0408bf901d6a03e633db081462569983338e70a6302642ceed9eb856fe19eac0

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1040558c7dc87a46be07caf72321cd8e.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1040558c7dc87a46be07caf72321cd8e.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1040558c7dc87a46be07caf72321cd8e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1040558c7dc87a46be07caf72321cd8e.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Wine	1040558c7dc87a46be07caf72321cd8e.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1"	1040558c7dc87a46be07caf72321cd8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableRoutinelyTakingAction = "1"	1040558c7dc87a46be07caf72321cd8e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fsp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1040558c7dc87a46be07caf72321cd8e.exe"	1040558c7dc87a46be07caf72321cd8e.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1040558c7dc87a46be07caf72321cd8e.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	checkip.dyndns.org

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\hpis.dll	1040558c7dc87a46be07caf72321cd8e.exe
File created	C:\Windows\system32\hpim.dll	1040558c7dc87a46be07caf72321cd8e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5068	1040558c7dc87a46be07caf72321cd8e.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts.Lists	1040558c7dc87a46be07caf72321cd8e.exe
File opened for modification	C:\Windows\PLA	1040558c7dc87a46be07caf72321cd8e.exe
File created	C:\Windows\PLA\userfsp.exe	1040558c7dc87a46be07caf72321cd8e.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4588	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	1040558c7dc87a46be07caf72321cd8e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	1040558c7dc87a46be07caf72321cd8e.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	1040558c7dc87a46be07caf72321cd8e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	1040558c7dc87a46be07caf72321cd8e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	1040558c7dc87a46be07caf72321cd8e.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5068	1040558c7dc87a46be07caf72321cd8e.exe
5068	1040558c7dc87a46be07caf72321cd8e.exe
5068	1040558c7dc87a46be07caf72321cd8e.exe
5068	1040558c7dc87a46be07caf72321cd8e.exe
5068	1040558c7dc87a46be07caf72321cd8e.exe
5068	1040558c7dc87a46be07caf72321cd8e.exe
5068	1040558c7dc87a46be07caf72321cd8e.exe
5068	1040558c7dc87a46be07caf72321cd8e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2720	5068	1040558c7dc87a46be07caf72321cd8e.exe	105
PID 5068 wrote to memory of 2720	5068	1040558c7dc87a46be07caf72321cd8e.exe	105
PID 5068 wrote to memory of 2720	5068	1040558c7dc87a46be07caf72321cd8e.exe	105
PID 5068 wrote to memory of 4588	5068	1040558c7dc87a46be07caf72321cd8e.exe	98
PID 5068 wrote to memory of 4588	5068	1040558c7dc87a46be07caf72321cd8e.exe	98
PID 5068 wrote to memory of 4588	5068	1040558c7dc87a46be07caf72321cd8e.exe	98
PID 2720 wrote to memory of 1816	2720	net.exe	100
PID 2720 wrote to memory of 1816	2720	net.exe	100
PID 2720 wrote to memory of 1816	2720	net.exe	100

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1040558c7dc87a46be07caf72321cd8e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1040558c7dc87a46be07caf72321cd8e.exe

C:\Users\Admin\AppData\Local\Temp\1040558c7dc87a46be07caf72321cd8e.exe
"C:\Users\Admin\AppData\Local\Temp\1040558c7dc87a46be07caf72321cd8e.exe"
1⤵
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer Phishing Filter
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5068
- C:\Windows\SysWOW64\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\PLA\userfsp.exe"
  2⤵
  PID:912
- C:\Windows\SysWOW64\net.exe
  net stop windefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop windefend
1⤵
PID:1816

C:\Windows\PLA\userfsp.exe
C:\Windows\PLA\userfsp.exe
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion