dcrat | ac0c0dbb347d0ed2096610d72ef708415f29ecc0bb560ff62bffd31675637fd4

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	15949a8ac89553949278777a580044ac.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WmiPrvSE.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	15949a8ac89553949278777a580044ac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	15949a8ac89553949278777a580044ac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WmiPrvSE.exe

Executes dropped EXE 1 IoCs

pid	Process
332	WmiPrvSE.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine	15949a8ac89553949278777a580044ac.exe
Key opened	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
1960	cmd.exe
1960	cmd.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\pnpsetup\\WmiPrvSE.exe\""	15949a8ac89553949278777a580044ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\pnpsetup\\WmiPrvSE.exe\""	15949a8ac89553949278777a580044ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\720a7ca2-9b9e-11ee-89df-aefc3be66ef1\\csrss.exe\""	15949a8ac89553949278777a580044ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\720a7ca2-9b9e-11ee-89df-aefc3be66ef1\\csrss.exe\""	15949a8ac89553949278777a580044ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\NlsLexicons0022\\spoolsv.exe\""	15949a8ac89553949278777a580044ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\NlsLexicons0022\\spoolsv.exe\""	15949a8ac89553949278777a580044ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\WPDShextAutoplay\\csrss.exe\""	15949a8ac89553949278777a580044ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\WPDShextAutoplay\\csrss.exe\""	15949a8ac89553949278777a580044ac.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	15949a8ac89553949278777a580044ac.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	15949a8ac89553949278777a580044ac.exe
File opened for modification	\??\PhysicalDrive0	WmiPrvSE.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbem\pnpsetup\WmiPrvSE.exe	15949a8ac89553949278777a580044ac.exe
File created	C:\Windows\SysWOW64\wbem\pnpsetup\24dbde2999530ef5fd907494bc374d663924116c	15949a8ac89553949278777a580044ac.exe
File created	C:\Windows\SysWOW64\NlsLexicons0022\spoolsv.exe	15949a8ac89553949278777a580044ac.exe
File created	C:\Windows\SysWOW64\NlsLexicons0022\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	15949a8ac89553949278777a580044ac.exe
File created	C:\Windows\SysWOW64\WPDShextAutoplay\csrss.exe	15949a8ac89553949278777a580044ac.exe
File opened for modification	C:\Windows\SysWOW64\WPDShextAutoplay\csrss.exe	15949a8ac89553949278777a580044ac.exe
File created	C:\Windows\SysWOW64\WPDShextAutoplay\886983d96e3d3e31032c679b2d4ea91b6c05afef	15949a8ac89553949278777a580044ac.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2024	15949a8ac89553949278777a580044ac.exe
332	WmiPrvSE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2608	schtasks.exe
2144	schtasks.exe
1716	schtasks.exe
2632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2024	15949a8ac89553949278777a580044ac.exe
2024	15949a8ac89553949278777a580044ac.exe
2024	15949a8ac89553949278777a580044ac.exe
2024	15949a8ac89553949278777a580044ac.exe
2024	15949a8ac89553949278777a580044ac.exe
2024	15949a8ac89553949278777a580044ac.exe
332	WmiPrvSE.exe
332	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	15949a8ac89553949278777a580044ac.exe
Token: SeDebugPrivilege	332	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1960	2024	15949a8ac89553949278777a580044ac.exe	34
PID 2024 wrote to memory of 1960	2024	15949a8ac89553949278777a580044ac.exe	34
PID 2024 wrote to memory of 1960	2024	15949a8ac89553949278777a580044ac.exe	34
PID 2024 wrote to memory of 1960	2024	15949a8ac89553949278777a580044ac.exe	34
PID 1960 wrote to memory of 1168	1960	cmd.exe	36
PID 1960 wrote to memory of 1168	1960	cmd.exe	36
PID 1960 wrote to memory of 1168	1960	cmd.exe	36
PID 1960 wrote to memory of 1168	1960	cmd.exe	36
PID 1960 wrote to memory of 1284	1960	cmd.exe	37
PID 1960 wrote to memory of 1284	1960	cmd.exe	37
PID 1960 wrote to memory of 1284	1960	cmd.exe	37
PID 1960 wrote to memory of 1284	1960	cmd.exe	37
PID 1284 wrote to memory of 1488	1284	w32tm.exe	38
PID 1284 wrote to memory of 1488	1284	w32tm.exe	38
PID 1284 wrote to memory of 1488	1284	w32tm.exe	38
PID 1284 wrote to memory of 1488	1284	w32tm.exe	38
PID 1960 wrote to memory of 332	1960	cmd.exe	39
PID 1960 wrote to memory of 332	1960	cmd.exe	39
PID 1960 wrote to memory of 332	1960	cmd.exe	39
PID 1960 wrote to memory of 332	1960	cmd.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15949a8ac89553949278777a580044ac.exe
"C:\Users\Admin\AppData\Local\Temp\15949a8ac89553949278777a580044ac.exe"
1⤵
- Modifies WinLogon for persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jEEliCGCGs.bat"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:1488
- - C:\Windows\SysWOW64\wbem\pnpsetup\WmiPrvSE.exe
    "C:\Windows\System32\wbem\pnpsetup\WmiPrvSE.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\WPDShextAutoplay\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\pnpsetup\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\720a7ca2-9b9e-11ee-89df-aefc3be66ef1\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons0022\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion