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:3012

C:\Users\Admin\AppData\Local\Temp\EB50.exe
C:\Users\Admin\AppData\Local\Temp\EB50.exe
1⤵
- Executes dropped EXE
PID:1876

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\EEE9.dll
1⤵
PID:1820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\EEE9.dll
  2⤵
  - Loads dropped DLL
  PID:2532

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\FB59.dll
1⤵
PID:3028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\FB59.dll
  2⤵
  - Loads dropped DLL
  PID:2224

C:\Users\Admin\AppData\Local\Temp\20E.exe
C:\Users\Admin\AppData\Local\Temp\20E.exe
1⤵
- Executes dropped EXE
PID:1840

C:\Users\Admin\AppData\Local\Temp\1273.exe
C:\Users\Admin\AppData\Local\Temp\1273.exe
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\system32\taskeng.exe
taskeng.exe {2B101556-8032-40DD-82D1-16CF3E963570} S-1-5-21-686452656-3203474025-4140627569-1000:UUVOHKNL\Admin:Interactive:[1]
1⤵
PID:2540
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  2⤵
  PID:1524

C:\Users\Admin\AppData\Local\Temp\31B7.exe
C:\Users\Admin\AppData\Local\Temp\31B7.exe
1⤵
- Executes dropped EXE
PID:616

C:\Users\Admin\AppData\Local\Temp\38D9.exe
C:\Users\Admin\AppData\Local\Temp\38D9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1324

C:\Users\Admin\AppData\Local\Temp\3A22.exe
C:\Users\Admin\AppData\Local\Temp\3A22.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1096

C:\Users\Admin\AppData\Local\Temp\3CE1.exe
C:\Users\Admin\AppData\Local\Temp\3CE1.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\AppData\Local\Temp\53CB.exe
C:\Users\Admin\AppData\Local\Temp\53CB.exe
1⤵
- Executes dropped EXE
PID:884

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5987.dll
1⤵
PID:2936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5987.dll
  2⤵
  PID:1020

C:\Users\Admin\AppData\Local\Temp\5DFB.exe
C:\Users\Admin\AppData\Local\Temp\5DFB.exe
1⤵
- Executes dropped EXE
PID:2216

C:\Users\Admin\AppData\Local\Temp\62CC.exe
C:\Users\Admin\AppData\Local\Temp\62CC.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Users\Admin\AppData\Local\Temp\8193.exe
C:\Users\Admin\AppData\Local\Temp\8193.exe
1⤵
PID:2436
- C:\Users\Admin\AppData\Local\Temp\8193.exe
  C:\Users\Admin\AppData\Local\Temp\8193.exe
  2⤵
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\8193.exe
    "C:\Users\Admin\AppData\Local\Temp\8193.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:608

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8A4B.dll
1⤵
PID:1740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8A4B.dll
  2⤵
  PID:2336

C:\Users\Admin\AppData\Local\Temp\90F0.exe
C:\Users\Admin\AppData\Local\Temp\90F0.exe
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Scripting

T1064

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery